India's data protection law is here. The question is whether your business is ready for it.

The Act and its rules are now in force.

What the DPDP Act actually requires

The Act is built around a consent-first model. Personal data can only be processed for a lawful purpose and with limited exceptions only with the free, specific, informed, and unconditional consent of the Data Principal (the individual). That consent must be as easy to withdraw as it was to give.

Beyond consent, the core obligations include:

For Data Fiduciaries businesses that determine the purpose and means of processing:

Collect only the data that is necessary for the stated purpose the Act explicitly codifies data minimisation
Provide a clear, plain-language notice before or at the time of collecting consent, explaining what is being collected and why
Give effect to Data Principal rights within the timeframes set out in the rules including the right to access information, the right to correction, the right to erasure, and the right to grievance redressal
Maintain reasonable security safeguards to prevent personal data breaches
Report personal data breaches to the Data Protection Board and affected Data Principals in the prescribed manner
Ensure that personal data is erased once the purpose for which it was collected has been fulfilled and retention is no longer legally required
Implement a grievance redressal mechanism that is accessible and responsive
Ensure that any Data Processors engaged to process data on your behalf do so only under a valid contract and in accordance with your instructions

For Significant Data Fiduciaries businesses designated by the Central Government based on volume, sensitivity, or risk:

Appoint a Data Protection Officer based in India
Appoint an independent data auditor and conduct periodic audits
Conduct Data Protection Impact Assessments for high-risk processing activities
Additional obligations as may be prescribed the category of Significant Data Fiduciary carries a meaningfully higher compliance burden

Cross-border data transfers:

The Act permits transfers of personal data outside India subject to Central Government notification. Certain countries or territories may be restricted. Businesses with global operations, cross-border data flows, or overseas vendors need to map their transfers and be ready to comply with restrictions as they are notified.

Who this applies to

The DPDP Act applies to the processing of digital personal data of individuals in India whether the processing happens inside India or outside. You need to take it seriously if you:

Are an Indian company processing personal data of Indian customers, employees, or users in any digital form
Are a global business with Indian customers, an Indian user base, or Indian employees whose data you process digitally
Operate a consumer-facing app, platform, or website that Indian users interact with
Are a B2B company processing personal data on behalf of clients as a Data Processor, your obligations under client contracts will change
Are in a data-intensive sector: fintech, healthtech, edtech, e-commerce, insurance, logistics, or any business running CRM, analytics, or marketing automation on Indian consumer data
Are raising capital from Indian or international investors who will look at your data governance posture as part of diligence
Are a multinational with an Indian subsidiary or operations global data governance frameworks will need to account for DPDP-specific requirements that differ from GDPR

The Act does not apply to personal data processed for personal or domestic purposes, or to data made publicly available by the Data Principal or under law. For everything else, the obligations apply.

What we do

We have worked on DPDP Act compliance across sectors including insurance, retail, financial services, and technology. Our approach is grounded in both the legal framework and the operational reality of building compliance systems inside businesses that are already running at pace.

Regulatory Readiness Assessment

We assess your current data practices against the full DPDP Act framework consent mechanisms, notice architecture, data flows, retention practices, third-party contracts, breach response procedures, and grievance redressal. You get a gap analysis that tells you exactly where you stand, ranked by priority and regulatory exposure.

Data Mapping and Inventory

Compliance starts with knowing what data you have, where it lives, how it flows, and who touches it. We work with your technology, legal, and operations teams to build a data inventory that is accurate, maintainable, and serves as the foundation for every other compliance workstream.

Consent Architecture and Notice Design

The Act's consent requirements are specific. Consent must be free, specific, informed, and unconditional and withdrawal must be as easy as giving it. We design consent flows that are legally compliant without creating unnecessary friction in your user experience, and we draft the notices that accompany them in language that is actually readable.

Data Principal Rights Framework

Individuals have the right to access information about their data, seek correction, demand erasure, and raise grievances. We build the internal processes to handle these requests intake, verification, response, escalation so that when a request comes in, your team knows exactly what to do and within what timeframe.

Grievance Redressal Mechanism

The Act requires a functioning grievance mechanism not just a named officer. We help you establish the process, designate the right contact point, and document the procedure in a way that satisfies both the regulatory requirement and the practical expectation of users who raise issues.

