DPDP Compliance Advisory for Indian Businesses
A technical and legal assessment of how your organisation handles personal data, and what needs to change under the DPDP Act, 2023.
Most businesses don't know where they stand.
The Digital Personal Data Protection Act, 2023 applies to virtually every Indian business that collects personal data: from a two-person startup to a listed enterprise. Yet most organisations don't have a clear picture of their compliance position.
Privacy policies are copied from templates. Consent mechanisms are vague or missing. Data flows are undocumented. Breach response plans don't exist. And the gap between what the law requires and what the business actually does remains invisible until an incident forces it into view.
Key obligations under the DPDP Act, 2023
A simplified overview of what businesses must address. Each area requires both legal understanding and technical assessment.
Lawful Purpose & Consent
Personal data can only be processed for a lawful purpose with valid, informed consent from the data principal. Consent must be specific, clear and revocable.
Notice & Transparency
Before or at the time of data collection, a clear notice must be provided describing what data is collected, the purpose of processing and how to exercise rights.
Data Principal Rights
Individuals have the right to access their data, request correction, demand erasure and nominate someone to exercise these rights on their behalf.
Data Fiduciary Duties
Organisations handling data must ensure accuracy, implement safeguards, restrict retention to what's necessary and delete data when the purpose is fulfilled.
Breach Notification
In the event of a personal data breach, the Data Protection Board and affected data principals must be notified in the prescribed manner and timeframe. See the breach notification guide for the 72-hour rule.
Children's Data
Processing data of children (under 18) requires verifiable parental consent. Behavioural monitoring and targeted advertising directed at children is prohibited.
How DPDP compliance assessment works.
A step-by-step process that examines your data practices as well as your policy documents.
Data Discovery & Flow Mapping
We start by understanding how personal data enters your systems, where it's stored, how it's processed, who has access and when it's deleted. The review follows the data itself through that lifecycle, rather than reading policies in isolation.
Gap Analysis
Your current data practices are mapped against DPDP Act requirements. We identify where you're compliant, where gaps exist and where risks are highest. Each finding is documented with its statutory basis.
Documentation & Drafting
Based on findings, we draft or revise the necessary documents: privacy notices, consent language, data processing agreements, internal policies and breach response protocols. Each document is drafted for your operations rather than adapted from a template.
Implementation Guidance
Compliance also requires changes in how your product and team operate. We provide specific recommendations for your engineering, product and operations teams to implement.
Is your organisation affected by the DPDP Act?
Startups & SaaS Companies
If your product collects user data (names, emails, phone numbers, usage data, payment info), the DPDP Act applies from day one. Early compliance prevents costly rework later. See the dedicated guide: DPDP compliance for Indian startups.
SMEs & Growing Businesses
Customer databases, employee records, vendor data: SMEs handle more personal data than they realise. The Act doesn't exempt based on company size.
Compliance Teams
If you're responsible for data governance within your organisation, this advisory helps you build a defensible compliance position with proper documentation.
E-commerce & Platforms
Online marketplaces, payment platforms and service aggregators process high volumes of personal and financial data. DPDP compliance is non-negotiable.
Legal knowledge alone isn't enough for DPDP.
Most DPDP advisory is done by lawyers who understand the statute but not the system. They can tell you what the law says but can't trace how data actually flows through your product.
Eighteen years in IT, working with databases, APIs, cloud infrastructure, data pipelines and product architecture, means the assessment looks at how data moves through your systems, and the recommendations are written so your engineering team can implement them.
Checks if the policy covers the required disclosures on paper.
Verifies whether the policy accurately reflects actual data collection, storage and sharing practices in the product.
Confirms a consent checkbox exists on the signup form.
Evaluates whether consent is granular per purpose, freely given, recorded with timestamp and technically revocable.
Common questions about DPDP compliance.
If your business collects personal data of individuals in India (customer names, emails, phone numbers, payment details), the DPDP Act likely applies, regardless of company size. There is no small business exemption in the Act.
The Act provides for significant financial penalties for non-compliance, breach of data protection obligations and failure to notify breaches. Beyond penalties, non-compliance creates business risk: loss of customer trust, contractual liability and regulatory scrutiny.
It depends on the complexity of your data practices, the number of products/services and the maturity of existing documentation. A focused assessment for a single product typically takes 2-4 weeks. Larger organisations with multiple data streams may require more time.
The advisory covers legal assessment, gap identification and documentation. For technical implementation (code changes, consent management tools, database modifications), the advisory sets out specifications your engineering team can work from.
The DPDP Act shares some concepts with GDPR (consent, data principal rights, breach notification), but it's a distinct Indian statute with its own definitions, obligations and enforcement mechanism (the Data Protection Board of India). GDPR compliance does not automatically mean DPDP compliance.
Enrolment: Bar Council of Punjab & Haryana | No.: PH/9616/2023
As per Bar Council of India rules, no work is solicited through this website. The information provided is for general guidance and does not constitute legal advice.