India’s Digital Personal Data Protection (DPDP) Act, 2023 became operational with the notification of the DPDP Rules in November 2025, with most obligations phased in over roughly 18 months. For businesses that collect customer data through websites, apps, CRMs or ERPs, DPDP compliance is now a software problem as much as a legal one.
Note: This article is a practical technology checklist, not legal advice. Confirm your specific obligations with a qualified legal professional.
Who does the DPDP Act apply to?
It applies to processing of digital personal data in India, and to processing outside India when it relates to offering goods or services to people in India. If your business collects names, phone numbers, emails, addresses, IDs or behaviour data of individuals, you are a Data Fiduciary with obligations.
The software compliance checklist
1. Clear notice and consent
- Show a plain-language notice explaining what data you collect, why, and how users can withdraw consent.
- Make consent specific and unbundled — no pre-ticked boxes, no “agree to everything”.
- Store a consent record (who, when, what version of the notice) in your database.
2. Collect only what you need
Audit every form and database table. If a field is not needed for the stated purpose, stop collecting it. Less data means less risk.
3. Make withdrawal and rights requests easy
Users must be able to withdraw consent as easily as they gave it, and request access, correction or erasure. Build a simple self-service page or a tracked request workflow, and publish grievance contact details.
4. Define retention and deletion
Set retention periods per data type and automate deletion or anonymisation when the purpose is fulfilled. Scheduled clean-up jobs are far more reliable than manual processes.
5. Secure the data
- Encrypt data in transit (HTTPS everywhere) and at rest for sensitive fields.
- Use role-based access control and multi-factor authentication for admin panels.
- Keep access logs so you can investigate incidents.
6. Prepare for breaches
The Rules require timely intimation of personal data breaches to the Data Protection Board and affected individuals. Have monitoring, an incident runbook and contact templates ready before you need them.
7. Review your vendors
Hosting providers, email tools, analytics, payment gateways and AI services are your Data Processors. Make sure contracts cover security and data-handling obligations.
Quick self-assessment
| Question | If “no”… |
|---|---|
| Do all forms show a privacy notice and capture explicit consent? | Update forms and store consent logs |
| Can a user withdraw consent online? | Add a preference or request page |
| Do you know where every copy of customer data lives? | Create a data inventory |
| Is old data deleted automatically? | Implement retention jobs |
| Would you detect a breach within hours? | Add monitoring and alerting |
How Webarc can help
Our data management and custom software teams help businesses build consent management, audit logging, retention automation and secure admin panels into existing applications — so compliance becomes part of the system, not a spreadsheet.
Frequently Asked Questions
When do DPDP obligations take full effect?
The DPDP Rules were notified in November 2025 with a phased roll-out; most Data Fiduciary obligations apply after an 18-month transition, i.e. around mid-2027.
Does DPDP apply to small businesses?
Yes. The Act applies to any entity processing digital personal data, although certain exemptions may be notified for specific classes such as startups.
What are the penalties for non-compliance?
The Act provides for significant financial penalties, up to ₹250 crore for failure to take reasonable security safeguards to prevent a breach.
Insights from the engineers, designers and marketers at Webarc Software & IT Solutions — helping businesses in Kerala, across India and worldwide build smarter software for more than a decade.
Need help putting this into practice?
Talk to our team for a free consultation on software, AI automation or SEO for your business.
