India’s Digital Personal Data Protection Act, 2023 (the DPDP Act) sets rules for any business that handles personal data of people in India, such as customers’ names, phone numbers, health details or children’s records. In short, you must collect personal data with clear notice and consent, use it only for that purpose, keep it secure, report breaches, and delete it when it is no longer needed. Your business software needs to support all of this.
When do the rules apply?
The government notified the DPDP Rules in November 2025, with most business obligations coming into force in phases over the following 18 months. Check the current dates on the official sources before you plan, because timelines can be updated.
The main duties, in plain words
| Duty | What it means for your business |
|---|---|
| Notice | Tell people clearly what data you collect and why |
| Consent | Get clear, specific consent, and let people withdraw it as easily as they gave it |
| Purpose | Use the data only for the purpose you stated |
| Accuracy | Keep data correct and complete when it is used for decisions |
| Security | Protect data with reasonable safeguards |
| Breach reporting | Report personal data breaches to the Data Protection Board and to affected people |
| Deletion | Erase data when the purpose is over, unless the law requires you to keep it |
| Rights | Let people see, correct and erase their data, and handle complaints |
| Children | Get verifiable consent from a parent for children’s data |
Penalties for serious failures, such as not protecting data properly, can be very large, up to hundreds of crores of rupees.
What your software must be able to do
- Record consent: what each person agreed to, when and how.
- Withdraw consent: a simple way for a person to say no, and the software then stops using the data.
- Limit access: each staff member sees only what their job needs.
- Log access: who viewed or changed personal data, and when.
- Encrypt and back up: data protected in storage and in transit, with safe backups.
- Export and correct: show a person their data, and correct it.
- Delete on schedule: remove data after its retention period.
- Detect and report breaches: alerts for unusual access, and a way to gather the facts quickly.
Who should pay most attention?
- Schools and colleges: students’ and children’s data.
- Hospitals and clinics: health data.
- Finance, insurance and lending businesses.
- E-commerce and apps with large customer lists.
- Businesses using WhatsApp or SMS marketing.
A first-step checklist
- List every place personal data lives: software, Excel, email, WhatsApp, paper.
- Write down why you collect each type of data.
- Remove what you don’t need.
- Update the notices on your website and forms.
- Check who has access to what, and close old accounts.
- Make sure backups and logs exist.
- Decide who in the business handles data requests and breaches.
How Ameya Artha helps
We build software with consent records, access control, audit logs and secure storage designed in from the start, and can review how your current software handles personal data. This is general information, not legal advice. See our software services