DIGITAL PERSONAL DATA PROTECTION - COMPLIANCE, APPLICABILITY AND REPORTINGBlog

The Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 establish India's framework for protecting digital personal data and regulating how organisations collect, use, store, disclose and process such data.

It applies to all public and private organizations (of any size) that process digital personal data of individuals in India, as well as foreign organizations offering goods or services to people in India.

It operate on a phased compliance roadmap leading to full enforcement by May 13, 2027, supervised by the Data Protection Board of India.

It requires appropriate notices and consent mechanisms, security safeguards, contractual controls, grievance handling, breach reporting and demonstrable accountability.

Key Compliance Milestones (2026–2027):

1. November 13, 2025: Phase-I activation establishing the Data Protection Board of India (DPBI) and foundational rules.
2. November 13, 2026: (Consent Manager Milestone) Phase-II deadline for the launch and registration of the Consent Manager Framework (platforms enabling individuals to manage consent).
3. May 13, 2027: (Full Substantive Enforcement Deadline) Phase-III Full operational compliance deadline for all substantive statutory obligations, audits, and appointments.

What information is covered?

1. Names, mobile numbers, email addresses and postal addresses.
2. Aadhaar or PAN details, where collected and processed digitally.
3. Customer, client, employee and resident records.
4. Case-related information linked to identifiable individuals.
5. Photographs, identity documents, account credentials and digital communications.
6. Device-linked or other information that identifies an individual, directly or indirectly.

The Act does not create a separate category of “sensitive personal data” in the same manner as some other privacy laws. Nevertheless, financial, identity, health, legal and other confidential records may require heightened safeguards depending on the circumstances.

Key distinction: The Act regulates the processing of digital personal data. It does not automatically cover every paper document merely because that document contains personal information.

Which Companies Are Covered?

1. All Business Sizes: Small startups, mid-sized firms, and large enterprises have the same core obligations regarding digital personal data.
2. Sector Examples: E-commerce platforms, IT/SaaS firms, banks, NBFCs, insurers, fintechs, healthcare organizations, and manufacturing/corporate entities handling employee or customer data in digital form.
3. International Companies: Overseas entities that process personal data while offering goods or services to individuals within India.
4. Significant Data Fiduciaries (SDFs): Larger organizations notified by the government based on data volume, sensitivity, or risk profiles face extra statutory duties (such as appointing a Data Protection Officer based in India, data audits, and impact assessments).

Core Obligations for Data Fiduciaries (Businesses):

1. Valid Consent: Must be free, specific, informed, unconditional, and unambiguous; bundled consent in terms and conditions is invalid.
2. Easy Withdrawal: Revoking consent must be as simple as granting it (e.g., a one-step digital toggle).
3. Data Minimization & Retention: Collect only what is necessary and delete personal data once the specified purpose is fulfilled.
4. Children’s Data: Requires verifiable parental consent; tracking, behavioral monitoring, and targeted advertising to minors under 18 are prohibited.
5. Grievance Redressal: Every Data Fiduciary must appoint and prominently publish contact details for a local Grievance Officer.
6. Data Breach Reporting: Mandatory notification of data breaches must be made directly to the DPBI and affected Data Principals.

Data Breach Reporting Schedule:

The data breach Reporting Timeline is structured as follows:

1. Initial Intimation (Without Delay): The Data Fiduciary must immediately notify the Data Protection Board of India (DPBI) and each affected Data Principal (individual) upon becoming aware of a personal data breach.
2. Detailed Report (Within 72 Hours): A comprehensive report detailing the nature, extent, timing, likely impact, and mitigation measures must be submitted to the Data Protection Board within 72 hours of awareness, unless an extension is granted by the Board upon a written request.
3. Effective Enforcement Date: While the DPDP Rules were notified on November 13, 2025, the substantive provisions regarding breach notifications are scheduled to come into full legal force after an 18-month implementation period in May 2027.

Key Requirements:

1. Dual Notification: Fiduciaries must notify both the regulatory authority (DPBI) and the affected individuals directly.
2. No Threshold: Every personal data breach must be reported regardless of its scale or number of affected persons.
3. Plain Language: Notifications sent to Data Principals must use clear, accessible language describing the breach, potential risks, and protective steps they can take.
4. Overlapping Obligations: Regulated entities subject to the CERT-In Directions (2022) must separately report applicable cybersecurity incidents within 6 hours of detection under IT Act guidelines.

Penalties for Non-Compliance:

1. Up to ₹250 Crore: Maximum financial penalty per violation for severe security safeguard failures.
2. Up to ₹200 Crore: Penalties for failing to protect children's data, breach notification lapses, or consent violations.