Privacy compliance under India’s Digital Personal Data Protection (DPDP) Act goes beyond publishing policies or website notices. The Act has fundamentally changed how organizations collect, process, store, and manage personal data. Whether you are a startup, SaaS company, e-commerce platform, employer, or enterprise handling customer information, compliance is no longer optional.
At World Informatix Cyber Security, we help organizations understand their obligations under the DPDP framework and implement practical compliance measures that align legal requirements with operational realities — integrated with your existing security environment.
World Informatix has created a streamlined, 13 week program to take any company from zero to compliance.
Develop procedures to identify, assess, and report personal data breaches and provide immediate notification in accordance with regulatory expectations.
We provide clear, structured, and defensible documentation that supports regulatory inquiries and customer audits.
Experience in supporting organizations with privacy programs across the US, EU, and India.
The Digital Personal Data Protection (DPDP) Act applies to any organization — Indian or overseas, large or small — that processes the digital personal data of individuals in India and determines how or why it is used. Overseas businesses fall in scope when they offer goods or services to people in India. This covers banks and fintechs, SaaS and technology companies, e-commerce and consumer platforms, healthcare providers, EdTech and educational institutions, and any multinational with India-facing operations. Startups are not exempt — applicability is driven by the data you process, not your size.
Yes. The Act has extra-territorial reach. If your organization is based outside India but processes the personal data of individuals in India in connection with offering goods or services to them, you may be treated as a Data Fiduciary and become subject to the Act’s obligations — regardless of where your company is incorporated.
Personal data is any information that can identify an individual, directly or indirectly. This includes names, phone numbers, email and postal addresses, identification numbers, financial details, health records, location data, employee records, and customer profiles. The DPDP Act governs digital personal data — data collected in digital form, or collected on paper and later digitized. Unlike the GDPR, it does not create a separate “sensitive personal data” category.
The DPDP Rules, 2025 were notified on 13 November 2025, and the law is being implemented in phases. The Data Protection Board of India became operational immediately. Most substantive compliance obligations — consent, privacy notices, security safeguards, breach notification, and data principal rights — take full effect on 13 May 2027. Organizations are expected to build governance and operational readiness during this window rather than waiting for the deadline.
Financial penalties run up to ₹250 crore per violation, and penalties are assessed per violation rather than per incident. The largest fine — up to ₹250 crore — applies to failure to implement reasonable security safeguards. Processing without valid consent, failing to notify a breach, and mishandling children’s data can each draw up to ₹200 crore. Penalties are imposed by the Data Protection Board of India, which weighs the gravity, duration, and repetitive nature of the breach. Non-compliance also brings regulatory scrutiny, reputational damage, and loss of customer trust.
A Data Fiduciary is the person or organization that, alone or with others, determines the purpose and means of processing personal data — broadly equivalent to a “data controller” under the GDPR. If your organization decides why and how personal data of individuals in India is processed, you are a Data Fiduciary and carry the Act’s core compliance obligations, including consent, transparency, security, and breach reporting.
The DPDP Act covers only digital or digitized personal data, while the GDPR covers all personal data, including paper records in a filing system. The DPDP Act is consent-centric and does not separately define “sensitive” personal data, whereas the GDPR sets out special categories with stricter rules. The two frameworks share principles such as purpose limitation, data minimization, and breach notification, so organizations already aligned to the GDPR have a strong foundation — but must still address DPDP-specific consent, children’s data, and notification requirements.
Yes. Compliance obligations are not limited to large enterprises. Any startup that processes the personal data of individuals in India should assess its obligations under the Act. The DPDP Rules do provide certain eased requirements for notified startups and smaller entities in specific areas, but the core duties — lawful processing, valid consent, and security safeguards — still apply.
Individuals — called Data Principals — have the right to access a summary of their personal data and how it is processed, to correct and update it, to request erasure, to grievance redressal, and to nominate another person to exercise their rights. Organizations must put workflows in place to receive, verify, track, and fulfil these requests within the required timelines.
All personal data breaches must be reported to the Data Protection Board of India and to affected individuals — regardless of the gravity or damage caused. Serious breaches are generally expected to be notified promptly, typically within 72 hours. The notification must describe the nature and extent of the breach, when and where it occurred, the likely consequences, and the mitigation steps taken.
Processing the personal data of children (under 18) requires verifiable consent from a parent or lawful guardian, and behavioural tracking or targeted advertising directed at children is restricted. Persons with disabilities who cannot give consent independently require consent from a verified lawful guardian. Mishandling children’s data can attract penalties of up to ₹200 crore.
Most engagements begin with a 3-week readiness assessment, followed by an approximate 3-month implementation period. The exact timeline depends on the size of your organization, the complexity of operations, the volume of personal data processed, and the maturity of your existing privacy and governance practices.
Start by understanding what personal data your organization collects, where it is stored, why it is processed, who has access, and which third parties receive it. A structured DPDP readiness assessment then identifies compliance gaps and prioritizes next steps across consent, privacy notices, data principal rights, vendor oversight, and breach preparedness.