DPDP Act (Digital Personal Data Protection Act, 2023)
The Digital Personal Data Protection Act, 2023, or DPDP Act, is India's law on handling the personal data of individuals. It expects businesses to collect data with clear consent, use it only for the stated purpose and keep it safe.
What it means
The DPDP Act is India's law on digital personal data. It reaches any business that collects and uses personal data about individuals, such as names, phone numbers, email addresses, photographs and purchase history. The Act calls the business that decides why and how data is used a data fiduciary, and the person the data belongs to a data principal. A school collecting parent details or an online store saving delivery addresses is a data fiduciary in this sense.
The ideas at its core
- Consent: ask clearly, in plain language, before collecting, and let people withdraw consent as easily as they gave it.
- Purpose limitation: use data only for the purpose you stated. A number collected for fee reminders is not a marketing list.
- Collect only what you need: every extra field is extra risk.
- Safety and deletion: protect data with reasonable safeguards and remove it when the purpose ends.
- People's rights: individuals can ask what you hold, ask for corrections and ask for erasure.
Why it matters for your business
Most Indian small businesses hold personal data without a policy: customer lists in Excel, student details in WhatsApp groups, CCTV footage and biometric attendance. The law turns sloppy handling into a business risk. The practical response is knowing what data you hold, why you hold it, who can see it and when it will be deleted. That sits close to role-based access control and data encryption.
An example
A coaching centre in Madurai collects student and parent phone numbers at enrolment. Using them for fee reminders and exam alerts fits the purpose. Sharing the same numbers with a shop for a commission would break the purpose parents agreed to. The Act also expects extra care with children's data, so the centre should limit which staff can open student records and delete the records of students who have left.
How we approach it
VS Tech Builders is a software studio, not a law firm, so take legal advice on your obligations; detailed rules and timelines are set by the government and can change. What we can do is build software that makes good practice easy: consent captured at sign-up, only the data fields you need, access limited by role, and export and deletion tools in the admin panel. If you are planning a CRM, a school management system or a web application, raise this at the start.
Common questions
Does the DPDP Act apply to a small business?
It applies to businesses of any size that handle digital personal data of individuals, whether customers, students, patients or staff. Detailed duties can differ by category of business, so ask a legal adviser how the current rules apply to you. A sensible first step, whatever the answer, is to list what personal data you collect, why you collect it and who can see it.
What should my website or app do to respect consent?
Tell people in plain language what you collect and why, before you collect it, and give them a clear way to agree. Do not pre-tick boxes or bundle unrelated uses together. Record when and what each person agreed to, and offer an easy way to withdraw consent or request deletion. Collect only the fields you genuinely need.
Read more
Tell us what you need. Get a fixed quote.
Describe your business and the problem in a few lines. We reply within one business day with an honest recommendation, a scope and a fixed price.