DPDP Act Explained (Part 1): Who It Covers and When It Bites
DPDP Act Part 1: key terms, who the law covers, what's exempt and the 2025–2027 commencement dates, explained for startups and manufacturers in Hyderabad.
A Hyderabad founder recently told us, “We are a B2B startup. We don’t hold consumer data, so the privacy law doesn’t apply to us.” Then we opened his CRM: 4,000 named contacts at client companies, employee Aadhaar copies in a shared drive, and a website form feeding a marketing tool. Every one of those is personal data under India’s new privacy law.
- Part 1 — What the DPDP Act is, who it covers, and when it bites (you are here)
- Part 2 — Consent, notice and the nine legitimate uses
- Part 3 — Your obligations: security, breach reporting, retention
- Part 4 — Rights, duties, children’s data, cross-border, exemptions
- Part 5 — Penalties, the Board, appeals and your compliance roadmap
This first part builds the foundation: the vocabulary, who the law covers, what it leaves out, and the dates that matter. Parts 2 to 5 then walk through consent, your obligations, people’s rights, and enforcement, ending with a practical compliance roadmap.
What is the DPDP Act, in one paragraph?
The DPDP Act (Act No. 22 of 2023) received Presidential assent on 11 August 2023. It has 44 sections and one Schedule of penalties. The Ministry of Electronics and Information Technology (MeitY) notified the operational detail, the Digital Personal Data Protection Rules, 2025, on 13 November 2025. Together, the Act and Rules set one simple bargain: you may use a person’s data only for a lawful purpose, tell them what you are doing, protect it, and delete it when you are done. The person, in turn, gets rights to know, correct, erase and complain.
The vocabulary: six roles that run the whole law
The DPDP Act avoids the familiar “data controller” language of Europe’s GDPR. Learn these terms once, and every later section will make sense.
| Term (section) | What it means | Startup / factory example |
|---|---|---|
| Personal data (s.2(t)) | Any data about an individual who is identifiable by or in relation to that data | Name, phone, email, PAN, photo, IP address linked to a user, biometric attendance record |
| Digital personal data (s.2(n)) | Personal data in digital form | CRM entries, HRMS records, scanned KYC, CCTV footage stored on a DVR |
| Data Principal (s.2(j)) | The individual the data relates to; for a child, includes the parent; for a person with disability, the lawful guardian | App user, employee, distributor’s proprietor, job applicant |
| Data Fiduciary (s.2(i)) | Anyone who, alone or with others, decides the purpose and means of processing | Your company deciding to collect customer data for deliveries |
| Data Processor (s.2(k)) | Anyone processing data on a fiduciary’s behalf | Payroll bureau, cloud host, call-centre vendor, email marketing tool |
| Processing (s.2(x)) | Wholly or partly automated operations: collection, recording, storage, use, sharing, erasure and more | Practically anything you do with the data |
| Consent Manager (s.2(g)) | A registered entity offering an interoperable platform to give, manage, review and withdraw consent | Account-aggregator style consent dashboards |
| Significant Data Fiduciary (s.10) | A fiduciary notified by the Government based on data volume, sensitivity and risk | Large platforms; most startups and SMEs will not be notified |
Who does the DPDP Act apply to?
Section 3 sets the scope. The Act applies to processing of digital personal data:
- Within India, where the data is collected in digital form, or collected offline and later digitised.
- Outside India, if the processing is connected with offering goods or services to Data Principals in India. A Dubai-based app selling to Indian users is covered.
Size does not matter. There is no turnover or user-count threshold for being a Data Fiduciary. A two-person startup and a listed manufacturer face the same core duties; only Significant Data Fiduciaries carry extra ones.
What is outside the Act?
- Personal or domestic use by an individual (your family WhatsApp group).
- Publicly available data made public by the Data Principal themselves (a public social-media post) or by someone legally required to publish it (such as directors’ names on the MCA portal).
- Purely paper records that are never digitised. The moment a paper visitor register is scanned or typed into Excel, it is in scope.
Separately, section 17 grants specific exemptions (for example, legal claims, crime investigation, and outsourced processing of foreigners’ data in India). We cover these in Part 4.
