The DPDP Act: a practical IT checklist for Indian businesses

The Digital Personal Data Protection Act, 2023 (the DPDP Act) is India's first comprehensive law on personal data. It applies to almost every business that handles information about people — customers, patients, students, employees or website visitors. The DPDP Rules were notified in November 2025, with most obligations phasing in over the following eighteen months.

Much of the work to comply is not legal at all. It is IT: knowing where data lives, controlling who can reach it, keeping it safe and deleting it when it is no longer needed. This guide translates the main obligations into practical steps.

This article is general information, not legal advice. For decisions specific to your business, read the official text and speak to a qualified lawyer.

The key terms

• Data Principal — the person the data is about.
• Data Fiduciary — the business that decides why and how personal data is processed. That is usually you.
• Data Processor — a vendor that processes data on your behalf, such as a cloud provider, payroll company or IT partner.
• Personal data breach — any unauthorised access, disclosure, loss or destruction of personal data.

What the Act expects from a business

In summary, a Data Fiduciary must:

• Process personal data only for a lawful purpose, with valid consent or another ground the Act allows
• Give people a clear notice of what is collected and why
• Take reasonable security safeguards to prevent breaches
• Notify the Data Protection Board and affected people if a breach happens
• Erase data once the purpose is served, unless the law requires keeping it
• Provide a way for people to raise grievances and exercise their rights
• Take extra care with children's data, including verifiable parental consent

The penalties are significant: failing to take reasonable security safeguards alone can attract a penalty of up to ₹250 crore.

The IT checklist

1. Build a data inventory

You cannot protect what you cannot find. List every place personal data lives:

• Business applications: ERP, CRM, billing, HR and payroll
• Shared drives, NAS storage and individual laptops
• Email inboxes and WhatsApp groups
• Website forms, spreadsheets and paper scanned into PDFs
• Backups, including old ones nobody has opened in years

For each, note what data it holds, why, who can access it and how long it is kept.

2. Control access

• Give each person their own account; remove shared logins
• Enable multi-factor authentication on email, cloud services and remote access
• Grant access by role and remove it the day someone leaves
• Review administrator accounts every quarter

3. Protect the data itself

• Encrypt laptops and mobile devices
• Use encrypted connections for every system that handles personal data
• Keep operating systems, firewalls and applications patched
• Run endpoint protection that is centrally monitored

4. Back up — and test restores

Backups protect against ransomware and accidental deletion, but only if they work. Keep at least one copy offline or immutable, and test a restore regularly.

5. Log and monitor

Keep access and security logs for important systems, so that if something goes wrong you can tell what happened, when, and to whose data.

6. Prepare for a breach

Write a short breach-response plan before you need it: who decides, who investigates, who informs the Board and affected people, and how. A plan written in calm conditions saves days during an incident.

7. Set retention and deletion rules

Decide how long each type of data is kept, and make deletion part of normal operations. Old CVs, closed customer records and former employees' documents are common risks.

8. Review your vendors

Every Data Processor you use should have a contract covering security, confidentiality, breach notification and data return or deletion. This includes your cloud, email, payroll and IT providers.

9. Fix consent and notices at collection points

Website contact forms, job applications and visitor registers should explain what is collected and why, and record consent where consent is the basis.

Where to start

Most businesses can make real progress in a few weeks: complete the data inventory, switch on multi-factor authentication, confirm backups can be restored, and write the breach-response plan. These four steps reduce risk immediately and make every later decision easier.

Our team runs DPDP readiness assessments that map where your personal data lives and produce a prioritised, practical list of fixes.