What the DPDP Act
actually asks you to do.
A plain-English walkthrough of India's Digital Personal Data Protection Act, obligation by obligation, written for the people who have to implement it rather than the people who litigate it.
Who the Act is talking to
The Act uses three terms consistently, and everything else follows from them. A Data Principal is the individual the data is about. A Data Fiduciary is whoever determines the purpose and means of processing, which for most companies reading this means you. A Data Processor processes on a Fiduciary's behalf, under contract.
The word fiduciary is doing real work there. It signals that the relationship is one of trust rather than transaction, and it explains why the burden of proof sits where it does: when a question arises about whether notice was given and consent taken, it is the Fiduciary who has to show it, not the Principal who has to disprove it.
The obligations, in the order they bite
Read in isolation the Act is a list. Read operationally it is a sequence: you cannot collect until you have given notice, you cannot keep until you have a purpose, and you cannot prove any of it later unless you recorded it at the time.
| Obligation | Where | What it means in practice |
|---|---|---|
| Notice before consent | Section 5 | An itemised notice, in clear and plain language, saying what data, for what purpose, how to withdraw, how to complain to you, and how to complain to the Board. It must be available in English or an Eighth Schedule language. |
| Free, specific, informed consent | Section 6 | Consent must be a clear affirmative action, limited to the data necessary for the stated purpose, and as easy to withdraw as it was to give. Pre-ticked boxes and bundled consent do not qualify. |
| Consent Managers | Section 6(7) | A Data Principal may give, manage and withdraw consent through a Consent Manager registered with the Board, which must be interoperable and accountable to the Principal. |
| Accuracy and security | Section 8 | Keep data accurate where it is used to make decisions, apply reasonable security safeguards, and impose the same obligations on your processors by contract. |
| Breach notification | Section 8(6) | Notify the Board and each affected Data Principal of a personal data breach. The Act does not set a materiality threshold, which makes this broader than most teams expect. |
| Erasure when purpose ends | Section 8(7) | Delete when consent is withdrawn or the purpose is served, unless retention is required by law. This is a deletion obligation, not a retention policy. |
| Children's data | Section 9 | Verifiable parental consent for anyone under 18, and a prohibition on tracking, behavioural monitoring and targeted advertising directed at children. |
| Significant Data Fiduciaries | Section 10 | If the Board designates you an SDF, you additionally need a DPO in India, an independent data auditor, and periodic Data Protection Impact Assessments. |
| Data Principal rights | Sections 11–14 | Access to a summary of processing, correction and erasure, grievance redressal, and the right to nominate someone to exercise rights on death or incapacity. |
Section references are to the Act as passed in August 2023. The Rules add operational detail and are the thing most likely to have changed since you last looked.
The part teams underestimate
Most of the work above is familiar to anyone who has done GDPR. Two things are not.
The burden of proof. When the Board asks whether a person consented, the answer cannot be that your banner was configured correctly. It has to be a record: this person, this notice version, this language, this timestamp, this set of purposes, this action. If your consent tooling stores a boolean, you do not have an answer.
Language. A notice available only in English is not available in the sense the Act means for a large part of your user base. Offering Eighth Schedule languages is straightforward; proving which language a specific person was shown is the part that requires the record to carry the language field.
Both are why we built the consent ledger the way we did: append-only, versioned against the notice that produced it, with the language stored on the record. How that works.
Where to start if you are starting today
In order, because each step makes the next one cheaper:
1. Find out what you are actually doing. Run a scan of your own site and see what fires before anyone consents. Most teams are surprised, and it is the fastest way to size the problem. The scan is free and takes a minute.
2. Write the notice. Purpose by purpose, in plain language, in the languages your users read. We publish a template.
3. Make consent provable. Record the choice, the notice version, the language and the timestamp, in a store you cannot quietly edit later.
4. Map the data. What you hold, where it goes, who processes it for you, and when it gets deleted. This is also most of what you need for a DPIA. DPIA template.
5. Wire the rights. Access, correction, erasure and grievance need a route in and a clock, not an inbox somebody checks.
The things people ask us
Does the DPDP Act apply to my company if we only have customers abroad?
It applies to personal data processed in India, and to processing outside India where that processing is in connection with offering goods or services to Data Principals in India. A company incorporated in India processing Indian users' data is squarely in scope. A company abroad with Indian users is also in scope for that processing.
Is consent the only lawful basis under DPDP?
No. Consent is the primary basis, but the Act also allows processing for certain legitimate uses, including where the Data Principal voluntarily provides data for a specified purpose, and for specified state functions, employment purposes, medical emergencies and disasters. Legitimate uses are narrower than the GDPR's legitimate interests and should not be treated as an equivalent.
What languages does the notice have to be available in?
The notice must be available in English or any language listed in the Eighth Schedule to the Constitution of India, which covers 22 languages. In practice this means offering the notice in the languages your users actually read, and being able to show which language a given person was shown.
Do we need a Data Protection Officer?
Only Significant Data Fiduciaries are required to appoint a DPO, who must be based in India and report to the board or equivalent. Every Data Fiduciary, however, must publish contact details for a person who can answer questions about processing, and must have a grievance redressal mechanism.
How is this different from the GDPR work we already did?
The obligations rhyme but the mechanics differ. DPDP has no equivalent of legitimate interests as a general basis, requires notice in Eighth Schedule languages, introduces the Consent Manager as a registered intermediary, and puts the burden of proving notice and consent squarely on the Data Fiduciary. Your GDPR controls are a strong starting point but not a complete answer.
See what fires before anyone says yes.
Run the free scan on your own domain. Two passes, one before consent and one after, with every cookie, tracker and fingerprinting call named against the obligation it touches.