Short answer: The Digital Personal Data Protection (DPDP) Act, 2023 applies to almost every Indian business that collects personal data digitally, including through website forms, WhatsApp, CRMs and apps. Under the DPDP Rules, 2025, most obligations become enforceable in May 2027. To comply, you need clear privacy notices, valid consent, easy consent withdrawal, a grievance contact, reasonable security safeguards, breach reporting and defined data retention.
This guide explains the technical and operational side of DPDP compliance in plain language. It is not legal advice; confirm your specific obligations with a qualified legal adviser.
What is the DPDP Act?
The Digital Personal Data Protection Act, 2023 (DPDP Act or DPDPA) is India’s data protection law. It sets out how organisations, called Data Fiduciaries, may collect and use the personal data of individuals, called Data Principals. The DPDP Rules, 2025, notified by the Ministry of Electronics and IT (MeitY) in November 2025, explain how the Act works in practice.
DPDP compliance timeline: key dates
| When | What applies |
|---|---|
| November 2025 | Rules notified; Data Protection Board of India framework and definitions take effect |
| November 2026 | Registration and obligations for Consent Managers |
| May 2027 (18 months after notification) | Most obligations for businesses: notice and consent, security safeguards, breach reporting, data retention and erasure, children’s data, rights of Data Principals, and Board penalties |
The remaining months are a readiness window. Updating websites, forms, software and processes takes time, so it is sensible to start now. Keep an eye on MeitY notifications, as clarifications and orders continue to be issued.
Does the DPDP Act apply to my business?
If you collect personal data in digital form, or collect it on paper and later digitise it, the Act very likely applies, whatever your size. There is no general exemption for small businesses. Typical examples:
- A website enquiry or booking form collecting names, phone numbers and emails
- WhatsApp chats with customers or patients
- Customer databases in a CRM, Excel sheet or billing software
- Online stores, apps, newsletters and lead-generation ads
- Staff and job-applicant records
- Hospitals and clinics holding patient records, appointments and reports
Key DPDP obligations explained
1. Privacy notice
Before or at the time you ask for consent, give a clear, standalone notice describing what personal data you collect, why, how people can withdraw consent, exercise their rights and complain to the Board.
2. Valid consent
Consent must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action. That means no pre-ticked boxes and separate consent for separate purposes, such as replying to an enquiry versus sending marketing messages.
3. Easy withdrawal
Withdrawing consent must be as easy as giving it. If someone can opt in with one click, they should not need to send multiple emails to opt out.
4. Rights of Data Principals
Individuals can ask to access a summary of their data, correct or update it, erase it, nominate someone to act for them, and raise grievances. The Rules set a maximum of 90 days to respond to such requests, and you must publish how to contact you about them.
5. Reasonable security safeguards
You must protect personal data with measures such as encryption, access control, monitoring and backups, and ensure your vendors (processors) do the same. The Rules require logs and related data to be kept for at least one year for specified purposes.
6. Personal data breach reporting
If a breach happens, you must inform affected individuals and the Data Protection Board, with a detailed report to the Board within 72 hours of becoming aware of it.
7. Data retention and erasure
Erase personal data when the purpose is fulfilled or consent is withdrawn, unless another law requires you to keep it, and make your processors do the same.
8. Children’s data
Processing personal data of children (under 18) requires verifiable consent from a parent or lawful guardian, and tracking, behavioural monitoring and targeted advertising directed at children are restricted.
Penalties for non-compliance
The Data Protection Board can impose significant penalties per instance of non-compliance, including up to ₹250 crore for failing to take reasonable security safeguards and up to ₹200 crore for failing to report a breach or for breaching children’s data obligations.
DPDP compliance checklist for your website and systems
- Map every place you collect personal data: forms, WhatsApp, calls, ads, CRM, software, spreadsheets
- Rewrite your privacy policy and add short notices at each form
- Add unticked, purpose-specific consent checkboxes and store consent records
- Add a cookie consent banner that blocks non-essential cookies until consent
- Provide a simple way to withdraw consent and request access, correction or deletion
- Publish a grievance contact and set up an internal process to respond within the timelines
- Secure your website and systems: SSL, strong logins, role-based access, updates, backups and logging
- Review plugins, analytics, payment, email and WhatsApp vendors and their data agreements
- Define retention periods and automate deletion in your CRM and software
- Prepare a breach response plan and train your staff
DPDP compliance for hospitals and clinics
Healthcare providers hold some of the most sensitive personal data: medical histories, reports, prescriptions and payment details. Appointment forms, WhatsApp reminders, hospital management systems and lab software all need consent records, role-based access, audit trails and clear retention rules. The NMC’s 2026 advertising guidelines also refer to the DPDP Act when patient information is used in public communication.
How Re-Infotech helps you become DPDP-ready
We handle the technical and operational implementation, working alongside your legal or compliance adviser, who confirms your legal position and approves policy wording.
- DPDP readiness audit: we map personal data across your website, forms, WhatsApp, CRM and software and list the gaps
- Website compliance: privacy notice pages, consent checkboxes, cookie consent banner, consent withdrawal and data request forms
- Consent records: storing who consented, to what and when, so you can prove it
- Security hardening: SSL, access control, updates, backups, logging and monitoring for websites and servers
- Software changes: consent logs, audit trails, role-based access and automated deletion in your CRM, HMS or custom software
- Vendor review: checking plugins, analytics, email and WhatsApp tools that process your data
- Breach readiness: an incident response plan and staff awareness sessions
Frequently asked questions
When does the DPDP Act come into force?
The DPDP Act, 2023 is being brought into force in phases under the DPDP Rules, 2025, notified in November 2025. The Data Protection Board framework applied immediately, Consent Manager provisions from November 2026, and most business obligations, such as notice, consent, security and breach reporting, from May 2027.
Does the DPDP Act apply to small businesses and clinics?
Yes, in most cases. The Act applies to anyone processing digital personal data, regardless of size, and there is no general small-business exemption. A clinic with an online appointment form, a shop with a customer list or a company with a website enquiry form will usually be covered.
What is the penalty for not complying with the DPDP Act?
The Data Protection Board can impose penalties per instance of non-compliance. These go up to ₹250 crore for failing to take reasonable security safeguards and up to ₹200 crore for failing to notify a personal data breach or for breaching obligations on children’s data.
Is a cookie banner required under the DPDP Act?
Where cookies or trackers collect personal data and you rely on consent, you need a clear notice and a valid way to obtain and withdraw consent. A cookie consent banner that blocks non-essential cookies until the visitor agrees is the practical way to do this on a website.
Do I need a Data Protection Officer under DPDP?
Only Significant Data Fiduciaries, a category notified by the government, must appoint a Data Protection Officer based in India. Other businesses must still publish contact details of a person who can answer questions about personal data processing and handle grievances.
Need help with this?
Get your website, forms and systems DPDP-ready before the 2027 deadline. Ask us for a DPDP readiness audit of your website and software, or see our IT infrastructure and software development services.