For many businesses, data protection compliance still feels like a deadline that belongs somewhere in the future.
India’s data protection framework has moved significantly closer to becoming an operational reality. The Digital Personal Data Protection Act, 2023 (“DPDP Act”) was enacted in August 2023, and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) were notified in November 2025. The Government has adopted a phased approach for bringing the framework into force, giving businesses time to prepare. That transition period should not, however, be mistaken for a period of inaction. The real question is therefore not whether a company will need to comply. It is whether it will be ready when compliance becomes enforceable.
The Law Has Moved Beyond the Privacy-Policy Stage
Data protection discussions in India have often centered around one familiar document: the privacy policy. A business may have a perfectly worded privacy policy and still have questions that remain unanswered:
- What personal data is the business actually collecting?
- Why is each category of data being collected?
- Where is that data stored?
- Who within the organization can access it?
- Which third-party vendors receive it?
- How long is it retained?
And that is where many businesses may find the real compliance challenge.
The 18-Month Window Should be Used as Preparation Time
The Government has adopted a similar phased approach for the DPDP Act itself. Several substantive provisions, including provisions dealing with obligations of Data Fiduciaries and rights of Data Principals, are scheduled to take effect eighteen months from the notification date. For businesses, this is valuable breathing space. But it is also a fairly short period if an organization has never mapped its data practices before. Consider a mid-sized company with thousands of customers, hundreds of employees, multiple SAAS platforms, marketing agencies, payment partners and cloud service providers. Identifying the data is one exercise. Understanding what happens to that data at every stage of its lifecycle is another.
Changing contracts, internal processes, technology systems and employee practices takes even longer.
This is why businesses that wait for the final compliance date may find themselves trying to solve a legal, contractual and technology problem simultaneously.
Start With the Data, not the Paperwork
A Sensible Starting Point for Businesses is a Data-Mapping Exercise.
Customer information: name, mobile number, emails address, delivery address and transaction details.
Marketing information: preferences, campaign responses and purchase history.
Employee information: identification details, salary information, attendance records and performance-related information.
Website information: information generated through forms, accounts, cookies and other technologies.
Vendor information: contact details and information relating to representatives of suppliers and service providers.
Once the Organization has Mapped this Information, Another Important Question Follows:
Does the business really need all of it?
Modern businesses rarely operate their entire technology stack internally. They use payroll providers, CRM platforms, cloud storage services, email marketing tools, HR software, payment gateways, analytics tools, customer support platforms and a range of other technology providers. This creates another layer of risk. A company may have strong internal controls, but its data may simultaneously be moving through several external systems. The DPDP framework therefore requires businesses to look closely at their contractual arrangements with third parties. Existing agreements may need to be reviewed from a data-protection perspective, including provisions relating to:
- permitted processing of personal data;
- confidentiality;
- security safeguards;
- data breaches;
- assistance with data-principal requests;
- retention and deletion;
- subcontracting;
- audit and cooperation requirements; and
- allocation of liability.
This is particularly relevant for businesses that have grown quickly. Contracts that were adequate when a company had 500 customers may not necessarily be adequate when it has five million.
Data breaches are no longer just an IT problem
Another significant shift is the need to treat personal data breaches as a broader organizational issue. When a breach occurs, the immediate reaction is often technological: contain the breach, identify the vulnerability and restore the system. Those steps remain important. But a data breach can also trigger legal, contractual, regulatory and reputational consequences. The question is therefore not only: “How did the breach happen?” It is also: “What was the organization’s response once it happened?” Businesses should have an incident-response framework that clearly identifies who needs to be informed, what needs to be documented, what contractual obligations may arise and how regulatory and individual communications will be handled.
Startups and D2C businesses should pay particular attention
The compliance conversation is sometimes assumed to be relevant only to large technology companies. That is unlikely to be the practical reality. A startup may have a relatively small team but collect significant quantities of personal data. Consider a D2C company. A customer may provide a name, phone number, email address, delivery address, payment-related information, purchase history and marketing preferences — sometimes without thinking twice about it. The company may then use several external platforms to process orders, communicate with customers, manage returns, conduct marketing campaigns and analyze consumer behavior. The volume of data may therefore grow much faster than the company’s internal compliance systems. Investors and acquirers are increasingly interested not only in a company’s revenue and intellectual property, but also in whether its data practices create potential regulatory exposure.
Compliance can become a transaction issue
There is another aspect of data protection that businesses should not overlook. Data compliance can increasingly become part of corporate transactions. During a due diligence exercise, questions may arise regarding:
- the categories of personal data held by the target;
- consent and other legal grounds for processing;
- customer and employee data practices;
- privacy notices;
- vendor arrangements;
- cross-border data flows;
- historical data breaches;
- complaints or regulatory correspondence; and
- Internal data governance policies.
A business that has treated data protection as an afterthought may therefore discover that the issue becomes important at exactly the point when it is trying to attract an investor or sell the business. Good compliance, on the other hand, can become part of transaction readiness.
What Should Businesses do Now?
- Map your personal data
- Review your privacy notices
- Review retention practices
- Build a breach-response mechanism
- Train employees
Data protection cannot be implemented only through contracts and technology. The DPDP framework gives businesses time. The question for businesses should therefore not be: “When does the DPDP Act become applicable to us?” It should be: “If someone asked us tomorrow to demonstrate how we collect, use, store and protect personal data, could we explain the entire journey?” If the answer is no, that is probably where the compliance exercise should begin.
Looking Ahead
India’s data protection regime is moving from legislation on paper towards an operational compliance framework. The Government has also established the Data Protection Board of India as the adjudicatory body contemplated under the DPDP Act, with a mandate that includes dealing with personal data breaches and instances of non-compliance. For businesses, this makes the coming period particularly important. Data protection should not be treated as another document to be added to the compliance folder. It is better understood as a business process — one that touches technology, contracts, employment, marketing, customer relationships, corporate transactions and, ultimately, reputation. The organizations that start preparing now will have an advantage that goes beyond regulatory compliance. They will simply have a better understanding of one of their most important business assets: the data they hold and the trust attached to it. For businesses preparing for the implementation of India’s data protection framework, the objective should not merely be to “be compliant”. It should be to build a system that works in the real world.
Author: Sarika Aggarwal
