Understanding the DPDP Act 2023: A Compliance Roadmap
India's digital landscape has undergone a seismic shift with the notification of the Digital Personal Data Protection (DPDP) Act, 2023. For years, businesses operated in a regulatory grey area, but the new framework brings clarity—and significant responsibility.
Key Obligations for Data Fiduciaries
The Act classifies organizations processing data as "Data Fiduciaries." The core obligations include:
- Notice & Consent: Consent must be free, specific, informed, unconditional, and unambiguous. A clear notice must precede any data collection.
- Purpose Limitation: Data can only be used for the purpose it was collected for.
- Data Minimization: Collect only what is strictly necessary.
- Grievance Redressal: A mandatory mechanism to address user complaints.
The Cost of Non-Compliance
Unlike previous drafts, the DPDP Act 2023 focuses heavily on financial penalties. The Data Protection Board (DPB) can impose fines up to ₹250 Crores for a single instance of a data breach. There is no criminal liability, but the economic impact on a business could be crippling.
Strategic Steps Forward
Organizations must immediately audit their data flows. If you are collecting legacy data, you must send a fresh notice to all users. Start by appointing a Data Protection Officer (DPO) if you are a Significant Data Fiduciary, and begin the process of "Privacy by Design."