India's Digital Personal Data Protection (DPDP) Act

The DPDPA is India’s primary law governing the processing of personal data. It aims to protect the privacy of individuals (known as “data principals”) by regulating how organizations (known as “data fiduciaries”) collect, store, process, and share personal data. The Act imposes strict obligations on data fiduciaries, including obtaining explicit consent from individuals (when applicable), ensuring data security, and providing transparency in data handling practices. It also grants individuals certain rights over their personal data, such as the right to access, correct, and request the deletion of their data.

The DPDPA applies to organizations that process personal data of individuals in India, including businesses operating outside India that offer goods or services to Indian residents. It covers both data fiduciaries (controllers) and data processors handling personal data on behalf of others.

For most organizations, appointing a dedicated DPO is not mandatory under the DPDPA. However, Significant Data Fiduciaries (SDFs)—organizations that process large volumes of personal data or handle high-risk data—must appoint a DPO based in India. Even for organizations not classified as SDFs, having a DPO is highly recommended to effectively manage compliance obligations and reduce regulatory risks.

Organizations that fail to comply with the DPDPA may face significant financial penalties. The law imposes fines of up to ₹250 crore ($30 million) for failing to prevent personal data breaches and up to ₹200 crore ($24 million) for non-compliance with obligations relating to children’s data. Additional penalties may apply for violations such as failing to report data breaches, unlawfully processing personal data, or not adhering to proper data retention practices. The DPDP Act even provides for criminal liability and imprisonment in certain situations.