The Digital Personal Data Protection Act, 2023 (DPDPA) sets out how organisations in India may collect and use digital personal data. Penalties under the Act can reach ₹250 crore for some failures, so it deserves board-level attention.
1. Find your personal data
Build a data inventory: what personal data you hold, where it sits, why you collect it, who can access it and which vendors process it.
2. Check your lawful basis and notices
Most processing relies on consent or a specific legitimate use. Review your privacy notices and consent flows so they are clear, specific and easy to withdraw.
3. Prepare for data principal requests
People have rights to access, correct and erase their data and to raise grievances. Set up a simple process, an owner and response timelines.
4. Strengthen security and breach response
The Act expects reasonable security safeguards and requires personal data breaches to be reported. Test your incident response plan with a privacy scenario.
5. Review your processors
Vendors that process personal data for you need contracts and oversight. Fold privacy questions into your third-party risk assessments.
Need a DPDPA gap assessment? Get in touch.