Digital personal data is now central to almost every business. Customer registrations, employee records, website forms, marketing databases, payment information, CRM systems and cloud platforms all involve the collection or processing of personal data. As businesses increasingly rely on digital systems and third-party technology, data protection has become an important part of legal and operational compliance.

India’s Digital Personal Data Protection Act, 2023 (DPDP Act) establishes a framework for processing digital personal data while recognising the rights of individuals and the obligations of organisations handling such data.

The DPDP Rules, 2025 were notified on 13 November 2025 and provide the operational framework for implementing the Act. Both the Act and the Rules follow phased commencement timelines. Certain institutional provisions came into force immediately, the Consent Manager provisions are scheduled to commence one year after notification, and most substantive data-processing obligations are scheduled to commence eighteen months after notification.

This gives businesses time to prepare. However, organisations should not wait until the final implementation stage. Reviewing data practices, contracts, privacy notices and security systems in advance can help identify compliance gaps before the applicable provisions take effect.

Understanding the DPDP Framework

A Data Fiduciary is any person who, alone or in conjunction with other persons, determines the purpose and means of processing personal data. This could include a company, online platform, employer, e-commerce business or other organisation. The individual to whom the personal data relates is the Data Principal. Any person who processes personal data on behalf of a Data Fiduciary is a Data Processor.

For businesses, this distinction matters because compliance responsibilities can extend beyond the organisation’s own systems to vendors, SaaS providers, cloud service providers and other third parties processing data on its behalf.

What Is Already in Effect?

The Rules were notified with a phased implementation timeline rather than a single commencement date.

The first stage, which took effect immediately, establishes important elements of the regulatory framework, including provisions relating to the Data Protection Board of India and its functioning.

The second stage is scheduled for 13 November 2026 and includes the provisions governing the registration and obligations of Consent Managers. These entities are intended to provide mechanisms through which Data Principals can give, manage, review and withdraw consent.

The final stage is scheduled for 13 May 2027. It covers several practical compliance requirements affecting businesses, including notices to Data Principals, security safeguards, breach-related obligations, children’s data, rights-related mechanisms and other operational requirements.

These dates follow two notifications of 13 November 2025. Under Section 1(2) of the DPDP Act, notification G.S.R. 843(E) brought Sections 1(2), 2, 18 to 26, 35, 38 to 43 and 44(1) and (3) into force immediately, Section 6(9) and Section 27(1)(d) one year later, and the remaining substantive provisions, including Sections 3 to 17 (other than Section 6(9)) and the penalty provisions in Section 33, eighteen months later. Rule 1(2) to (4) of the DPDP Rules, 2025 (G.S.R. 846(E)) follows the same structure: Rules 1, 2 and 17 to 21 came into force on publication, Rule 4 commences one year later, and Rules 3, 5 to 16, 22 and 23 commence eighteen months later. Businesses should distinguish between provisions already in force and obligations that have been notified but are not yet operative. The phased structure therefore gives businesses a compliance window rather than a reason to postpone preparation.

Non-compliance can be costly once the relevant provisions take effect. Under Section 33 of, and the Schedule to, the DPDP Act, which are scheduled to commence on 13 May 2027, the Data Protection Board of India may impose penalties of up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach, and up to ₹200 crore each for failing to notify a breach or to meet the additional obligations relating to children.

1. Start With a Data Inventory

The first step in data privacy compliance is understanding what personal data the business actually collects and processes.

Businesses should identify information collected from customers, employees, applicants, vendors and website users. This includes contact information, identification details, financial information, account information and other personal data depending on the nature of the business. The organisation should also identify where the information is stored, who can access it, which third parties receive it and how long it is retained.

A proper data inventory can help identify unnecessary collection, excessive retention and gaps in internal controls.

2. Review Privacy Policies and Notices

A privacy policy should accurately explain the organisation’s data practices and should be consistent with the actual processing carried out by the business. Rule 3 of the DPDP Rules, 2025 prescribes requirements for notices given by Data Fiduciaries, including clear information about the personal data being processed and the purpose of processing.

Businesses should therefore review their website privacy policy, data protection policy, cookies privacy policy, application notices and customer onboarding documents. Where a business maintains separate terms and conditions and privacy policy, both documents should also be reviewed together. Contractual terms, privacy notices and actual data practices should not contradict one another.

3. Review Consent Mechanisms

Consent is an important part of the DPDP framework, but businesses should first understand the legal basis applicable to their particular processing activity. Under Section 4(1) of the DPDP Act, 2023, personal data may be processed for a lawful purpose on the basis of the Data Principal’s consent or for certain legitimate uses specified under Section 7, subject to the statutory conditions. Where consent is relied upon, the organisation should ensure that consent is obtained in an appropriate manner and that the Data Principal can withdraw it through an accessible mechanism.

The Rules also establish a framework for Consent Managers and prescribe requirements concerning their registration and functioning. Rule 4, which governs Consent Managers, is scheduled to commence on 13 November 2026. Businesses should therefore review existing data protection consent mechanisms, including consent forms, website interfaces, application flows and withdrawal processes.

