A patient fills out a registration form at a hospital. A shopper saves her address on an e-commerce app. A job candidate emails his resume to HR. Each time, an organisation collects personal data, and under the Digital Personal Data Protection Act 2023 each one is now legally responsible for how that data is used, stored and deleted.
This guide explains what the Act says, what changes for your business, and how TeamSync helps you prove compliance before the deadline arrives.
What Is the Digital Personal Data Protection Act 2023?
The DPDP Act is India's first comprehensive law on digital personal data. It received Presidential assent on 11 August 2023.
It applies to:
Personal data collected digitally, or collected on paper and later digitised. That means a scanned KYC form counts.
Organisations outside India that process data to offer goods or services to people in India.
It does not apply to data used for purely personal or domestic purposes, or to personal data that a person has made public themselves.
Key Terms, Explained Simply
Data Principal: the person the data is about, such as a customer, patient, employee or student.
Data Fiduciary: the organisation that decides why and how data is processed. This is usually your business.
Data Processor: a vendor that processes data on your behalf, such as a payroll provider or cloud host.
Significant Data Fiduciary (SDF): a fiduciary the government designates based on data volume and risk. SDFs carry extra duties, including a Data Protection Officer based in India, independent audits and impact assessments.
Consent Manager: a registered platform through which people can give, manage and withdraw consent.
When Does the DPDP Act Apply? The 2027 Deadline
The Act needed operating rules, and the DPDP Rules, 2025 were notified on 14 November 2025. They roll out in three phases:
November 2025: the Data Protection Board of India was set up.
November 2026: Consent Manager registration begins.
May 2027: the core duties apply, covering notice and consent, security safeguards, breach reporting, children's data, SDF obligations and cross-border transfers.
Full compliance is due by 13 May 2027, with no grace period after that date. If your organisation holds years of customer files, that runway is shorter than it looks.
Your Core Obligations as a Data Fiduciary
1. Give a clear notice and get valid consent
Consent must be free, specific, informed, unconditional and unambiguous, and withdrawing it must be as easy as giving it.
Example: an e-commerce app can use your address to deliver an order. Sending your data to a partner brand for promotions needs separate consent. If you unsubscribe in one tap, the partner feed must stop too.
2. Know when consent isn't required
The Act also allows certain legitimate uses without fresh consent, such as processing employee data for employment purposes or responding to a medical emergency.
Example: HR can process an employee's bank details for salary. It cannot reuse that same data for an unrelated marketing survey.
3. Use data only for its purpose, then erase it
Once the purpose is served and no law requires you to keep the data, it must be deleted. Your processors must delete it too.
Example: a company rejects 2,000 job applicants. Keeping their resumes in an HR inbox for five years "just in case" now creates risk with no benefit.
4. Protect the data and report breaches
You must apply reasonable security safeguards such as encryption, access controls and logs. If a breach happens, you must inform the Data Protection Board and every affected person.
Example: a laptop with unencrypted patient discharge summaries is stolen from a clinic. That is a reportable breach, and the clinic needs to know exactly which patients were in those files.
5. Take extra care with children's data
Processing data of anyone under 18 needs verifiable parental consent. Tracking, behavioural monitoring and targeted ads aimed at children are not allowed.
Example: an edtech platform must verify a parent before a 14-year-old creates an account.
Rights People Now Have
Under the Digital Personal Data Protection Act 2023, individuals can:
Ask what personal data you hold and who you have shared it with
Request correction, completion, updating or erasure
Raise a grievance and expect a response
Nominate someone to act for them in case of death or incapacity
People have duties too. Filing a false or frivolous complaint can attract a penalty of up to ₹10,000.
Where Most Businesses Are Exposed
Policies and cookie banners are the easy part. The real risk sits in unstructured content: scanned forms, PDFs, email attachments and shared drives where personal data piles up without owners, purposes or deletion dates. If you can't find it, you can't protect it, delete it or report on it.
How TeamSync Helps You Comply with the DPDP Act
TeamSync is a regulated content and AI platform that turns DPDP requirements into everyday controls.
Discover personal data. Metadata extraction and OCR/ICR identify Aadhaar, PAN, phone numbers and health details, even inside scanned documents.
Control access. Role-based access control ensures employees and vendors see only what their role needs.
Automate retention. Retention rules by document type delete data when its purpose ends, and log each deletion as proof.
Respond to rights requests. Semantic search finds every document linked to a person, so access and erasure requests take hours, not weeks.
Stay audit-ready. A tamper-evident audit trail records who viewed, shared or changed what, ready for the Data Protection Board.
For sector-specific guidance, read our guide on DPDP compliance for banks.
