The DPDP Act: India's data protection law for startups

The DPDP Act is a 2023 law that governs how organisations collect and use the personal data of people in India. Personal data means anything that identifies a person: a name, phone number, email, location, photo, or account history. The Act covers data in digital form, and also paper data that is later digitised.

India had no single data protection law before this. Startups relied on the older IT Act and on contract terms. The DPDP Act replaces that patchwork with clear duties for firms and clear rights for people.

The Act's duties are being switched on in stages. The DPDP Rules were notified on 13 November 2025 and come into force in phases over about eighteen months, so most duties apply by around May 2027. This guide does not give exact phase dates, so check the official notifications for the date that applies to each duty.

Even before every phase starts, investors and enterprise customers now ask about readiness. A startup selling to banks or large companies will often be asked how it handles consent, storage and breaches during due diligence.

The law uses three terms. A data principal is the person whose data it is, such as your user. A data fiduciary is the organisation that decides why and how the data is used, which is usually your startup. A data processor is a company that handles data for the fiduciary, such as a cloud or SMS vendor.

The fiduciary carries the main legal responsibility, even when a processor makes the mistake. This is why contracts with vendors now need clear data clauses. A Data Protection Board of India handles complaints and imposes penalties.

The core duties are short to state, though they take real work to carry out.

Ask first: get free, specific, informed and clear consent before using personal data, with a notice in plain language that says what data you collect and why. Let a user withdraw consent as easily as they gave it. Collect only what you need for the stated purpose, and delete the data when the purpose ends, unless a law requires you to keep it.

• Keep data safe with reasonable security measures such as encryption and access controls.
• Tell the Board and the affected people if a data breach happens.
• Let people see what data you hold, correct it, erase it and complain, and name a point of contact for questions.
• For children under 18, get verifiable consent from a parent or guardian, and do not track them or aim targeted ads at them.
• Use consent managers, which are registered services that let people manage consent in one place, if a user chooses to.

The penalties are among the highest in Indian business law. The schedule to the Act sets fines of up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore for not notifying a breach or for breaking the rules on children's data. Lower fines apply to other breaches. The Board decides the amount after looking at the nature and seriousness of the breach.

These are maximums, not standard fines. For a young startup the larger risk is damage to trust and lost deals. Still, a fine near any of these numbers would end most early-stage companies, so treat the Act as a core business risk.

The government can name certain fiduciaries as Significant Data Fiduciaries, based on factors such as the volume and sensitivity of data and risk to people. They face extra duties, including an independent audit, a data protection officer based in India and impact assessments.

The Act also lets the government exempt classes of fiduciary, including startups, from some provisions through notification. Do not assume your startup is exempt: wait for an official notification that names your category, and until then follow the basic duties.

Start with a data map: list every kind of personal data you hold, where it sits, which vendors see it and why you collect it. Delete data you do not need. Rewrite consent screens and privacy notices in plain language. Add data clauses to contracts with your cloud, analytics, payment and messaging vendors. Prepare a breach plan that names who tells the Board and the users, and how fast.

Cross-border transfers are allowed by default under the Act, except to countries the government restricts by notification. Sector rules from the RBI or SEBI may still limit where some data can be stored. This guide is general information as of October 2026, not legal advice, so check with a qualified professional.