4. Strengthen Data Security

A data protection policy should be supported by appropriate technical and organisational safeguards. Rule 6 of the DPDP Rules, 2025 prescribes reasonable security safeguards, including measures addressing encryption or masking, access controls, logging, monitoring and other protections.

Businesses should assess who has access to personal data, whether access is restricted according to business requirements and whether appropriate controls exist for storing and transferring information. This becomes particularly important for organisations using cloud-based systems. Cloud computing and data protection should be considered together when businesses select cloud providers, configure access controls or transfer personal data between systems.

5. Prepare for Personal Data Breaches

Businesses should have a documented process for identifying and responding to personal data breaches. Rule 7 of the DPDP Rules, 2025 prescribes breach-intimation obligations, including notification to affected Data Principals and the Data Protection Board of India.

A breach-response process should identify who is responsible for detecting, investigating, documenting and managing an incident. The business should also review its contracts with vendors and Data Processors to ensure that security incidents can be reported and addressed promptly.

6. Review SaaS and Software Contracts

Businesses increasingly rely on SaaS platforms, cloud applications, CRM systems and third-party software to process personal data. Existing SaaS agreements, SaaS contracts and software license agreements should therefore be reviewed for provisions dealing with confidentiality, security, data processing, breach notification, retention and deletion.

Where a vendor processes personal data on behalf of the business, the contractual allocation of responsibilities should be clearly documented. Under Section 8(1) and 8(2) of the DPDP Act, the Data Fiduciary remains responsible for processing undertaken on its behalf by a Data Processor, irrespective of any agreement to the contrary, and may engage a Data Processor only under a valid contract. Rule 6(1)(f) of the DPDP Rules, 2025 also requires appropriate contractual provision for reasonable security safeguards. This is particularly important where customer or employee information is stored on third-party systems.

7. Establish Processes for Data Principal Rights

The DPDP Act provides Data Principals with specified rights, including rights relating to access to information, correction and erasure, grievance redressal and nomination. Businesses should establish an internal mechanism for receiving and responding to such requests. Responsibility should be clearly allocated between relevant teams such as legal, HR, customer support and technology. The organisation should also maintain appropriate records of requests and responses.

What Should Businesses Do Now?

A practical data privacy compliance review should cover:

• Data inventory and processing activities
• Privacy policy and data protection policy
• Consent and withdrawal mechanisms
• Website and cookies practices
• SaaS agreements and software contracts
• Data Processor arrangements
• Cloud computing and data protection
• Security safeguards
• Personal data breach response
• Data retention and deletion
• Data Principal rights

The objective is not merely to prepare documents. Policies, contracts and internal processes should reflect the way the business actually collects, uses, stores and shares personal data.

FAQs

1. Does the DPDP Act apply to every business?

The DPDP Act applies to the processing of digital personal data within India and, in specified circumstances, to processing outside India in connection with offering goods or services to Data Principals in India. However, Section 3 provides for certain exclusions, including personal data processed by an individual for personal or domestic purposes and personal data made or caused to be made publicly available in the circumstances specified under the Act. Applicability therefore depends on the nature and circumstances of the processing and the statutory exclusions.

2. Is a privacy policy sufficient for DPDP compliance?

No. A privacy policy is only one part of compliance. Businesses should also review consent mechanisms, security safeguards, contracts, breach procedures, retention practices and processes for handling Data Principal rights. The timing of the relevant obligations should be assessed against the Act’s and Rules’ phased commencement provisions.

3. What is the Data Protection Board of India?

The Data Protection Board of India is the statutory body established under the DPDP framework to exercise the functions and powers assigned to it under the Act and Rules.

4. Are cookies covered under the DPDP framework?

Cookies may involve the processing of personal data depending on the information collected and how it is used. Under Section 2(t) of the DPDP Act, 2023, information collected through cookies may constitute personal data where it relates to an identifiable individual. The use of cookies does not automatically mean that personal data is being processed; businesses should examine the information collected and how it is used when reviewing their website practices and cookies privacy policy.

5. What should a SaaS agreement cover for data protection?

A SaaS agreement should appropriately address data processing responsibilities, confidentiality, security safeguards, breach reporting, retention, deletion and the responsibilities of relevant Data Processors.

6. When should businesses start preparing for DPDP compliance?

Businesses should begin reviewing their data practices, privacy policies, contracts, consent mechanisms and security safeguards before the relevant provisions become applicable. The phased implementation provides time for preparation, but waiting until the applicable commencement date may leave insufficient time to address compliance gaps.

Conclusion

The DPDP Act and Rules make data privacy compliance an important part of business governance. The framework affects more than privacy policies. It can require businesses to review how personal data is collected, how consent is obtained, how information is secured, how third-party vendors process data and how requests and breaches are handled.

Businesses using SaaS platforms, cloud services or artificial intelligence should pay particular attention to their contractual and technical arrangements. Reviewing policies, consent mechanisms, cloud arrangements and vendor contracts together offer a more practical way to prepare for the phased implementation of the framework.

Early preparation also gives businesses an opportunity to identify gaps and make necessary changes before the relevant provisions become operational.

This article is intended for general informational purposes only and does not constitute legal advice. The legal position should be reviewed against the applicable legislation, Rules, notifications and subsequent regulatory developments as on the date of reliance.