Progressive Infotech (Workelevate) Recognized in the 2025 Gartner® Magic Quadrant™ for Digital Employee Experience Management Tools for the Second Consecutive Year

DPDP Act Compliance Requirements for Companies

What is the DPDP Act?

The Digital Personal Data Protection (DPDP) Act, 2023 is India’s comprehensive data protection law that governs how organizations collect, process, store, and protect digital personal data. The Act aims to safeguard individual privacy while enabling businesses to use personal data in a lawful, transparent, and secure manner.

Applicability of the DPDP Act to Indian and Global Companies

The Digital Personal Data Protection (DPDP) Act, 2023 applies not only to Indian organizations but also to global companies that handle personal data of individuals in India. Its provisions are designed to ensure that all enterprises processing digital personal data follow lawful, secure, and transparent practices.

Indian Companies

  • Companies operating in India that collect, store, or process digital personal data must comply with the DPDP Act.
  • This includes startups, SMEs, large enterprises, and government entities.

Global Companies

  • Foreign organizations offering goods, services, or digital platforms to individuals in India fall under the Act’s scope.
  • Enterprises processing Indian users’ personal data abroad must adhere to cross-border data transfer rules (Section 16).

e-Book Download e-Book

Obligations of Data Fiduciaries under the DPDP Act, 2023 (Sections 4–10)

Under the Digital Personal Data Protection (DPDP) Act, 2023, a Data Fiduciary is any organization that determines the purpose and means of processing personal data. The Act places clear, enforceable responsibilities on enterprises to ensure lawful, secure, and accountable data handling.

Section 4 – Grounds for Processing Personal Data
  • What it means: Personal data can only be processed under specific, lawful grounds.
  • Grounds include
    • Consent of the Data Principal
    • Compliance with legal obligations
    • Legitimate business purposes (with safeguards)
  • Enterprise Action
    • Ensure all processing activities are documented and mapped to lawful grounds
    • Avoid processing data without a valid legal basis
  • What it means: Data Fiduciaries must provide clear and transparent notice to Data Principals at or before the time of data collection.
  • Notice must include
    • Purpose of collection
    • Types of data collected
    • Rights of the Data Principal
    • Contact for grievance redressal
  • Enterprise Action
    • Implement notices across websites, apps, and offline channels
    • Ensure clarity and accessibility for all users
  • What it means: Processing personal data is permissible only after obtaining explicit, informed, and unambiguous consent from the Data Principal.
  • Key requirements
    • Consent must be freely given and revocable
    • Consent records must be maintained
  • Enterprise Action
    • Build consent management systems integrated with all data collection points
    • Track consent status and withdrawals
  • What it means: Allows limited processing without consent in specific cases (e.g., legal obligations, public interest, or security).
  • Enterprise Action
    • Identify all situations where consent is not required
    • Maintain documentation to justify processing under these legitimate grounds
  • What it means: Data Fiduciaries must ensure lawful, fair, and transparent processing.
  • Key obligations include
    • Purpose limitation
    • Data minimization
    • Accuracy
    • Storage limitation
    • Security safeguards
    • Facilitation of Data Principal rights
  • Enterprise Action
    • Implement policies, processes, and technical controls to meet these obligations
    • Maintain audit trails and records for compliance verification
  • What it means: Special safeguards for children’s personal data.
  • Requirements include
    • Verifiable parental or guardian consent for minors
    • Limiting collection to necessary data
  • Enterprise Action
    • Implement consent verification mechanisms for minors
    • Ensure restricted processing of children’s data
  • What it means: Enterprises classified as SDFs have enhanced compliance responsibilities.
  • Key obligations include
    • Appointment of a Data Protection Officer (DPO)
    • Conducting Data Protection Impact Assessments (DPIA)
    • Enhanced governance, audits, and reporting
  • Enterprise Action
    • Establish a DPO function and DPIA processes
    • Strengthen internal controls, monitoring, and reporting mechanisms

Key Takeaways for Enterprises

  1. 1. All personal data processing must have a valid legal basis and adhere to purpose limitations.
  2. 2. Notice and consent management systems are mandatory.
  3. 3. Special attention is required for children’s data.
  4. 4. SDFs have heightened obligations, including DPO appointment and DPIAs.
  5. 5. Maintain records, audits, and technical safeguards to demonstrate compliance.

