Introduction
The Digital Personal Data Protection Act (DPDPA) 2023, expected to be fully implemented by 2025, is India’s first comprehensive law dedicated to governing the use, processing, and storage of digital personal data. It reflects a major shift in India’s digital regulatory framework, placing strong emphasis on the protection of individual privacy and personal data rights. The DPDPA is designed to create a balance between the rights of individuals (Data Principals) and the lawful interests of businesses (Data Fiduciaries). Inspired by global data protection frameworks such as the European Union’s GDPR, it sets out detailed requirements for how businesses should collect, handle, store, and process personal data in India.
Core Principles of the DPDPA
The DPDPA is based on important foundational principles including purpose limitation, consent-based data processing, data minimization, storage limitation, accuracy, accountability, and transparency. These principles are embedded throughout the Act and form the guiding standards for all data handling practices in India. Businesses must not only comply with these principles in letter but also in spirit, by redesigning internal processes and technologies.
Requirement of Valid Consent
The Act mandates that no personal data shall be processed without obtaining explicit, clear, and informed consent from the individual. Consent must be free, specific, informed, unambiguous, and given through affirmative action. Individuals must also have the ability to withdraw consent at any point.
Impact on Businesses
Businesses must redesign all user interfaces where personal data is collected—such as websites, forms, and mobile applications—to include transparent consent forms and options to revoke consent. The commonly used practices of passive consent or bundled terms and conditions are no longer allowed. Every business must track consent and show proof that it was legally obtained.
Example
If Flipkart collects user data for sending promotional emails, it must show a separate opt-in checkbox where users can agree or disagree. It cannot automatically enroll users in marketing communication by default.
Obligations of Data Fiduciaries
Under the DPDPA, all businesses that handle personal data are known as Data Fiduciaries and must follow legal obligations such as informing users about the purpose of data collection, processing data only for legitimate use, ensuring data accuracy, implementing security safeguards, and allowing users to exercise their rights. Fiduciaries are expected to build systems that support these requirements.
Example
An app like Practo that stores sensitive health data must now provide a mechanism for users to correct errors in their medical history or delete outdated records, while ensuring data is encrypted and protected from unauthorized access.
Purpose Limitation and Data Minimization
The DPDPA requires that data be collected only for specific and declared purposes. The purpose must be shared with the user at the time of consent, and businesses are expected to collect only data that is strictly necessary for the stated purpose. Collecting extra data “just in case” is not allowed under this law.
Example
A ticket booking platform like IRCTC can ask for the passenger’s name, age, and ID, but it cannot ask for income, education level, or religious beliefs unless that data is essential for the service being provided.
Data Principal Rights
The DPDPA introduces several important rights for individuals, including the right to access their data, the right to correct inaccuracies, the right to delete data, the right to be informed, and the right to withdraw consent. Businesses are obligated to create internal systems to allow users to exercise these rights efficiently.
Example
If a Zomato user decides to delete their profile and all order history, Zomato must comply with this request and confirm the deletion. They must not keep any data unless it is legally required (such as for tax records).
Consent Managers
DPDPA introduces the concept of Consent Managers—neutral platforms authorized by the government to help individuals manage their consents across platforms. These managers can help users view, withdraw, or provide consent for multiple services from a single dashboard.
Example
A financial app like PhonePe might integrate with a consent manager such as Sahamati, enabling users to manage their consents for data sharing with various banks, lenders, and apps.
Children’s Data Protection
Special provisions are made for protecting the personal data of children under the age of 18. Parental consent is mandatory before processing data of minors. Businesses are also restricted from conducting behavioral tracking or serving targeted advertisements to minors.
Example
EdTech platforms like Byju’s must collect verifiable parental consent before enrolling a child and must ensure no personalized ads or data tracking are done on children’s usage patterns.
Cross-Border Data Transfer Rules
The law allows data to be transferred to countries that the Indian government notifies from time to time. This is a more relaxed stance compared to earlier drafts that called for strict data localization. However, the receiving countries must have strong data protection standards in place.
Example
Amazon India may process some of its data using servers in the United States, provided the US is among the countries approved by the Indian government and Amazon ensures compliance with Indian laws.
Data Breach Notification Requirements
In the event of a data breach, businesses must inform both the affected individuals and the Data Protection Board of India. Timely reporting and transparency are emphasized to ensure users are not kept in the dark.
Example
If Paytm faces a cyberattack in which credit card details are leaked, the company must immediately notify all affected users, publish a disclosure, and report the incident to the Data Protection Board.
Significant Data Fiduciaries (SDFs)
Some businesses will be classified as Significant Data Fiduciaries (SDFs) based on factors such as volume and sensitivity of data handled, potential impact on user rights, and scale of operations. These businesses will be subject to enhanced obligations like data audits, privacy impact assessments, appointing Data Protection Officers, and publishing compliance reports.
Example
Jio, which manages sensitive call records and customer data, would likely be an SDF and must hire a full-time Data Protection Officer and regularly submit reports to the Data Protection Board.
Penalties and Enforcement
The DPDPA establishes a Data Protection Board that will monitor compliance, investigate complaints, and impose penalties. Financial penalties for non-compliance can go up to ₹250 crore for serious violations. The Board can also recommend remedial actions and initiate legal proceedings.
Example
If MakeMyTrip fails to provide a user with access to their personal data within the required time, or continues using deleted data, the company can be fined and investigated by the Board.
Impact on Specific Sectors
E-commerce platforms must be careful with recommendation engines and user profiling. They must collect only necessary data and obtain explicit consent for marketing. Healthcare organizations must follow data encryption and access control standards while allowing data corrections. Financial institutions will need robust security infrastructure and must implement customer-controlled consent flows. EdTech firms must ensure no behavioral tracking of minors. Startups will face compliance costs but can benefit from early adoption and user trust.
Opportunities for Businesses
While the DPDPA presents a strong compliance challenge, it also offers new business opportunities. Companies that proactively follow the law will earn customer trust, become eligible for international partnerships, and strengthen brand reputation. Businesses that prioritize data protection can turn compliance into a competitive advantage.
Conclusion
The DPDPA 2023/2025 is a transformative law that impacts every stage of data handling—from collection and storage to sharing and deletion. It requires Indian businesses to treat personal data with transparency, accountability, and respect. Although compliance will involve reworking policies, building consent mechanisms, training staff, and deploying secure technologies, the long-term benefits include increased user trust, reduced risk of data breaches, and enhanced global competitiveness. By embedding privacy-by-design and user rights into their systems, businesses can not only meet legal requirements but also lead the way in building a responsible digital economy in India.
