What Is DPDP, Why It's Important, and What SMBs Need to Know

On 11 August 2023, India enacted the Digital Personal Data Protection Act, 2023 (DPDP Act) - the country's first comprehensive data protection legislation.

After nearly five years of drafts, stakeholder consultations, and parliamentary debate, the law received Presidential assent and set in motion a fundamental reset of how Indian businesses collect, process, and store personal data. The framework was fully operationalised on 13 November 2025, when the Government of India notified the Digital Personal Data Protection (DPDP) Rules, 2025.

If you run a business in India - whether a neighbourhood salon, a dental clinic, a coaching centre, or a mid-sized SaaS company - the DPDP Act now governs how you handle customer phone numbers, email addresses, Aadhaar details, and every other piece of digital personal data in your possession. The penalties for getting it wrong are severe: up to ₹250 crore per contravention for failing to implement reasonable security safeguards, and up to ₹200 crore for failing to report a data breach to the Data Protection Board.

This article explains what the DPDP framework actually says, why the government introduced it now, what it wants to achieve, and - most importantly - what small and medium businesses (SMBs) must do to comply without hiring a 20-person legal team.

---

What Is the DPDP Act?

The DPDP Act is a parliamentary statute that provides the legal architecture for processing digital personal data in India.

It applies to:

• All personal data collected in digital form
• Non-digital personal data that is subsequently digitised
• Processing conducted outside India if connected with offering goods or services to individuals in India

The Act creates two primary roles that every business must understand:

• Data Fiduciary: Any person or entity that determines the purpose and means of processing personal data - essentially, every business, government body, or organisation that collects customer data
• Data Principal: The individual whose personal data is being processed - your customer, patient, student, or tenant

The DPDP Rules, 2025 serve as the operational manual that translates the Act's broad principles into day-to-day compliance obligations. They specify how notices must be formatted, how consent must be obtained, what security standards are expected, and how the grievance redressal mechanism works.

Why Now? From IT Act 2000 to DPDP 2023

India's previous data protection framework - Section 43A of the Information Technology Act, 2000 and the IT (Reasonable Security Practices) Rules, 2011 - was narrow, outdated, and lacked enforcement teeth. It applied only to a limited category of sensitive personal data like health records and financial information, leaving the vast majority of personal data completely unregulated.

The DPDP Act replaces this patchwork entirely. It covers all personal data - not just sensitive categories - and imposes structured obligations on every Data Fiduciary, regardless of size or sector.

The timing is deliberate. India is now a data-driven economy with over 900 million internet users, a booming digital payments ecosystem built on UPI, and a thriving startup landscape. Without a modern data protection framework, citizen trust in digital services would erode, foreign investment would hesitate, and India's digital public infrastructure would face credibility risks.

Implementation Timeline

Phase	Date	What Happens
Rules Notified	13 November 2025	Data Protection Board constituted; consent and notice obligations active
Consent Manager Framework	~November 2026	Consent Manager registration and operations begin
Full Enforcement	14 May 2027	All major obligations, including Significant Data Fiduciary rules

What the Government Wants to Achieve

1. Citizen-Centric Data Governance

The framework puts individual rights at the centre. Every Indian now has enforceable rights to access their data, correct inaccuracies, demand erasure, and withdraw consent at any time. The right to withdraw consent must be as seamless as the act of giving it - a deliberate design principle that forces businesses to rethink their data collection practices from the ground up.

2. Attracting Investment and Enabling Innovation

By clarifying cross-border data transfer rules and removing mandatory data localisation requirements, the Act aims to make India an attractive destination for global technology investment while still protecting citizens.

3. Replacing a Broken Patchwork

Section 43A and the SPDI Rules were limited in scope, poorly enforced, and increasingly irrelevant to how modern businesses actually operate. The DPDP Act creates a single, comprehensive regime that applies uniformly across sectors.

4. Protecting Children in Digital Spaces

Section 9 of the Act introduces India's strongest-ever protections for minors, prohibiting behavioural tracking, targeted advertising, and processing of children's data without verifiable parental consent.