Key Sections for Security Obligations

Section 8(5) – Reasonable Security Safeguards

Data Fiduciaries must implement reasonable technical and organizational measures to protect personal data from unauthorized access, disclosure, alteration, or loss.

Section 8(6) – Personal Data Breach Notification

Requires Data Fiduciaries to notify the Data Protection Board and affected Data Principals in the event of a personal data breach.

Section 10 – Additional Obligations for Significant Data Fiduciaries (SDFs)

SDFs must adopt enhanced governance and security measures, including audits, risk assessments, and appointment of a Data Protection Officer (DPO).

DPDP Act, 2023

Section 16 – Processing of Personal Data Outside India

Under Section 16 of the DPDP Act, 2023, enterprises that process personal data outside India must comply with specific cross-border data transfer requirements to ensure the protection and lawful handling of Indian personal data.

Key Provisions

  • 1. Cross-Border Processing Restrictions
    • Personal data of individuals in India can be processed outside India only if permitted under the Act or Rules.
    • Certain categories of sensitive or critical personal data may have stricter transfer restrictions.
  • 2. Data Protection Standards
    • Enterprises processing data abroad must ensure that the same level of protection as required under Indian law is maintained.
    • This may include contractual obligations, security safeguards, and compliance audits.
  • 3. Regulatory Oversight
    • The Data Protection Board of India has the authority to approve, regulate, or restrict cross-border transfers.
    • Organizations must be prepared to demonstrate compliance with transfer requirements.
  • 4. Enterprise Action Items
    • Identify all cross-border data flows involving personal data of Indian individuals.
    • Implement adequate safeguards, such as:
      • Standard contractual clauses
      • Encryption and access controls
      • Vendor risk assessments for foreign processors
    • Maintain records and documentation for regulatory compliance and audits.

Key Benefits of Adhering to the DPDP Act for Businesses

  • Build Customer Trust and Loyalty
  • Avoid Regulatory Penalties
  • Strengthen Cybersecurity Posture
  • Support Safe Digital Transformation
  • Competitive Advantage
  • Operational Efficiency and Accountability

Our Managed IT Solutions & Services

Progressive Techserve’s Cybersecurity Services

Cybersecurity & Risk Evaluation
Request

DPDP Act 2023 & DPDP Rules 2025 – Enterprise Compliance Timeline

Protect Your Enterprise. Safeguard Personal Data. Ensure Regulatory Readiness.

The Digital Personal Data Protection (DPDP) Act, 2023 and the accompanying DPDP Rules, 2025 set India’s framework for handling digital personal data. Enterprises that process personal data must prepare now to meet strict compliance timelines, avoid hefty penalties, and build trust with customers, partners, and regulators.

Why Enterprises Must Act Now

  • Heavy Penalties: Up to ₹250 crores for Significant Data Fiduciaries (SDFs) for non-compliance.
  • No Grace Period: Full enforcement begins May 13, 2027.
  • Mandatory Data Governance: Consent management, breach reporting, and user rights systems.
  • Regulatory Oversight: The Data Protection Board of India will have full enforcement powers.

Enterprises that proactively comply will gain a competitive advantage, secure customer trust, and reduce operational risk.

Implementation Phases for Enterprises

Phase 1 – Immediate Effect (Nov 13, 2025)

Key Sections Activated

  • Definitions (Section 2) – Clarifies personal data, data fiduciary, data principal, consent, and other terms.
  • Data Protection Board (Sections 18–26) – Constitution, powers, and operations begin.
  • Board Operations (Rules 17–21) – Appointments, salaries, meetings, digital office functioning.
  • Miscellaneous Provisions (Sections 35, 38–44(1)(3)) – Rule-making authority, repeal, general provisions.

Enterprise Action

  • No immediate compliance burden.
  • Monitor Board appointments and regulatory guidance for future requirements.