When does it come into force? The three phases
| Phase | Date | What commences |
|---|---|---|
| I | 13 November 2025 | Definitions, Data Protection Board provisions (constitution and appointments), rule-making powers, and the RTI Act amendment |
| II | 13 November 2026 | Consent Manager registration and related obligations (Rule 4) |
| III | 13 May 2027 | The substantive law: notice, consent, fiduciary obligations, children’s data, rights, cross-border, penalties and Board inquiries |
Two live developments to watch. First, in January 2026 MeitY consulted stakeholders on shortening the 18-month window, particularly for Significant Data Fiduciaries. As at 24 October 2026, we have not found an amending notification (confirm before relying on the dates above). Second, the Data Protection Board’s members were being recruited through 2026; in October 2026 the Government told the Kerala High Court the Board had been constituted but was not yet functional (confirm current status).
The practical message: about 200 days remain until 13 May 2027. Mapping data, rewriting notices, fixing vendor contracts and building consent and erasure workflows typically takes months, not weeks.
Tell us your business model and the tools you use. We’ll help you map where personal data sits and which DPDP duties apply.
WhatsApp us Email Call 99595 36391What the Act changes for your business, at a glance
| Before | From 13 May 2027 |
|---|---|
| Privacy policy buried in the website footer | Standalone, plain-language notice listing data items and purposes (Part 2) |
| Pre-ticked boxes and bundled “I agree” | Free, specific, informed, unambiguous consent by clear affirmative action (Part 2) |
| IT Act s.43A “reasonable security practices” for sensitive data | Defined security safeguards for all personal data, breach reporting to the Board within 72 hours (Part 3) |
| Data kept “just in case” | Erase once the purpose is served, unless law requires retention (Part 3) |
| Customers had limited recourse | Rights to access, correct, erase, nominate and complain, with a 90-day response window (Part 4) |
| Compensation claims under IT Act s.43A | Penalties up to ₹250 crore payable to the Government (Part 5) |
Hyderabad context
Hyderabad’s mix of SaaS and product startups around HITEC City, Kondapur and Gachibowli, global capability centres in the Financial District, and pharma and engineering manufacturers across Telangana means DPDP touches almost every business type here. Startups processing Indian users’ data are fully in scope. IT-services firms processing foreign clients’ data under contract may qualify for the section 17(1)(d) exemption, though core security duties still apply. Manufacturers face the biggest surprise through employee and dealer data.
Why work with ComplianceKart
DPDP compliance is not only an IT project. It sits across contract law (vendor and processor agreements), employment law (staff data), corporate governance (board oversight) and day-to-day operations. ComplianceKart is a boutique practice bringing CAs, CSs and advocates under one roof, much like a multi-speciality hospital where the specialists review the case together before treatment begins. We help you map data, draft notices and processor contracts, and set up workable consent and grievance processes. We do not guarantee outcomes before the Board or any authority.
Frequently asked questions
Is the DPDP Act in force now?
Partly. Board-related provisions and definitions commenced on 13 November 2025, and Consent Manager provisions commence on 13 November 2026. The core obligations and penalties apply from 13 May 2027, subject to any amending notification.
Does the DPDP Act apply to small businesses and startups?
Yes. There is no size threshold. Section 17(3) lets the Government exempt notified classes of fiduciaries, including startups, from certain provisions, but no such notification was available as at 24 October 2026 (confirm).
Does it cover employee data?
Yes. Employee data is personal data. Employers can often rely on the “employment purposes” legitimate use in section 7(i) instead of consent, but security, retention and breach duties still apply.
Are paper records covered?
Only if they are digitised. Data collected on paper and later entered into a computer system is covered from that point.
Does the DPDP Act replace GDPR for Indian companies with EU customers?
No. If you serve EU residents, GDPR can apply alongside the DPDP Act. The two overlap but differ, for example on legal grounds for processing and sensitive data.
What is the maximum penalty?
Up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach. Part 5 covers the full Schedule.
Sources
- Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) — MeitY
- PIB, “Government notifies DPDP Rules to empower citizens and protect privacy”, 14 November 2025 — pib.gov.in
- PIB, Lok Sabha reply on simplified compliance for start-ups, 3 December 2025 — pib.gov.in
Next in the series: Part 2 — Consent, notice and the nine legitimate uses. Also useful: why legal drafting is business insurance, and our Knowledge Updates library.
This article is general information on the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 as at 24 October 2026. It is not advice on any specific situation. Phased commencement dates and pending government notifications can change; check the official text on meity.gov.in before acting.
Need this done for your business?
Send us one message. A CA, CS or Advocate replies within a working day — no forms, no obligation.