The Core Provisions Every Business Must Understand

No Processing Without a Lawful Basis

You cannot collect or use personal data without a legal basis. For most businesses, that basis is explicit consent from the individual.

Notice Before Consent

You cannot ask for consent without first giving a clear notice that explains: what personal data will be collected, the purpose of processing, how the individual can exercise their rights, and how they can lodge a complaint. This notice must be standalone and accessible - not buried in a 40-page terms-of-service document.

The Quality of Consent Matters

Consent must be free, specific, informed, unconditional, and unambiguous, given through a clear affirmative action, and limited to the data necessary for the stated purpose. Pre-ticked checkboxes, passive scroll behaviour, and vague "by using our service, you agree" statements do not qualify as valid consent under Indian law.

Data Must Be Deleted When No Longer Needed

The Rules mandate that personal data may be stored for a maximum of three years from the date of the last interaction with the Data Principal. Data Fiduciaries must notify individuals at least 48 hours before erasing their data, giving them the option to retain it.

Breach Notification Is Not Optional

If your customer database is leaked, stolen, or accidentally exposed, you must inform the Data Protection Board within 72 hours of becoming aware of the incident. The penalty for silence is up to ₹200 crore.

Penalties at a Glance

Violation	Maximum Penalty
Failure to implement reasonable security safeguards	₹250 crore
Failure to notify the Data Protection Board of a breach	₹200 crore
Non-compliance with children's data obligations	₹100 crore
Other Data Fiduciary duty failures	₹50 crore
Data Principal filing false complaints	₹10,000

What SMBs Specifically Need to Understand

Large corporations have entire compliance departments. SMBs do not. Yet the Act applies equally to a neighbourhood bakery collecting phone numbers for delivery and to a unicorn SaaS company. There is no small business exemption in the Act.

You Are a Data Fiduciary

The moment you decide why and how personal data is collected - whether via a Google Form, a WhatsApp chat, or a booking app - you are a Data Fiduciary with legal obligations.

Verbal Permission Is Not Consent

That WhatsApp message where a customer shared their address? That spreadsheet where you pasted phone numbers collected at a networking event? Under DPDP, none of this constitutes valid consent unless you gave prior notice and obtained clear affirmative consent for a specified purpose.

Data Minimisation Is Mandatory

You cannot collect "just in case" data. The Act requires that you collect only what is strictly necessary for the stated purpose, and delete it when that purpose ends.

Children's Data Is a Separate Minefield

If you run a coaching centre, a school, a gaming app, or any business that may process data of individuals under 18, you need verifiable parental consent - which may involve identity verification via DigiLocker - and you cannot track their behaviour or show targeted advertising.

A Practical Compliance Roadmap for SMBs

You do not need a ₹50 lakh consultant to get started. Full enforcement kicks in on 14 May 2027.

Phase 1 - Data Audit (Weeks 1-2)

Map every piece of personal data you collect: customer names, phone numbers, addresses, Aadhaar copies, payment details, employee records. Document where it lives - Google Sheets, WhatsApp, CRM, email inboxes, physical files.

Phase 2 - Consent Cleanup (Weeks 3-4)

For every active data collection point, add a clear notice stating what you collect and why. Implement a consent mechanism that requires an explicit affirmative action and records the timestamp.

Phase 3 - Privacy Policy Rewrite (Week 5)

Your privacy policy must be simple, transparent, and written in plain language. It should cover: what data you collect, why you collect it, how long you retain it, what rights the individual has, and how they can raise a grievance.

Phase 4 - Security Baseline (Weeks 6-8)

Enable two-factor authentication on all systems storing customer data. Implement encryption for stored data. Maintain audit logs of data access for at least one year.

Phase 5 - Breach Response Plan (Week 9)

Assign one person internally to own data breach incidents. Document the steps: contain the breach, assess scope, notify the Data Protection Board within 72 hours, and inform affected customers.

Phase 6 - Annual Review (Ongoing)

Compliance is not a one-time event. Conduct quarterly reviews of your data collection practices. Delete data you no longer need.

---

This blog is the first in a series on DPDP compliance for Indian businesses. Next: GDPR vs DPDP: What India's Data Protection Law Does Differently →