What is the DPDP Act?  

The Digital Personal Data Protection (DPDP) Act, 2023 is India’s central law for protecting people’s personal data. It defines how businesses should collect, store, use, and delete personal information.

Who must comply with the DPDP Act?  

The DPDP Act applies to:

• All businesses operating in India

• Any company collecting personal data (name, phone, Aadhaar, email, IP address)

• Indian startups, SMEs, online stores, private limited companies, and professional service firms

• Foreign companies offering services to Indian users

Key Terms to Know  

DPDP Compliance Checklist for Small Businesses  

1. Provide a Privacy Notice  

• Clearly tell users:

• • What data are you collecting?

  • Why you are collecting it

  • How long you will keep it

  • Who they can contact for concerns

Add this to your website footer or app settings.

2. Collect Valid Consent  

• Ask for clear, affirmative consent

• Allow users to withdraw consent anytime

• Use consent checkboxes or pop-ups

Avoid auto-opt-ins or unclear language.

3. Keep Data Safe and Minimal  

• Don’t collect more data than needed

• Limit who can access it

• Use secure cloud or server platforms

• Delete old or unused data regularly

Review email, CRM, and file storage for cleanup.

4. Add a Grievance Contact  

• Users should be able to ask:

• • What data do you store

  • To correct or delete it

  • How to file a complaint

Example: Add privacy@yourcompany.in or info@yourcompany.com as the grievance email.

5. Prepare for Data Breaches  

If you leak or lose data:

• Inform the Data Protection Board of India

• Inform the affected users promptly

Keep a basic internal plan for data breach handling.

What are Significant Data Fiduciaries?  

These are larger organizations that:

• Handle data of children or vulnerable persons

• Use AI to make decisions (like loan approval, job shortlisting)

• Process large amounts of sensitive personal data

If your company is notified as a Significant Data Fiduciary, you will also need:

• A Data Protection Officer (DPO)

• Impact assessments for risky data processing

• More transparency in automated decisions

Most SMEs will not fall into this category.

Penalties Under DPDP Act  

FAQs

Ebizfiling’s DPDP Compliance Support  

We assist businesses with:

• Privacy policy drafting

• Consent form setup

• Grievance redressal system

• Compliance training for your team

• Record-keeping templates

Book a free consultation at www.ebizfiling.com or write to info@ebizfiling.com