DPDP Act 2023 Compliance: What Every Indian Business Needs to Know in 2026

If you process personal data of Indian users – customers, employees, or website visitors – the DPDP Act 2023 applies to you, and the compliance clock is no longer theoretical. With the Digital Personal Data Protection Rules notified in November 2025, penalties running up to ₹250 crore for inadequate security safeguards and effectively ₹500 crore in aggravated cases, and a hard deadline for substantive obligations landing in May 2027, “we’ll get to it next quarter” is quickly becoming the most expensive sentence in Indian IT governance. Here’s what the DPDP Act actually requires, who it applies to, and how to get audit-ready without the panic.

What Is the Digital Personal Data Protection Act, 2023?

The Digital Personal Data Protection Act (DPDP Act) is India’s first comprehensive data protection law, built to give individuals “Data Principals” control over how their personal data is collected, used, and stored, while placing enforceable obligations on the organisations that process it “Data Fiduciaries”. Passed in 2023 after years of consultation, the Act’s operational teeth arrived only once the DPDP Rules were formally notified – and 2026 is the year most Indian businesses are discovering how much groundwork that actually requires. Unlike GDPR, which many Indian IT and BFSI companies already benchmark against, the DPDP Act India framework has its own scope, penalty structure, and reporting timelines – meaning existing GDPR alignment is a head start, not a free pass.

Who Needs to Comply

The DPDP Act’s reach is broad by design. It covers any entity processing digital personal data in India, and – critically – any entity outside India that processes personal data in connection with offering goods or services to individuals in India. That means IT services companies, BFSI institutions, healthcare and hospital groups, e-commerce platforms, SaaS providers, and their vendors and sub-processors are all in scope. Organisations that handle personal data at scale, or that process sensitive categories of data, may additionally be designated Significant Data Fiduciaries, triggering extra obligations – and extra penalty exposure, up to ₹150 crore for related non-compliance alone.

The Core Obligations

Four obligations sit at the centre of any DPDP Act compliance programme:

• Consent and notice: Data Fiduciaries must obtain clear, specific, informed consent before processing personal data, and must give data principals plain-language notice of what’s being collected and why.
• Security safeguards: The Act requires organisations to implement reasonable security safeguards to prevent breaches – this is the single largest penalty exposure in the Act, capped at ₹250 crore per contravention.
• Breach notification: This is where DPDP compliance intersects hardest with day-to-day IT operations. Under CERT-In’s existing directions, cybersecurity incidents must be reported within 6 hours of detection, with ICT system logs retained for a rolling 180 days within Indian jurisdiction. Under the DPDP Act itself, Data Fiduciaries must separately notify the Data Protection Board of India and every affected data principal, with a detailed report due within 72 hours – and no minimum-size threshold. A breach affecting ten records carries the same data breach notification obligation as one affecting ten million. Failure to notify alone can cost up to ₹200 crore.
• Data principal rights: Access, correction, erasure, and grievance redressal must be operationally supported, not just written into a policy document.

How DPDP Act Compliance Connects to Security Testing and Readiness

Here’s the part most compliance checklists skip: DPDP obligations aren’t satisfied by a policy PDF. The Act’s security safeguards requirement, combined with CERT-In’s 6-hour reporting mandate, effectively makes continuous security testing and structured incident response non-negotiable – not optional best practice. For businesses regulated by financial or insurance authorities, or those pursuing recognised information security benchmarks, this means Vulnerability Assessment and Penetration Testing (VAPT) is now a practical prerequisite, not a periodic audit checkbox. A well-run information security management programme gives you the documented controls, log retention discipline, and incident response runbooks that map directly onto what the Data Protection Board and CERT-In will ask for after a breach. Cyber insurance India providers are also increasingly tying premium pricing and claim eligibility to demonstrable security posture – meaning DPDP readiness and VAPT cadence now directly affect what you pay to transfer breach risk.

A Practical DPDP Act Readiness Checklist

• Map every system, vendor, and third party that touches personal data, and classify what’s collected
• Review and rewrite consent flows and privacy notices in plain language
• Run a security safeguards gap assessment – this is where VAPT belongs
• Build (and rehearse) a breach response runbook that satisfies both the CERT-In 6-hour and DPBI 72-hour clocks
• Confirm ICT log retention meets the 180-day, India-hosted requirement
• Assess whether your data volumes or categories could trigger Significant Data Fiduciary status
• Treat security testing and cyber insurance as part of the same risk programme, not separate line items

What Happens If You’re Not Compliant

The Data Protection Board of India can levy penalties up to ₹250 crore for inadequate security safeguards, up to ₹200 crore for failing to notify a breach, and up to ₹150 crore for unmet obligations tied to Significant Data Fiduciary status – with the Act allowing enhancement up to roughly ₹500 crore in the most serious cases. The Board weighs factors like the gravity and duration of the contravention and whether remedial steps were taken promptly, so a fast, well-documented response measurably reduces exposure. Substantive obligations land in May 2027 – 2026 is your window to get ready, not the deadline.

fluidPro‘s managed IT services practice works with Indian enterprises on exactly this intersection: VAPT, security readiness assessments, and incident response architecture built to satisfy DPDP Act and CERT-In requirements together, not as separate projects. If your last security assessment predates the Rules notified in November 2025, it’s worth a conversation before your next audit does it for you.