R M   L E G A L

Data Protection Compliance (DPDP Act)

RM Legal advises businesses on compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025. We help organisations understand what personal data they hold, put the required notices, consents and safeguards in place, and update their contracts with vendors and service providers.

What We Do

Our work includes:

  • Data mapping and gap assessments
  • Privacy notices and consent mechanisms
  • Data processing agreements with vendors and service providers
  • Internal policies on security, retention and breach response
  • Processes for handling requests from individuals to access, correct or erase their data
  • Advice on children's data and verifiable parental consent
  • Advice on obligations of Significant Data Fiduciaries
  • Breach response and reporting to the Data Protection Board

Who the Law Applies To

The DPDP Act applies to the processing of digital personal data in India, and to processing outside India where it relates to offering goods or services to individuals in India. Any business that collects personal data of customers, employees, website users or business contacts is likely to be a "data fiduciary" with obligations under the Act.

Key Dates

The DPDP Rules, 2025 were notified on 13 November 2025 and come into force in phases. The Data Protection Board and related provisions took effect immediately. The rules on Consent Managers apply from November 2026. Most obligations on businesses, including notices, consent, security safeguards, breach reporting, individuals' rights, children's data and retention, apply from May 2027.

Core Obligations

  • Notice and consent: personal data must generally be processed on the basis of consent obtained through a clear, itemised notice, or for specified legitimate uses.
  • Security safeguards: reasonable security measures, such as encryption, access controls and logging, must be in place, including for data handled by processors.
  • Breach reporting: a personal data breach must be reported to the Data Protection Board and to the affected individuals without delay, with a detailed report to the Board within 72 hours.
  • Individuals' rights: individuals can seek access to, correction and erasure of their data, and must have a way to raise grievances.
  • Children's data: processing the personal data of children requires verifiable parental consent, and targeted advertising directed at children is prohibited.
  • Retention: data must be erased once its purpose is served, and certain large platforms are subject to specified retention periods.

Penalties

The Data Protection Board can impose penalties of up to ₹250 crore for a single breach, depending on the nature of the default, such as a failure to maintain reasonable security safeguards.

Frequently Asked Questions

Does the DPDP Act apply to small businesses?
Yes. The Act applies to businesses of every size that process digital personal data, though the Government can exempt certain classes of data fiduciaries, including start-ups, from some provisions.

When do businesses need to comply?
Most obligations apply from May 2027. Businesses should use the time before then to map their data, update notices and contracts, and set up breach response processes.

Does it cover employee data?
Yes. Personal data of employees is covered, although processing for certain employment purposes is a legitimate use that does not always require consent.

What should a vendor contract include?
Clear instructions on processing, security obligations, breach notification to the business, restrictions on sub-processing, and deletion or return of data at the end of the contract.

What is a Significant Data Fiduciary?
A business notified by the Government on the basis of factors such as the volume and sensitivity of data processed. It must appoint a Data Protection Officer in India, carry out periodic data protection impact assessments, and undergo independent audits.

What are the penalties?
Up to ₹250 crore for a single breach, depending on the default.

Reviewed by Richa M. Goyal, Managing Partner. Last reviewed: October 2026.

Related Services