Data Processor Contracts and Vendor Management

If you use third-party vendors who process personal data on your behalf, your contracts with them need to reflect your DPDP obligations. We review and update your Data Processing Agreements and help you build a vendor assessment process that keeps third-party risk visible and manageable.

Cross-Border Transfer Analysis

If personal data of Indian individuals leaves India to cloud infrastructure, overseas group entities, or international service providers you need to understand the transfer framework and be ready to comply with any restrictions the Government notifies. We map your cross-border flows and advise on the appropriate mechanisms.

Significant Data Fiduciary Readiness

For businesses that are, or are likely to be, designated as Significant Data Fiduciaries, we provide additional support: DPO appointment and governance, data audit preparation, DPIA frameworks, and the enhanced documentation the designation requires.

What DPDP compliance gives your business

Regulatory certainty

Stronger client and consumer trust

Faster enterprise deals

A foundation for global compliance

Reduced breach exposure

Investor readiness

Resources

ISO 42001 | 4 min read

Building Trusted, Responsible AI Compliance for Modern Enterprises with AI 42001 : 2023

ISO 42001:2023 is the first international standard specifically dedicated to the management of artificial-intelligence (AI) systems. It defines requirements and guidance for establishing, implementing, maintaining and continually improving an AI Management System (AIMS) within an organisation. (Microsoft Learn) The standard covers the full lifecycle of AI systems — from conception, design, development, deployment, monitoring, through […]

DPDPA | 6 min read

Essential Steps for Implementing DPDP Regulations Efficiently

The rise of data breaches and privacy concerns, regulations like the Data Protection and Digital Privacy (DPDP) are crucial. Implementing these regulations can seem daunting, but with the right approach, it can be a smooth process. This blog post will guide you through essential steps for implementing DPDP regulations efficiently. Understanding DPDP Regulations Before diving […]

DPDPA | 5 min read

How Xiligent Simplifies Your Privacy Assessment Process

Privacy is power. With data breaches and privacy regulations on the rise, businesses must take privacy assessments seriously. However, the process can often feel overwhelming. This is where Xiligent comes in. Xiligent offers a streamlined approach to privacy assessments, making it easier for organizations to manage their data privacy needs. In this post, we will […]

GDPR | 7 min read

Understanding GDPR Compliance for Your Business Needs

In today’s digital world, data privacy is more important than ever. The General Data Protection Regulation (GDPR) is a law that protects personal data in the European Union. If your business handles personal data, understanding GDPR compliance is crucial. This post will guide you through the essentials of GDPR, its requirements, and how to ensure […]

Let's look at where you stand

A straightforward gap assessment is usually the right place to start. It tells you what the Act requires of your specific business, where your current practices fall short, and what needs to happen in what order. No assumptions, no generic templates just an honest picture of your position.

The Act has been in force for a while. Are we too late to start?

No but the window for orderly compliance is narrowing. The Act and rules are now fully in force, which means enforcement risk is real. Businesses that start now can still build a defensible compliance programme before they face regulatory scrutiny or a client requiring evidence of compliance. Those that continue to defer are accumulating risk with no corresponding benefit. The groundwork data mapping, consent architecture, rights processes, vendor contracts takes time to do properly. Starting now is still meaningfully better than starting after an incident or an enforcement notice.

How is the DPDP Act different from GDPR?

There are meaningful similarities both are consent-first frameworks with data principal rights, breach notification obligations, and third-party processor requirements. But the differences matter. The DPDP Act does not have the same concept of 'legitimate interests' as a lawful basis consent is much more central. The Act's treatment of children's data, cross-border transfers, and the Significant Data Fiduciary category are India-specific. And the enforcement architecture through the Data Protection Board rather than a traditional regulator is different in structure and process. Businesses with existing GDPR programmes will find overlap, but cannot simply apply their GDPR compliance to India without adaptation.

What are the penalties for non-compliance?

The Act prescribes penalties up to INR 250 crore for failure to implement reasonable security safeguards resulting in a data breach. Other violations failure to notify breaches, failure to implement data principal rights, obligations around children's data carry penalties of up to INR 200 crore. The Data Protection Board has the power to investigate, summon, and impose penalties. These are not theoretical numbers.