Compliance
Not a GDPR summary with the numbers changed. What the Act actually requires, in the order a small business runs into it.
Check your DPDP readiness — free More on the blogMost compliance content written for Indian SMBs about the Digital Personal Data Protection Act, 2023 is a GDPR explainer with the section numbers swapped out. That gets the shape of the law right and almost everything else wrong — the DPDP Act is a shorter, differently structured statute, and a business that prepares for GDPR-in-India ends up compliant with a law that does not exist and exposed under the one that does.
The Act turns on a single mechanism. Before you collect personal data — a name, a phone number, an email address, anything that identifies a person — you show a Consent Notice in clear language, in English or any language in the Eighth Schedule, that says what data you are collecting and why. No notice, no lawful collection, regardless of how the data is later used. This is the gap that shows up first in almost every DPDP readiness check: a signup form, a WhatsApp order flow, a delivery address field, none of them carrying a notice at all. It costs nothing to fix and it is the duty most businesses have never heard of.
The Schedule to the Act sets a statutory maximum of ₹250 crore per breach of a duty, and it stacks — three separate lapses can each engage their own ceiling. That is a maximum, not an amount owed automatically, and the Data Protection Board sets the real figure per case. But it is the number that turns "we should get to this eventually" into a board-meeting agenda item. A ceiling is not a bill. It is what a single bad quarter can turn into if nobody in the room can say what the business actually does with a customer’s phone number.
Not with a policy document. Start with an inventory: every place the business collects a name, a phone number, a photo, a health record, or anything else that identifies a real person — a signup form, a delivery address, a CCTV feed, an HR file. For each one, ask whether a notice exists at the point of collection. That single question, answered honestly across every collection point, is most of what a DPDP readiness check is actually scoring. The free check on this site does exactly that in about five minutes, and returns a score with the section number attached to every gap — the same twenty-odd questions a lawyer would ask, without the retainer.
Yes. The Digital Personal Data Protection Act, 2023 applies to any business that processes digital personal data in India, with no turnover or headcount threshold. A two-person shop taking phone numbers on a signup form is a Data Fiduciary under the Act exactly as a large company is. Some obligations, such as appointing a Data Protection Officer, attach only to Significant Data Fiduciaries, but the core duties of notice, purpose limitation and security apply to everyone.
The Schedule to the Act sets penalties per violation, with the highest at up to Rs 250 crore for failing to take reasonable security safeguards to prevent a personal data breach. Failure to notify the Data Protection Board and affected users of a breach carries up to Rs 200 crore. These are ceilings, not fixed fines: the Board sets the amount considering the nature, gravity and duration of the breach.
A notice given at or before the point you collect personal data, stating what data you are collecting, the specific purpose you will use it for, how the person can withdraw consent, and how they can complain to the Data Protection Board. It must be available in English and the Eighth Schedule languages. In practice this is the duty most Indian small businesses have never implemented, because it applies to ordinary signup forms and order flows, not just formal privacy policies.
Published 26 August 2026. Founder & CEO at VidhiSar. I have watched four companies pay for the same mistake, and it was never the mistake anyone expected. VidhiSar is software, not a law firm: every answer names the section it relies on so you can check it, and anything turning on your specific facts is worth putting to a professional. More about who builds this
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.