The Digital Personal Data Protection Act, 2023 is India’s first comprehensive data protection statute, and it applies well beyond large technology companies. Any business that collects a customer’s phone number for an order confirmation, an employer that stores employee records digitally, or a clinic that keeps patient information on a computer, is processing personal data within the meaning of the Act.
Most of what follows is not complicated. The difficulty for small businesses is usually not understanding the obligations — it is knowing that they apply at all, and building the modest compliance habits that satisfy them before a complaint or a breach forces the issue.
Who this law covers
The Act applies to the processing of digital personal data within India, and, notably, to processing outside India as well where it is in connection with offering goods or services to individuals in India. It uses three key terms: the Data Principal is the individual to whom the personal data relates; the Data Fiduciary is the person or entity that determines the purpose and means of processing that data — ordinarily, the business itself; and a Data Processor is any person who processes data on behalf of a Data Fiduciary, such as an outsourced payroll provider or a cloud vendor.
A small business is almost always a Data Fiduciary in respect of its customers and employees, and it remains responsible for compliance even where processing is outsourced to a Data Processor.
Where the Act currently stands
The Act received presidential assent in August 2023. As with several recent statutes, its substantive obligations depend on rules and a phased notification of provisions, including the operationalisation of the Data Protection Board of India that will administer and enforce it. Businesses should treat the Act as the framework that will govern their data practices and build towards it now, while checking the current notification status of the specific provisions relevant to them — particularly the compliance timelines and the constitution of the Board — before assuming a given obligation is presently enforceable against them.
What is not in doubt is the direction of travel: the principles below reflect the scheme of the Act as enacted, and building processes around them is not wasted effort even where a particular provision’s enforcement date is still to be confirmed.
Notice and consent
Before processing personal data, a Data Fiduciary must give the Data Principal a notice describing the personal data being collected and the purpose of processing, in clear and plain language, either in English or any language specified in the Eighth Schedule to the Constitution. Processing itself must ordinarily be based on the Data Principal’s consent, which the Act requires to be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action.
Consent must be as easy to withdraw as it was to give. The Act also recognises certain legitimate uses that do not require fresh consent — for example, where the Data Principal has voluntarily provided the data for a specified purpose and has not indicated they do not consent, compliance with a legal obligation, a medical emergency, or specified employment-related purposes — but these are exceptions to be relied on carefully, not a general substitute for consent.
Rights of Data Principals
Individuals whose data is processed have a defined set of rights: to obtain a summary of the personal data being processed and the processing activities; to seek correction, completion, updating and erasure of their personal data; to have their grievance addressed by the Data Fiduciary within a reasonable time; and to nominate another individual to exercise these rights on their behalf in the event of death or incapacity.
A small business needs a working way to actually receive and act on these requests — a published contact point is the minimum, not a system that only exists on paper.
Duties of a Data Fiduciary
The Act places the operative obligations on the Data Fiduciary. It must process data only for the purpose consented to or otherwise permitted, ensure the data is accurate and complete where it will be used to make a decision affecting the Data Principal or shared with another Fiduciary, and put in place a mechanism for Data Principals to make complaints. Where the purpose for which data was collected is no longer being served and retention is not required by law, the data must be erased, and the same applies where the Data Principal withdraws consent.
Certain Data Fiduciaries designated as Significant Data Fiduciaries, based on the volume and sensitivity of data they process, carry additional obligations — appointing a Data Protection Officer based in India, undertaking periodic data protection impact assessments, and independent audits. Most small businesses will not meet this threshold, but the classification is worth checking as the business scales.
Security safeguards and breach notification
Every Data Fiduciary, regardless of size, must implement reasonable security safeguards to prevent a personal data breach — access controls, encryption where appropriate, and basic protections proportionate to the data actually held. What is “reasonable” for a business holding a customer’s name and phone number is different from what is reasonable for one holding financial or health records; the standard scales with the sensitivity of the data.
A breach must be notified, not managed quietly
In the event of a personal data breach, the Act requires the Data Fiduciary to notify the Data Protection Board and the affected Data Principals. Treat this as a compliance obligation from day one, not a decision to make under pressure after a breach has already occurred — have a short, written breach response plan in place before you need it.
Children’s data
Processing the personal data of a child — defined as an individual under eighteen — requires verifiable parental or guardian consent before processing. The Act also prohibits processing that is likely to cause detrimental effect on a child’s wellbeing, and bars tracking, behavioural monitoring, and targeted advertising directed at children.
This matters more than businesses assume: any consumer-facing platform, school-adjacent service, or app that could plausibly be used by a minor needs an age-verification and parental consent mechanism, not merely a checkbox stating the user is an adult.
What a small business should actually do
- Map what personal data you actually hold — customers, employees, vendors — and why. Most businesses collect more than they need and keep it longer than they should.
- Rewrite your notices and consent flows so they clearly state what is collected and for what purpose, in plain language, with a real opt-out.
- Set up a single point of contact for data-related grievances and rights requests, and make sure someone actually monitors it.
- Put reasonable, documented security practices in place, proportionate to what you hold — this does not need to be elaborate for a small business, but it needs to exist and be written down.
- Prepare a short breach response plan now, including who is notified and how, rather than improvising one during an actual incident.
- Review any data involving minors separately and specifically — the consent and advertising restrictions here are stricter than for adult users.
This is general information, not advice on your case
The law summarised above is stated as at the date of publication and applies differently to different facts. Nothing here creates an advocate–client relationship. If the subject affects you, speak to a lawyer about your own position — request a consultation or call +91 83685 88897.