Phase 2 – One-Year Implementation (Nov 13, 2026)

Consent Manager Framework Activated

  • Registration of Consent Managers (Section 6(9), Rule 4)
  • Board powers for registration (Section 27(1)(d))

Enterprise Action

  • Enterprises planning to act as Consent Managers must prepare:
    • Minimum net worth of ₹2 crores
    • Independent certification for interoperable platforms
    • System design and platform readiness

Phase 3 – Full Compliance (May 13, 2027)

Critical Enterprise Obligations

Area Requirement
Notice & Consent Provide clear, actionable notices and obtain informed, specific consent before processing.
Data Fiduciary Obligations Implement purpose limitation, data accuracy, and robust security safeguards.
Rights of Data Principal Facilitate access, correction, erasure, grievance redressal, and nomination.
Breach Reporting Detect and report breaches within 72 hours to the Board and affected individuals.
Children’s Data Obtain verifiable parental consent for underage users.
Significant Data Fiduciary Appoint DPO, conduct DPIA, and implement advanced audit and compliance measures.
Cross-Border Data Transfer Comply with restrictions and regulatory approvals.
Board Powers & Penalties Full enforcement, penalties up to ₹250 crores, investigation and inquiry powers.

Sector-Specific Preparations

Sector Key Compliance Actions
Technology Platforms SDF designation, DPIA, audit, algorithmic accountability
E-commerce Consent for marketing, 3-year retention with automated deletion
Financial Services Align with RBI/SEBI regulations, cross-border payments data compliance
Healthcare Children’s health data safeguards, research exemptions
Telecommunications Location data protection, CDR retention vs deletion
Ed-Tech Parental consent systems, educational activity exemptions
BPO / IT Services Contracts with data processors, log retention, client data handling

Recommended Enterprise Compliance Roadmap

Months 0–6 (Nov 2025 – May 2026)

  • Conduct data mapping and gap analysis
  • Risk assessment for SDF designation
  • Vendor and processor contract review

Months 6–12 (May 2026 – Nov 2026)

  • Design and test consent and notice mechanisms
  • Build technical infrastructure for rights exercise
  • Draft policies and procedures
  • Establish Data Protection Officer function

Months 12–18 (Nov 2026 – May 2027)

  • Deploy systems in production
  • Conduct user acceptance and breach response exercises
  • Internal audits and documentation
  • Finalize vendor contracts

Penalties for Non-Compliance

Violation Section Maximum Penalty
Data fiduciary obligations breach 28 ₹250 Cr (SDF) / ₹200 Cr (others)
Non-compliance with Board directions 29 ₹250 Cr (SDF) / ₹200 Cr (others)
Failure to implement security safeguards 30 ₹250 Cr
Failure to report data breaches 30 ₹250 Cr
Children’s data violations 31 ₹250 Cr
Failure to publish contact info 32 ₹10,000/day (up to ₹10 lakh)

Advanced Data Security Measures

The DPDP Act, 2023 mandates enterprises to implement strong technical and organizational safeguards to protect personal data against unauthorized access, misuse, loss, and cyber threats. A cybersecurity-led approach ensures data protection is embedded into the enterprise architecture, not treated as an afterthought.

Enterprise-Class Security Architecture

Organizations must adopt a layered, defense-in-depth security strategy to safeguard personal data across environments:

  • End-to-End Data Encryption: Secure encryption of data at rest, in transit, and during processing using industry-recognized standards.
  • Identity-Centric Access Controls: Role-based access control (RBAC), multi-factor authentication (MFA), and least-privilege policies to minimize data exposure.
  • Network Security & Zero Trust: Deployment of next-generation firewalls, IDS/IPS, zero-trust frameworks, and network segmentation to prevent unauthorized access and lateral movement.
  • Endpoint, Cloud & Application Protection: Advanced endpoint security (EDR/XDR), cloud security posture management, secure application configurations, and workload protection across hybrid and multi-cloud environments.

Continuous Visibility & Threat Response

  • 24×7 Security Monitoring: Real-time surveillance of systems and data activity to detect anomalies and potential breaches.
  • Centralized Security Intelligence: Log aggregation, correlation, and analytics to support threat detection, investigations, and compliance reporting.
  • Proactive Vulnerability & Threat Management: Continuous vulnerability scanning, patching, and threat intelligence integration to reduce attack surfaces.

