DPDP Act 2023 Compliance & Consent Management
India’s Digital Personal Data Protection Act applies to every business that handles digital personal data of people in India — and to foreign companies offering goods or services to them. Vyapari Solutions turns the statute into a working consent, notice and rights programme.
4.9/5 average client rating · 500+ engagements delivered
What the DPDP Act requires
The DPDP Act is deliberately principle-led and short. Its obligations, however, reach into almost every system that stores a name, phone number, email or identifier — CRM, marketing automation, support desk, HRMS, app SDKs and analytics.
The central duty is accountability: a Data Fiduciary determines why and how personal data is processed, and remains responsible even when a processor does the work. Consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action — and it must be as easy to withdraw as it was to give.
- Itemised notice in plain language and in the Eighth Schedule languages, presented before or at the point of collection
- Verifiable consent records, granular by purpose, with a withdrawal path that propagates to every downstream system
- Data Principal rights: access, correction, erasure, grievance redressal and nomination
- Verifiable parental consent for children under 18, and no behavioural advertising or tracking directed at children
- Breach notification to the Data Protection Board and to every affected Data Principal
- Purpose limitation, data minimisation and erasure once the purpose is served or consent is withdrawn
Key facts
| Law | Digital Personal Data Protection Act, 2023 with the DPDP Rules |
|---|---|
| Applies to | Data Fiduciaries and Data Processors handling digital personal data of Data Principals in India, including extraterritorial processing |
| Maximum penalty | Up to ₹250 crore per instance for failure to prevent a personal data breach |
| Legal bases | Consent, and certain legitimate uses defined in Section 7 |
| Typical project | 8–14 weeks depending on the number of systems and consent touchpoints |
What a DPDP programme covers
We rebuild the data lifecycle around purpose and consent, then wire the controls into the systems your teams already use.
Personal data discovery
Automated and interview-led discovery across SaaS, databases, file stores, SDKs and third-party trackers to find every processing activity.
Records of Processing (ROPA)
A living inventory of purposes, categories, retention periods, recipients and cross-border transfers.
Notice & consent design
Itemised notices, granular purpose-level consent, and multilingual delivery across web, app, IVR, WhatsApp and offline channels.
Consent manager integration
Architecture and integration for consent capture, storage, proof, withdrawal propagation and audit retention.
Rights fulfilment workflow
Access, correction, erasure, nomination and grievance workflows with SLA tracking and identity verification.
Breach readiness
Detection, severity classification, Board notification templates and Data Principal communication playbooks.
Data Fiduciary or Significant Data Fiduciary?
Every organisation processing digital personal data is a Data Fiduciary. The Central Government may notify some as Significant Data Fiduciaries based on volume and sensitivity of data, risk to Data Principals, electoral democracy, security of the State and public order. SDFs carry extra duties:
- Appoint a Data Protection Officer based in India who reports to the board or governing body
- Appoint an independent data auditor and undergo periodic data audits
- Conduct Data Protection Impact Assessments periodically
- Observe additional obligations that may be prescribed, including algorithmic due diligence
Penalty exposure reduced
The largest DPDP penalty attaches to breach prevention failures — our programme starts there, not with paperwork.
Marketing that still works
Purpose-level consent designed for conversion, so opt-in rates hold up instead of collapsing.
Reuse of GDPR investment
If you already run GDPR, we map the delta rather than rebuilding — and vice versa for India-first companies expanding abroad.
You finally know your data
The ROPA and discovery output usually reveals shadow systems and trackers no one had inventoried.
How the engagement runs
Applicability & gap assessment
We confirm your role (Fiduciary, Processor or both), test SDF triggers, and assess current state against every DPDP duty.
Data discovery & ROPA
Systems, purposes, flows, retention and third parties mapped into a maintainable record of processing activities.
Consent & notice re-engineering
We redesign collection points, draft multilingual itemised notices, and define the consent data model.
Implementation
Rights workflows, retention and erasure jobs, processor contracts, breach runbooks and staff training rolled out.
Assurance & DPO support
Internal data audit, DPIA where required, and ongoing DPO-as-a-service or advisory for your appointed DPO.
What you receive
- DPDP applicability and SDF assessment note
- Personal data inventory and Records of Processing Activities
- Itemised privacy notices in English plus Eighth Schedule languages
- Consent architecture, data model and integration specification
- Data Principal rights and grievance redressal SOPs with SLA tracking
- Data Protection Impact Assessment reports where applicable
- Processor agreements, retention schedule and breach response playbook
DPDP Act 2023 — frequently asked questions
Yes, if you process digital personal data in connection with offering goods or services to Data Principals within India. Location of servers is irrelevant; the trigger is who you serve. Foreign companies typically need an India-based grievance contact and, if notified as an SDF, an India-based DPO.
DPDP is consent-centric with a narrow set of legitimate uses, has no separate "sensitive data" category, no statutory DPIA for every fiduciary, and no right to data portability or objection. GDPR is broader. Practically, a mature GDPR programme covers perhaps 70% of DPDP — the remaining work is consent granularity, multilingual notices, children’s data and Board notification.
A DPO is mandatory only for Significant Data Fiduciaries, and must be based in India and answerable to the board. Every other Data Fiduciary must still publish the contact details of a person who can answer questions about processing. We provide DPO-as-a-service for organisations that need the role without a full-time hire.
Free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data necessary for the stated purpose. Pre-ticked boxes, bundled consent across unrelated purposes and consent as a condition for unrelated service are all invalid. Withdrawal must be as easy as giving it.
Anyone under 18 is a child under the Act. You need verifiable parental consent, and you may not undertake tracking, behavioural monitoring or targeted advertising directed at children. Age-gating and verification design is one of the harder parts of DPDP, and we build it against your actual user journey.
Notify the Data Protection Board and every affected Data Principal, without the materiality threshold GDPR allows. That makes detection and classification speed critical, so our programme always includes a tested breach runbook with pre-approved notification templates.
Still not sure what applies to you?
Ask an assessor directly — we answer scoping questions before anyone talks about a fee.
Get a realistic timeline and a fixed fee
A 30-minute call is usually enough to scope DPDP Act 2023 accurately. You will leave with a timeline, an evidence checklist and a number — whether or not you engage us.