A turning point for India's digital economy — here's who the DPDPA defines as stakeholders, what it demands of them, and what happens when they fall short.
January 2025 · 6 min read
India's Digital Personal Data Protection Act, 2023 marks a real turning point in how the country handles digital data — it sets out a comprehensive legal framework for protecting personal data, gives citizens defined power over their own information, and raises accountability for the businesses and government bodies that process it. Here's the essence of the law, who it touches, and what staying compliant with it actually involves.
The individual the personal data is about — in practice, you and me, and everyone whose data flows through a digital system.
The entity deciding why and how personal data gets processed — the businesses, apps, and platforms actually making that call.
A neutral, licensed platform authorised to manage and record consent on a Data Principal's behalf, sitting between the individual and the organisations processing their data.
Organisations carrying large-scale data processing responsibilities. This classification comes with enhanced obligations — appointing a Data Protection Officer and conducting Data Protection Impact Assessments among them.
Data Principals hold a defined set of rights: to access their own personal data, to correct or erase it, to raise a grievance and have it addressed, and to nominate someone else to act on their behalf in the event of incapacity or death.
Fines for data breaches or non-compliance can reach ₹250 crore. The Data Protection Board of India exists specifically to enforce the Act — investigating, inquiring, and issuing penalties where warranted.
The obligation reaches any organisation operating in India, or processing the data of Indian users regardless of where the organisation itself is based. That includes entities offering digital services, financial services, ecommerce, healthcare, and more. Startups are not broadly exempt — the carve-outs that exist are limited and specific, not a general pass for smaller companies.
The DPDPA isn't really about ticking legal boxes. At its core, it's about respecting digital rights and building a business culture where trust is a structural feature, not an afterthought bolted on for a compliance audit. The organisations that treat it that way now — not because a deadline forces them to, but because it's the right way to build — are the ones that will find the transition easiest.
Turning this into an actual compliance posture, rather than a summary you've read, starts with our DPDP gap assessment.
30 minutes to talk through your specific data footprint — no obligation.
Book a Consultation