DPDP Compliance for Businesses: What Should Organisations Review?

An introduction to data-governance planning, privacy notices, consent and organisational controls under India’s digital personal data protection framework.

Businesses increasingly collect personal data through websites, applications, customer forms, employee systems, marketing platforms and service providers. Data protection is therefore not only an IT issue; it also involves contracts, notices, internal processes and accountability.

1. Start with a data inventory

Identify what personal data is collected, why it is collected, where it is stored, who can access it, how long it is retained and which vendors or processors receive it. A practical data inventory is a useful foundation for compliance work.

2. Review notices and consent mechanisms

Privacy notices and consent flows should be reviewed for clarity, purpose and consistency with the organisation's actual practices. The Digital Personal Data Protection Act, 2023 establishes the statutory framework, while the Digital Personal Data Protection Rules, 2025 provide implementation details and an enforcement timeline. MeitY's official material states that most operational rules take effect according to the notified timeline rather than all becoming effective immediately.

3. Contracts with vendors matter

Where personal data is handled through cloud providers, payroll vendors, marketing platforms, SaaS tools or other service providers, the contractual allocation of responsibilities should be examined. Data-related clauses should fit the actual business relationship and security practices.

4. Security and incident readiness

Organisations should consider access controls, retention practices, internal escalation, vendor management and incident-response procedures. A written process is more useful when it reflects the organisation's actual systems rather than copying a generic policy.

5. Website policies should match reality

A privacy policy, terms and conditions and cookie-related disclosures should not be treated as standalone website text. They should correspond with the actual data collection and processing practices of the business.

Important: This article is for general informational purposes only and is not legal advice. The applicable law, facts, limitation periods, rules and procedural requirements should be assessed for the particular matter.