India's Digital Personal Data Protection Act, 2023 (DPDP Act) gives the world's largest digital population an enforceable privacy regime — and gives companies processing Indians' personal data a new set of obligations with penalties reaching ₹250 crore (roughly $30 million) per violation. If GDPR was the template, DPDP is India's leaner, consent-centric take on it.
Who the law covers
The Act applies to digital personal data processed within India, and to processing outside India when it relates to offering goods or services to people in India. It speaks in its own vocabulary: businesses are Data Fiduciaries, individuals are Data Principals, and your processors are simply extensions of your responsibility — the fiduciary answers for them.
The obligations that matter most
- Consent must be free, specific, informed and unambiguous — requested through a clear notice, in English or any of the scheduled Indian languages the user chooses.
- Data Principals get rights to access, correction, erasure and grievance redressal, with workable response mechanisms behind them.
- Breaches must be reported to the Data Protection Board and to affected individuals — there is no materiality threshold to hide behind.
- Significant Data Fiduciaries (designated by volume and risk) additionally need a Data Protection Officer in India, independent audits and periodic impact assessments.
- Cross-border transfers are permitted by default except to countries the government restricts — the inverse of GDPR's adequacy model.
How it differs from GDPR
Three differences trip up teams that assume GDPR compliance carries over. DPDP recognizes only consent and a short list of 'legitimate uses' — there is no broad legitimate-interest basis. It applies to digital personal data only, with no special-category regime. And its penalty logic is obligation-based rather than turnover-based, which makes individual failures easier to price and easier to enforce.
Getting ready
- Map every flow of Indian personal data — collection points, storage, processors, transfers.
- Rebuild consent notices and records to the Act's standard; assume the burden of proof is yours.
- Stand up rights-request and grievance workflows with named owners and deadlines.
- Check whether your scale or sector makes you a Significant Data Fiduciary, and plan for the DPO and audit duties if so.
With the DPDP Rules now operational, enforcement is a question of when, not if. The companies treating 2026 as the preparation window will meet it calmly.
