DPDP Act in India: History, Present Rules, Future and What Your Business Should Do

Every business website collects personal data: a name in a contact form, a phone number for a callback, an email for a newsletter, a cookie that follows a visitor around. India's Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules, 2025 now decide how you can do this. This guide covers how the law came about, what it requires today, what is coming next, and exactly what to do about it.

In short

The DPDP Act applies to any business that handles digital personal data of people in India. You need clear consent, a plain notice, secure systems, and a way for people to use their rights. Penalties go up to ₹250 crore. Most business obligations start on 13 May 2027, about seven months from 15 October 2026, and a key date falls on 13 November 2026. The time to prepare is now.

How we got here: a short history

India took more than a decade to reach a data protection law. The story matters because it explains why the law is built the way it is.

2012: Justice A.P. Shah groupA government expert group recommends privacy principles for India.
2017: Puttaswamy judgmentA nine-judge Supreme Court bench declares privacy a fundamental right under the Constitution. This is the legal foundation for everything that follows.
2018: Srikrishna CommitteeA committee led by Justice B.N. Srikrishna submits a report and a draft data protection bill.
2019: Personal Data Protection BillThe bill is introduced in Parliament and sent to a Joint Parliamentary Committee for review.
2022: Bill withdrawnThe government withdraws the 2019 bill and releases a simpler draft later in the year.
August 2023: DPDP Act passedParliament passes the Digital Personal Data Protection Act, 2023 and it receives Presidential assent. It is shorter and simpler than earlier drafts.
13 November 2025: DPDP Rules notifiedAfter a draft and public consultation, the Rules are notified. They explain how the Act works in practice and set a phased timeline.

The DPDP Act today

Who and what it covers

The Act covers digital personal data processed in India, and data processed outside India when it is connected to offering goods or services to people in India. Offline data is covered only if it is later digitised. It applies to startups, agencies, clinics, schools and e-commerce stores as much as to large companies.

Key terms

Data Principal: the person the data is about, such as your customer or lead.
Data Fiduciary: the business that decides why and how the data is used. This is you.
Data Processor: a company that handles data for you, such as a CRM, email tool or hosting provider.
Consent Manager: a registered platform that lets people give, manage and withdraw consent in one place.
Data Protection Board of India: the body that handles complaints and breaches and can impose penalties.

What you must do

Get clear consentFree, specific, informed and unambiguous, given by a clear action. Pre-ticked boxes and bundled consent do not work.

Give a plain noticeSay what data you collect, why, how people can exercise their rights, and how to complain. The notice must be available in English or any of the 22 languages in the Constitution's Eighth Schedule, so Hindi and Punjabi are options for North India.

Collect only what you needUse the data only for the purpose you stated, and delete it when that purpose is over, unless the law requires you to keep it.

Respect people's rightsAccess, correction, erasure, grievance redressal, and the right to nominate someone to act for them. Withdrawing consent must be as easy as giving it.

Protect the data and report breachesUse reasonable security safeguards. After a breach, inform affected people and report to the Board, with a detailed report following within the time the Rules set.

Handle children's data with careAnyone under 18 needs verifiable parental consent. Tracking, behavioural monitoring and targeted ads aimed at children are restricted.

Consent is not the only lawful basis. The Act also allows processing for certain "legitimate uses", such as data a person voluntarily gives for a specific purpose, some employment purposes and legal obligations. Do not assume every case needs a consent popup, but marketing and tracking almost always do.

Penalties

Failure	Maximum penalty
Not keeping reasonable security safeguards	₹250 crore
Not reporting a data breach	₹200 crore
Breaking children's data obligations	₹200 crore
Extra duties of Significant Data Fiduciaries	₹150 crore
Other breaches of the Act or Rules	₹50 crore

These are upper limits. The Board decides the actual amount based on how serious, repeated and harmful the failure was, and whether you acted to reduce the damage.