Breach Preparedness & Regulatory Readiness

A cybersecurity-first model ensures enterprises can meet DPDP breach notification and accountability obligations:

  • Incident Response & Containment: Predefined response playbooks for rapid isolation, investigation, and remediation of incidents.
  • Impact Assessment & Regulatory Reporting: Risk-based analysis to determine potential harm and enable timely reporting to the Data Protection Board of India.
  • Audit Trails & Forensic Readiness: Comprehensive logging, evidence preservation, and audit-ready documentation to demonstrate compliance.

Governance, Risk & Security Assurance

Strong security controls must be reinforced with governance and assurance frameworks:

  • Security Policies & Control Frameworks: Alignment with DPDP Act requirements and global standards such as ISO 27001 and NIST.
  • Ongoing Security Testing & Audits: Regular penetration testing, red teaming, and compliance audits to validate security posture.
  • Human Risk & Awareness Programs: Continuous cybersecurity training to mitigate insider threats and human error.

Prepare Your Enterprise Today

Ensure compliance, protect customer trust, and mitigate risk with Progressive’s DPDP Advisory and Cybersecurity Solutions
Request

Freely Asked Question's

Q1. What does a DPDP Act compliance checklist look like for enterprises?

A DPDP compliance program must combine legal, technical, operational, and governance controls. Key elements include:

  • Data Discovery & Mapping – Identify personal data flows, storage locations, processors, and cross-border transfers
  • Lawful Basis Assessment – Map each processing activity to consent or legitimate use under the Act
  • Notice & Consent Management – Implement clear notices and granular consent mechanisms
  • Data Principal Rights Enablement – Access, correction, erasure, grievance redressal, and nomination workflows
  • Security Safeguards – Encryption, access controls, monitoring, logging, and breach prevention
  • Incident Response & Breach Reporting – 72-hour notification capability
  • Retention & Deletion Controls – Automated deletion aligned to purpose limitation
  • Vendor & Processor Governance – DPDP-compliant contracts and oversight
  • DPO & DPIA (for SDFs) – Mandatory governance for Significant Data Fiduciaries

Compliance is ongoing, not a one-time exercise, and requires continuous monitoring and audits.

The DPDP Act enforcement follows a phased implementation, with full compliance mandatory by May 13, 2027.

Key milestones:

  • November 13, 2025 – Data Protection Board constituted
  • November 13, 2026 – Consent Manager framework operational
  • May 13, 2027 – All substantive obligations enforced

From May 13, 2027:

  • No grace period applies
  • Penalties are immediately enforceable
  • The Data Protection Board gains full investigative and enforcement powers

Enterprises must treat DPDP as a board-level compliance priority well before this date.

While inspired by GDPR, the DPDP Act has key structural and operational differences:

Aspect GDPR DPDP Act
Scope Global India-centric
Legal Basis Multiple lawful bases Consent + legitimate uses
Penalties % of global turnover Fixed monetary caps
Data Types Personal + sensitive Digital personal data
Authority Multiple EU regulators Multiple EU regulators
Localization Optional Cross-border restrictions apply

For global enterprises, GDPR compliance does not automatically ensure DPDP compliance. DPDP requires India-specific notices, consent flows, breach reporting, and governance controls.

Yes, under Section 16, but subject to:

  • Government-notified restrictions
  • Adequate security safeguards
  • Regulatory oversight by the Data Protection Board

Data Principals have the right to:

  • Access personal data
  • Correct or erase personal data
  • Withdraw consent
  • Grievance redressal
  • Nominate another person to exercise rights

Banks must comply with the DPDP Act as Data Fiduciaries and are likely to be designated as Significant Data Fiduciaries (SDFs). Core requirements include:

  • Lawful basis for processing customer data (consent or legitimate use)
  • Clear notices and auditable consent records
  • Strong security safeguards and continuous monitoring
  • 72-hour personal data breach reporting to the Data Protection Board
  • Enablement of customer rights (access, correction, erasure, grievance redressal)
  • Appointment of a Data Protection Officer and conduct of DPIAs

Full enforcement applies from May 13, 2027, with penalties of up to ₹250 crores for non-compliance.

© Copyright 2026, Progressive Techserve (formerly known as Progressive Infotech), All rights reserved.