DPDP Act compliance built into your systems

The Digital Personal Data Protection Act, 2023 relies heavily on consent for processing digital personal data, alongside certain legitimate uses defined in the Act. Consent must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and limited to the personal data necessary for the stated purpose.

Notices must tell individuals what personal data is collected, for what purpose and how they can exercise their rights and complain. Designing these notices in plain language, available in English or languages listed in the Eighth Schedule of the Constitution as the Act provides, is both a legal and a user experience task.

Withdrawing consent must be as easy as giving it. Products therefore need clear settings or flows for withdrawal, and back-end processes that stop processing and, where required, erase data after withdrawal, subject to legal retention obligations. Records of consent, including when, how and for what purpose it was given, help demonstrate compliance if questions arise later. Building consent records into systems from the start is much easier than reconstructing them after an inquiry.

Preparing for the DPDP Act combines legal interpretation with practical engineering and process work. The implementing rules provide for obligations to phase in over a transition period, so organizations should confirm which provisions are in force when planning. The steps below form the core of most readiness programs.

Data mapping comes first, because every other obligation depends on knowing what personal data exists, where it is stored, why it is processed and who it is shared with. Many organizations discover data collected without a clear purpose that can simply be deleted.

Security safeguards deserve particular attention. The Act requires reasonable security safeguards to prevent personal data breaches, and failure to take them is linked to the highest penalties under the Act. Training and ownership complete the program. Teams handling personal data should understand the basics, and a named person or function should coordinate compliance and grievances.

• Map personal data, purposes, systems and recipients.
• Update notices and consent flows.
• Build processes for access, correction, erasure and grievances.
• Implement retention and erasure rules.
• Strengthen security safeguards and breach response.
• Review contracts with data processors.

Under the Act, a data fiduciary remains responsible for personal data processed on its behalf by data processors, such as cloud providers, payment processors, CRM vendors and outsourced service providers. Processing by a processor must take place under a valid contract.

Contracts should cover the purpose and scope of processing, security safeguards, confidentiality, breach notification to the fiduciary, assistance with data principal requests, and deletion or return of data when the service ends. Existing vendor agreements often need updating to reflect these points.

Maintain an inventory of processors and the categories of data each handles. Review security practices before onboarding new vendors, and monitor existing ones, especially those handling sensitive information such as financial or health data. Organizations already compliant with GDPR can reuse much of this work, but differences in definitions and obligations mean a separate review is still needed. This page provides general information, not legal advice; consult a qualified Indian data protection lawyer about your specific obligations.