Why it matters
The Act allows penalties of up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach. It also changes everyday processes: consent, notices, handling requests and working with processors.
What to get right
- Map what personal data you hold, where it flows and who processes it. This takes longest, so start first.
- Make consent specific, informed and easy to withdraw, and keep records you can produce.
- Prepare to notify the Data Protection Board of India and affected individuals of breaches.
- Update contracts with vendors who process personal data on your behalf.
Common questions
When does the DPDP Act apply?
The Act is brought into force in stages through rules made by the central government. Check the latest notified timelines, as obligations and dates are phased.
Does the Act apply to data about employees?
Yes. It covers digital personal data generally, although certain purposes such as employment have specific provisions. Take legal advice on your circumstances.