🔒 DPDP Act — Is Your
Business Ready?

The Digital Personal Data Protection Act, 2023 is India's comprehensive law on how businesses must handle personal data (like names, phone numbers, emails, Aadhaar, etc.) of Indian residents. It gives individuals the right to know what data is collected about them, get it corrected, and ask for it to be deleted — and it creates binding obligations and penalties for businesses that mishandle this data.

Yes. Unlike some other regulations, the DPDP Act has no minimum turnover or size threshold. Any business — MSME, startup, proprietorship, partnership, LLP, or large company — that collects and processes personal data of Indian residents must comply. The Government may notify exemptions for certain categories, but the base obligations apply broadly.

Penalties are graded based on violation severity. Failing to implement adequate security safeguards can attract penalties up to ₹250 crore. Failure to notify the Data Protection Board of a breach carries penalties up to ₹200 crore. Breaching a voluntary undertaking can attract penalties up to ₹500 crore. These are civil penalties — no criminal prosecution — but enforcement can be swift and reputationally damaging.

Yes. Employee data — including Aadhaar, PAN, salary, bank account details, attendance, health data, performance records — is personal data under the DPDP Act. Employers (as Data Fiduciaries) must obtain valid consent from employees, use data only for stated HR purposes, implement retention and deletion policies, and honour employees' data rights. The Act provides some flexibility for employers in certain processing contexts, but the core obligations apply.

The Government can designate certain Data Fiduciaries as "Significant Data Fiduciaries" (SDFs) based on volume or sensitivity of data processed, risk to data principals, national security, or impact on sovereignty. SDFs face additional obligations including mandatory appointment of a Data Protection Officer (India-resident), periodic Data Protection Impact Assessments (DPIAs), and periodic audits. Most MSMEs will not be designated as SDFs initially, but the threshold can evolve.

This is a transitional question that depends on specific Rules notified by the Government. Generally, businesses should seek fresh DPDP-compliant consent from existing data principals where the original collection predates the Act. Historical consent that does not meet the DPDP standard of being specific, informed, and unambiguous will need to be refreshed. TAXAJ can advise on the appropriate transitional consent strategy for your customer and employee database.

For a typical MSME or startup with moderate data collection, a full DPDP compliance programme with TAXAJ can be completed in 6–10 weeks: 2 weeks for data audit and gap analysis, 2–3 weeks for policy drafting and vendor DPAs, and 2–4 weeks for implementation, testing, and team training. Larger enterprises with complex data ecosystems may require longer timelines.