DPDP Act 2023 Compliance: Penalties for Businesses

What Is the DPDP Act 2023?

The Digital Personal Data Protection Act, 2023 (Act 22 of 2023) was enacted on 11 August 2023. It is India's first comprehensive legislation for the protection of digital personal data. It creates a framework for the processing of personal data that recognises both the right of individuals to protect their personal data and the need to process personal data for lawful purposes.

The Act applies to the processing of digital personal data within the territory of India, where the data is collected in digital form or in non-digital form and digitised subsequently. It also applies to the processing of digital personal data outside India if the processing is in connection with any activity related to offering goods or services to data principals within India.

The Act does not apply to personal data processed by an individual for personal or domestic purposes, or to personal data that is made publicly available by the data principal or by any person under a legal obligation to make it public. The Act establishes the Data Protection Board of India as the regulator.

The DPDP Rules, 2025 were notified in November 2025. The Rules set out the procedural and operational details that businesses need to follow, including consent management, notice requirements, breach reporting, and the obligations of significant data fiduciaries.

Who Does the DPDP Act Apply To?

The Act uses three key concepts.

Data Principal: The individual to whom the personal data relates. This includes customers, employees, patients, students and website visitors.

Data Fiduciary: The person or entity that alone or jointly with others determines the purpose and means of processing personal data. This includes companies, law firms, hospitals, educational institutions, e-commerce businesses and service providers in Kolkata.

Data Processor: The person or entity that processes personal data on behalf of a data fiduciary. This includes IT service providers, cloud hosting companies and outsourced call centres.

If your business collects names, phone numbers, email addresses, Aadhaar numbers, financial information, health records or any other personal data in digital form, the DPDP Act applies to you. The Act does not exempt small businesses. The obligations scale with the nature of the data and the activities of the data fiduciary.

Key Obligations for Data Fiduciaries

Section 8 of the DPDP Act sets out the general obligations of a data fiduciary. These are the core compliance duties.

• Lawful processing: Process personal data only for a lawful purpose for which the data principal has given consent, or for certain legitimate uses specified in the Act.
• Valid consent: Consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action. It must be limited to the purpose for which it is given.
• Clear notice: Give the data principal a notice in clear and plain language describing the personal data collected, the purpose of processing, the manner of exercise of rights, and the procedure to complain to the Board.
• Reasonable security safeguards: Implement appropriate technical and organisational measures to protect personal data in your possession or control, including data processed on your behalf by a data processor. Section 8(5) makes this a statutory duty.
• Breach notification: In the event of a personal data breach, intimate the Board and each affected data principal in the prescribed form and manner. Section 8(6) makes this mandatory.
• Data accuracy: Ensure the completeness, accuracy and consistency of personal data where it is used to make a decision affecting the data principal or disclosed to another data fiduciary.
• Erasure on withdrawal: Erase personal data upon withdrawal of consent or when the specified purpose is no longer being served, unless retention is required by law. Also cause the data processor to erase the data.
• Grievance redressal: Provide a mechanism for data principals to exercise their rights and to complain.

Rights of Data Principals

The Act gives individuals several enforceable rights. Businesses must be able to respond to these requests.

• Right to access information: A summary of the personal data processed, the identities of the data fiduciaries with whom it has been shared, and the descriptions of the data.
• Right to correction and erasure: Request correction of inaccurate or misleading data, completion of incomplete data, and erasure of data that is no longer necessary.
• Right to grievance redressal: Complain to the data fiduciary, and if unsatisfied, to the Data Protection Board.
• Right to nominate: Nominate another individual to exercise rights in the event of death or incapacity.
• Right to withdraw consent: Withdraw consent at any time. Withdrawal must be as easy as giving consent.

Data principals also have duties under Section 15 — for example, not to impersonate another person, not to suppress material information, and not to file false or frivolous complaints.

Penalties Under the DPDP Act

The Act's penalty schedule is one of the strongest in Indian regulatory law. The maximum penalty is Rs 250 crore for a single category of breach.

The Board determines the penalty after an inquiry, considering the nature, gravity and duration of the breach, the type of data affected, whether the breach was repetitive, whether the entity gained or avoided loss, whether it took mitigating action, and the proportionality of the penalty. Penalties are credited to the Consolidated Fund of India.

DPDP Rules 2025: What Changed

The DPDP Rules, 2025 were notified in November 2025. The Rules operationalise the Act. Key features include:

• Consent managers: Registered consent managers will allow individuals to give, manage, review and withdraw consent through a single interface.
• Notice format: The Rules prescribe the form and content of the privacy notice that data fiduciaries must give.
• Breach reporting: The Rules set out the timelines and format for reporting personal data breaches to the Board and affected individuals.
• Significant Data Fiduciaries: The Rules provide the criteria and additional obligations for entities designated as significant data fiduciaries, including data protection impact assessments and audits.
• Children's data: The Rules specify how verifiable parental consent is to be obtained and how data of children is to be handled.
• Implementation timeline: The Rules provide a phased implementation schedule so that businesses can build compliance systems.

Compliance Checklist for Kolkata Businesses

If your business processes digital personal data, use this checklist to assess your readiness.

1. Map your data: Identify what personal data you collect, where it is stored, who has access, and with whom it is shared. Include data held by vendors and cloud providers.
2. Review your consent: Ensure consent is free, specific, informed and unambiguous. Replace bundled or implied consent with clear affirmative action. Make withdrawal as easy as giving consent.
3. Draft a privacy notice: Publish a clear notice describing the data collected, the purpose, the rights of data principals and the grievance redressal mechanism. Comply with the DPDP Rules 2025 format.
4. Appoint a grievance officer: Designate a person to handle data principal requests and complaints. Publish the contact details.
5. Implement security safeguards: Adopt technical and organisational measures — access controls, encryption, logging, vendor contracts, employee training and incident response plans.
6. Prepare a breach response plan: Know who will notify the Board, how affected individuals will be informed, and what evidence will be preserved. Test the plan.
7. Review vendor contracts: Data processor contracts must require the processor to protect data, erase it on instruction, and assist with breach notification.
8. Handle children's data carefully: Obtain verifiable parental consent and avoid behavioural tracking or targeted advertising directed at children.
9. Conduct a data protection impact assessment if you are likely to be designated a significant data fiduciary, or if you process sensitive data at scale.
10. Document everything: Keep records of processing, consent, breach reports and audits. Documentation is your defence in an inquiry.

Conclusion

The DPDP Act 2023 changes the compliance landscape for every business in Kolkata that handles digital personal data. The Act is not merely a privacy statement requirement. It creates enforceable duties around consent, notice, security, breach reporting and erasure, backed by penalties that can reach Rs 250 crore. The DPDP Rules 2025 add the operational detail that businesses must implement. The prudent approach is to map data, fix consent and notice, appoint a grievance officer, strengthen security and prepare a breach response plan before an incident occurs. Compliance is also a commercial advantage — customers and vendors increasingly ask for data protection assurances before they sign contracts.

Disclaimer: This article provides general legal information and does not constitute legal advice. For advice on your specific business, consult a qualified advocate.