DPDP Act 2023: A practical compliance roadmap for Indian enterprises

The Digital Personal Data Protection Act, 2023 changed the default for Indian businesses: personal data processing now requires a lawful basis, demonstrable safeguards, and the ability to honor data principal rights. With rules notified and enforcement machinery taking shape, "we'll look at it next quarter" has become a risk position, not a plan.

Start with what the Act actually asks of you

Strip away the commentary and the DPDP Act asks four things: know what personal data you process and why; have a lawful basis (consent or legitimate uses) for each purpose; protect the data with reasonable safeguards and report breaches; and honor data principal rights — access, correction, erasure, grievance.

A sequence that works

1. Data mapping first. You cannot comply with a law about data you haven't inventoried. Map personal data flows across systems, vendors and teams — what's collected, where it lives, who touches it, when it's deleted. This single artifact drives everything else.

2. Rationalize purposes and consent. Most organizations discover they collect more than they use and keep it longer than they should. Cut what you don't need — every field you stop collecting is compliance you don't have to engineer.

3. Fix the mechanics of rights. Erasure and access requests fail in practice because data is scattered. Decide now how a deletion request propagates to backups, analytics and vendors — regulators will ask.

4. Contract your processors. Data processors act on your instructions; that relationship needs paper. Update vendor agreements with processing terms, breach notification timelines and audit rights.

5. Prepare for breach reporting. DPDP breach notification runs alongside CERT-In's 6-hour incident reporting. One incident process should satisfy both — build it once, exercise it annually.

Where companies overspend

Consent-management platforms bought before data mapping. Committees before owners. Policy documents before deletion mechanics. Tooling is the last 20% of DPDP compliance; the first 80% is knowing your data and cutting what you don't need.

If you're starting from zero, a focused readiness assessment typically takes two to four weeks and gives you a costed roadmap. That's the honest entry point — not a platform subscription.