Timeline of the rollout

13 November 2025 (done)The Data Protection Board and the basic framework came into effect. People can already complain to the Board.
13 November 2026 (about four weeks away)Consent manager registration opens, 12 months after notification.
13 May 2027 (about seven months away)Most business obligations start, 18 months after notification: notices, consent, user rights, breach reporting and retention. This is your main deadline.

Some sources give slightly different May 2027 dates, so confirm the exact day in the official Gazette text. The government has also discussed shortening the 18-month window, but as of this update the May 2027 date still stands. Watch official MeitY announcements.

What DPDP means for your website, SEO and marketing

Forms: every contact, enquiry and booking form needs a short notice and an unticked consent checkbox. Ask only for fields you really use.
Analytics and ad tags: Google Analytics, Meta Pixel, remarketing and heatmap tools should load only after consent for non-essential tracking. Expect smaller datasets and rely more on first-party data.
Email, SMS and WhatsApp marketing: keep proof of when and how each person opted in, and add a simple unsubscribe.
CRM and lead data: know where leads live, who can see them and how long you keep them. Old, unused leads are a risk, not an asset.
Chatbots and AI tools: check what personal data they capture, where it is stored and whether the vendor uses it to train models.
Trust and rankings: a clear privacy policy, contact details and visible data practices support E-E-A-T. This helps both Google rankings and the chance of being cited by AI platforms like ChatGPT, Gemini and Perplexity.

The winners will be businesses that earn attention instead of tracking it: strong content, local visibility and email lists built on real opt-in. That is exactly what good SEO and GEO already aim for.

The future: what to expect next

Active enforcement: the Data Protection Board is a digital-first body. Expect early cases to focus on breaches, missing notices and children's data.
Consent managers: people may soon manage consent across many businesses from one dashboard, so your systems must be able to respond to withdrawals quickly.
Cross-border data: transfers abroad are allowed by default, but the government can restrict specific countries and sectors may add stricter rules.
Stricter rules for large players: Significant Data Fiduciaries face audits, impact assessments and a data protection officer based in India.
AI and personal data: using customer data to train or run AI tools will need a lawful basis, so expect more questions about AI vendors.
Higher customer expectations: as awareness grows, people will ask why you need their data and will choose businesses that explain it well.

Guidance, clarifications and sector rules may change the details. Treat this section as direction, not a promise.

What to do: a practical action plan

Use this plan in order. Tick items as you go to track your progress. With about seven months left, a 12-week plan leaves you time to test everything before the deadline.

Common mistakes to avoid

Copying a privacy policy from another website without matching it to your real practices.
Showing a cookie banner while tracking tags still fire before consent.
Keeping every old lead forever "just in case".
Assuming you are too small for the law to apply.
Ignoring what your vendors do with your customer data.

Frequently asked questions

Does the DPDP Act apply to small businesses?

Yes. The core duties apply to any business that decides why and how personal data is processed. The Rules offer relief to some classes, such as startups, mainly for extra obligations, but not an exemption from consent, security and breach duties.

Do I need a cookie banner?

If you use analytics, advertising or tracking tools that process personal data, you need clear consent before they run. Essential cookies that keep the site working are treated differently.

When do I need to be ready?

Most business obligations start on 13 May 2027. Consent manager registration opens earlier, on 13 November 2026. Starting now leaves time to fix systems, vendors and habits without rushing.

Do I need a Data Protection Officer?

Only Significant Data Fiduciaries must appoint one. Every business should still name a person who handles privacy questions and complaints.

Can I still use my old email list?

Review it. If you cannot show that people agreed to hear from you for that purpose, ask them to opt in again or stop using their data for marketing.

Disclaimer: This article is for general information, current as of 15 October 2026, and is not legal advice. The law and its rules may change. Please read the official text and consult a qualified legal professional for your situation.

Need help with a compliant, high-ranking website?

CredoRank helps businesses rank on Google and AI platforms with AI SEO, GEO, Technical SEO, Content Optimization, Link Building, Local SEO, Analytics and SEO-optimized website development. We are available 24/7. Visit credorank.com to get started.

Author

Rajni Thakur