What is the DPDP Act 2023?

The Digital Personal Data Protection Act 2023 is India’s digital personal-data law. It was enacted in 2023. The final Rules and commencement notifications were issued in November 2025, with the core obligations in sections 3–17 scheduled to commence after an 18-month transition in May 2027.

Does the DPDP Act apply to my SME?

It may apply when your business processes digital personal data within India, or offers goods or services to people in India while processing their personal data, subject to the Act’s scope and exemptions. Contact forms, bookings, accounts, payments, and customer-support flows are common triggers for a closer review.

What is the maximum DPDP fine?

The Act’s Schedule specifies maximum penalties including up to ₹250 crore for failure to take reasonable security safeguards and up to ₹200 crore for certain children’s-data obligations. Actual exposure depends on the provision, commencement timeline, facts, and Board process; obtain legal advice for a specific case.

What does DPDP compliance actually require?

Two sides: legal and technical. Legal readiness includes notice with or before consent requests, a valid processing basis, a published privacy contact, a grievance mechanism, and processes for data-principal rights. Technical readiness includes reasonable security safeguards suited to the personal data and processing risks. A public website scan can observe supporting signals but cannot determine complete compliance.

How does RiskPulse help with DPDP compliance?

RiskPulse runs an automated external readiness scan covering three public signals — an inspectable privacy notice, consent controls where non-essential tracking is observed, and a privacy or grievance contact — plus technical security signals such as SSL, headers, ports, and breach exposure. Unknown evidence is reported as unknown, not as compliance or failure.

Is RiskPulse a substitute for a lawyer?

No. RiskPulse is an automated external readiness scan. It cannot observe internal processing, lawful bases, consent records, contracts, security governance, or grievance operations. Consult qualified counsel and security specialists for a complete assessment.

India / Digital Personal Data Protection Act 2023

Privacy is now a business obligation.

If your business collects customer data, DPDP is not a policy-page exercise. It is a visible operating discipline: know the data, protect it, and prove how you respond.

Check my readiness Open the owner's brief

Owner's brief / 04 controls

What must become visible

LIVE

01
Know what personal data you collect and why.
02
Protect it with reasonable security safeguards.
03
Explain consent, rights, and grievance routes clearly.
04
Prove that incidents can be found and answered.

Maximum penalty / security safeguards

₹250 crore

Applicability / 01

If you collect it, you must protect it.

The DPDP Act applies to ordinary digital interactions—not only large technology companies.

01
Does my business have a website?
Yes → You may be affected.
Covered
02
Does my website collect any customer information?
Yes → You are affected.
Covered
03
Does this include phone numbers, email addresses, names, payment details, or location?
Yes → You must comply.
Covered

Obligations / 02

Policy and proof.

Compliance has a legal face and a technical backbone. Both must be visible.

Legal requirements

1Clear notice with or before consent requests explaining the personal data and purpose
2A valid processing basis and, where consent applies, an equally easy withdrawal mechanism
3Published business contact information for privacy questions and a grievance mechanism
4A process for responding to customer requests to access or delete their data

Technical safeguards

1Encrypted connections for all data transmission (SSL/TLS)
2Protection against unauthorized access to systems holding personal data
3Email domain security preventing impersonation
4No exposed databases or cloud storage containing customer data
5Regular monitoring for data breaches affecting customer credentials
6No outdated software with known vulnerabilities handling personal data

Exposure / 03

The cost of leaving it vague.

₹250 crore

for failure to implement reasonable security safeguards resulting in a data breach

₹200 crore

for breach of obligations regarding children's data

₹10,000

for individual violations by data principals

DPDP Act FAQ

Plain answers to the questions Indian SMEs keep asking.

The final DPDP Rules use phased commencement. Core obligations in sections 3–17 are scheduled for May 2027, so this is the preparation window for Indian SMEs.

Primary sources / 04

Verify the law at its source.

RiskPulse reports public technical readiness signals, not legal certification. The Act is being commenced in stages; official legislation and notifications remain the source of truth.

Check your public DPDP readiness signals in 45 seconds.

Free scan. No account needed.

Check My DPDP Readiness →