India now has a proper data privacy law. And unlike many legal developments that only matter to lawyers, this affects pretty much every business owner in the country.
The Digital Personal Data Protection Act 2023, or DPDP Act, was passed by Parliament in August 2023. The implementation rules (DPDP Rules 2025) came out in November 2025. Full enforcement begins in May 2027. The Data Protection Board of India, the regulator, is already up and running.
Here's what it actually means, in plain English.
What Does the DPDP Act Do?
It sets rules for how personal data about Indian citizens can be collected, stored, used, and deleted. Personal data means any information that identifies or can be used to identify a person, such as a name, email address, phone number, address, Aadhaar number, IP address, or location data.
Before the DPDP Act, India did not have a comprehensive data protection law. Companies could, and often did, collect data with vague terms and conditions and use it quite freely. That is changing now.
Who Does It Apply To?
Every business that digitally processes the personal data of Indian users. That includes:
Startups collecting user signups
E-commerce sites storing delivery addresses
Apps accessing your location
HR software holding employee records
WhatsApp-based businesses taking customer orders
There is no exemption for small businesses, nor a minimum turnover requirement. If you collect even one Indian user's email address, the law applies to you.
The law also applies to foreign companies that offer services to Indian users. For example, a UK startup with Indian customers must comply.
What Are the Main Rules?
A few key things the law requires:
Consent before collection. You must get clear, specific consent before collecting personal data. The consent request must explain exactly what you're collecting and why. Pre-ticked checkboxes don't count.
Purpose limitation. You can only use data for the purpose you stated when you collected it. For example, if you collect an email for order updates, you cannot use it for marketing without getting new consent.
Right to erasure. Users can ask you to delete their data. You must comply.
Breach notification. If there's a data breach, you must notify the Data Protection Board within 72 hours. You also notify affected users.
Data deletion. Once you have fulfilled the purpose for which you collected the data, you must delete it. You cannot keep it just in case you need it later.
What Are the Penalties?
The penalties are serious. A single violation can result in a fine of up to ₹250 crore.
To put this in perspective, a startup that receives even a ₹50 crore fine, which is the minimum for inadequate data security, would likely not survive. In some cases, the law also creates personal liability for directors.
When Does This Actually Kick In?
The rules have been notified, and the regulator is already operational. However, there is a grace period. Most core compliance obligations must be met by May 13, 2027.
November 2026 is also a key date: the Consent Manager Framework becomes operational, requiring businesses that rely on consent to integrate with compliant systems.
It might seem like you have plenty of time. However, setting up consent flows, data mapping, vendor contracts, and breach protocols usually takes most businesses 6 to 12 months. If you wait until 2027 to start, it will be too late.
So, What Should You Do First?
Start with a DPDP assessment to understand where you currently stand. Review your sign-up forms, privacy policy, data storage practices, and vendor contracts.
You can check your DPDP compliance score for free atdcomply.in/tools. It takes 5 minutes and gives you a clear list of gaps to fix.