The DPDP Act: What Indian Businesses Must Actually Do

The core obligations

1. Notice: an itemised notice at or before seeking consent, stating what data is collected and for what purpose, in clear language and available in the Eighth Schedule languages.

2. Consent: free, specific, informed, unconditional and unambiguous, with a clear affirmative action, and as easy to withdraw as to give.

3. Purpose limitation: data may be used only for the purpose consented to.

4. Accuracy and security: reasonable safeguards to prevent breach.

5. Erasure: on withdrawal of consent or once the purpose is served, unless retention is legally required.

6. Grievance redressal: a published mechanism and a contactable person.

Legitimate uses

Consent is not required for certain legitimate uses: where the person voluntarily provides data for a purpose and has not objected, for employment purposes, for compliance with law or a court order, for medical emergencies, and for specified State functions.

The employment exception is broad and useful, covering data processed for safeguarding the employer from loss, for provision of services or benefits to employees, and for attendance and payroll.

Breach reporting

Every personal data breach must be reported to the Data Protection Board and to each affected person. There is no materiality threshold in the Act itself — the obligation is framed broadly.

Penalties for failing to take reasonable security safeguards to prevent a breach reach two hundred and fifty crore rupees, which is the highest in the Act's schedule.

Practical first steps

Map what personal data you hold, where it sits and who can reach it. Rewrite consent flows to be itemised and specific rather than bundled into terms of service. Build an erasure process, because an unactionable right is a breach waiting to be reported.

Set retention periods per data category and enforce them — holding data longer than its purpose requires is itself non-compliance, which cuts against the instinct to keep everything forever.

Frequently asked questions

### Does the DPDP Act apply to small businesses?

Yes. Any person determining the purpose and means of processing digital personal data is a data fiduciary. Certain obligations may be relaxed for notified classes including start-ups, but the core duties apply broadly.

### What is the penalty for a data breach?

Up to two hundred and fifty crore rupees for failure to take reasonable security safeguards to prevent a breach, and up to two hundred crore for failure to notify the Board and affected persons.

### Do I need consent to process employee data?

Not for most employment purposes. The legitimate uses provision covers processing for employment, including safeguarding the employer from loss, providing services or benefits to employees, and attendance and payroll.