In short
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India’s general data protection law. It covers personal data in digital form, or collected on paper and later digitised, that identifies a person: a customer, an employee, a supplier’s contact or a website visitor. Businesses must tell people what they collect and why, get valid consent or rely on a use the law allows, protect the data, report breaches, answer requests and erase data they no longer need. Most of these duties apply from May 2027, and they live in software as much as in policies.
Who it applies to
- Every Data Fiduciary: any organisation that decides why and how personal data is processed, whatever its size.
- Data Processors such as software vendors, cloud hosts and payroll providers, through the contracts fiduciaries must sign with them.
- Processing outside India when it relates to offering goods or services to people in India.
- Significant Data Fiduciaries, designated by the government for the volume or sensitivity of their data, carry extra duties: a Data Protection Officer in India, independent audits and impact assessments.
The Act does not cover personal data processed for purely personal or domestic purposes, or data a person has made public themselves.
What it means for your website
- A notice before you collect. Every form, sign-up and enquiry needs a plain-language notice: what data, for what purpose, for which service, and how to withdraw consent, use rights and complain to the Board. The notice must be available in English or any of the 22 languages in the Eighth Schedule to the Constitution.
- Real consent for cookies and tracking. Analytics and advertising tools need a clear affirmative action: no pre-ticked boxes, and a reject option as easy as accept.
- Withdrawal as easy as consent, for example a cookie settings link on every page.
- A published contact for the person who answers questions about personal data.
- No tracking or targeted advertising aimed at children.
What it means for your software
Consent records
Section 6 places the burden of proof on the business: you must be able to show that notice was given and consent obtained. Systems that rely on consent need to log who agreed, to what, when and against which version of the notice, and must stop processing when consent is withdrawn.
Rights requests
People can ask for a summary of their data and who it was shared with, and for correction, completion, updating or erasure. They can also nominate someone to act for them. The system needs a way to find a person’s records across modules, act on the request and record the response. Grievances must be resolved within a reasonable time, and no later than 90 days.
Retention and erasure
Personal data must be erased once its purpose is served or consent is withdrawn, unless a law requires keeping it. Separately, Rule 8 requires personal data, traffic data and logs to be kept for at least one year. In practice: retention periods per record type, automatic flags or erasure when they pass, and legal holds for tax and accounting records.
Security safeguards
Rule 6 lists the minimum: encryption, masking or tokenisation; access control; logging, monitoring and review to detect unauthorised access; backups for continuity; and contracts binding processors to the same standard. Failing here carries the largest penalty, up to ₹250 crore.
Breach detection and reporting
A breach must be reported to affected people without delay, and to the Data Protection Board without delay, with a detailed report within 72 hours. That is only possible if the system logs access and changes, raises alerts on unusual activity, and lets you tell quickly whose data was involved.
Children’s data
Systems that may hold data of under-18s need verifiable parental consent before processing, and must not profile children or target advertising at them.
Checklist
- List every place your business collects personal data: website, apps, ERP, CRM, HR system, WhatsApp and spreadsheets.
- For each, record the purpose, the legal basis and how long you need the data.
- Rewrite notices and consent screens in plain language, with a withdraw option.
- Log consent: who, when, for what and which version of the notice.
- Name a grievance contact, publish the details and set up a way to answer requests within 90 days.
- Review vendor contracts so processors must protect data and delete it when told.
- Turn on role-based access, encryption and logging, and keep logs for at least a year.
- Write a breach plan: who decides, who tells the Board within 72 hours, who tells customers.
- Set retention periods and automate erasure when they pass.
- Train the staff who handle customer and employee data.
How Kreon helps
We build DPDP features into the ERP, CRM, HR and app systems we deliver: consent capture and records, rights-request workflows, retention and erasure rules, role-based access, a full audit trail of changes, and logging that supports breach reporting. For an existing system, we can review how it handles personal data and say plainly what needs to change before May 2027.