DPDP Act (Digital Personal Data Protection Act, India)

Why it matters

Any business holding customer phone numbers, addresses, or payment references is processing personal data. The DPDP Act matters because it converts good data hygiene from courtesy into legal obligation, with real penalties, and because customers increasingly choose vendors who can answer 'how do you protect my data' convincingly.

How it works

The Act centres on consent-based processing for defined purposes, obligations on 'data fiduciaries' (the entities deciding why and how data is processed) to secure data and honor rights such as correction and erasure, breach notification duties, and restrictions on retaining data beyond its purpose. Compliance in practice means knowing what personal data you hold, why, where, who can touch it, and being able to delete it on request.

A real-world example

A retail software vendor stores customer names and phone numbers for billing on behalf of shops. Under the DPDP lens, the vendor maps this data, restricts staff access by role, logs every access, keeps it hosted appropriately, and builds deletion workflows, so when a shop's customer invokes rights, the chain can actually comply.

Common mistakes

• ✗ Collecting data 'because it might be useful', purpose limitation forbids exactly this
• ✗ Keeping personal data in exports, chats, and spreadsheets outside governed systems
• ✗ Having no deletion path, rights you cannot execute are violations waiting
• ✗ Treating compliance as a legal document instead of an engineering property

Best practices

• ✓ Inventory personal data: what, where, why, who accesses it
• ✓ Minimize collection and retention to the stated purpose
• ✓ Enforce access by role, log access, and secure data in transit and at rest
• ✓ Design erasure and correction as product features, not manual heroics

Frequently asked questions