The DPDP Act, Decoded: What Every Indian Business Must Know in 2026

For founders, legal, security & IT leaders  ·  ~6 min read  ·  Suggested publish: 5 Aug 2026

India now has a comprehensive data-protection law with real teeth. The Digital Personal Data Protection (DPDP) Act, 2023 — and the DPDP Rules notified on 13 November 2025 — set out how every business that handles the personal data of Indians must collect, use, protect and account for it. With the average cost of a data breach in India hitting a record ₹22 crore in 2025, this is boardroom risk, not an IT footnote. Here is the plain-English version.

The vocabulary you need

Four terms unlock the entire law:

• Data Principal — the individual whose personal data is being processed (your customer, employee or user).
• Data Fiduciary — you, if you decide how and why that data is processed. The buck stops here.
• Data Processor — a vendor that processes data on your behalf; their compliance becomes your concern.
• Consent — permission that must be free, specific, informed and revocable, backed by a clear notice.

Your core obligations

The duties are principled and practical. Collect personal data only with lawful consent and a clear, plain-language notice. Use it only for the purpose you stated. Protect it with reasonable security safeguards. Honour data-principal rights — access, correction, erasure and grievance redressal. And when something goes wrong, report the breach to the Board and to affected individuals.

The teeth: penalties and the Board

The Data Protection Board of India is operational, complaints can already be filed, and early enforcement has begun. Penalties run up to ₹250 crore per instance — with the largest reserved for failing to prevent a personal-data breach. Combined with the ₹22 crore average breach cost, the message is clear: data protection is now a direct financial risk to the business, not just a policy document.

The clock is phased

The Rules were notified on 13 November 2025, and enforcement follows three phases. The Board and core definitions are already in force. Enforcement powers, the penalty framework and Consent Manager registration begin on 13 November 2026. And full compliance is due by 13 May 2027 — with no grace period expected. In practice, since typical enterprise DPDP programmes take 9–12 months, the time to start is now.