The legal issues in jargon-free English for DPDP Act

If you handle digital data of Indians, this applies.

It doesn’t matter if you are based in Mumbai, London, or New York. If you are selling to or servicing people in India, or processing their digital data (even paper forms that you later scan/digitize), you must follow this law.

Any data that points to a person.

Unlike the old rules, there is no complex list of “Sensitive” vs “Non-Sensitive” data for general processing. Whether it’s a name, email, or biometric ID—it’s all “Personal Data” and needs protection.

Show your work.

You can’t just say you are compliant; you need evidence. This means keeping digital logs of who accessed data, proof that users actually clicked “I Agree” (Consent Artifacts), and documented security policies. If you can’t produce these logs during an audit, you have failed.

No more hidden clauses.

You cannot bury privacy terms in a 50-page “Terms & Conditions” document. You must show a separate, simple screen (the Notice) that lists exactly: “We collect [X] for [Y] purpose.” It must be as easy to read as a restaurant menu.

Tell the truth, fast.

If you lose data (hack, leak, or accidental email), you cannot hide it. You must tell the Government (DPB) immediately and submit a full report within 72 hours. Crucially, you must also tell the people affected (users/employees) so they can protect themselves.

You need a “Go-To” person.

Every company needs a designated person (Grievance Officer) whose contact details are public, so people can complain. If you are a huge company (SDF), you need a senior “Data Protection Officer” based in India who reports to your Board.

The Client is the boss, but the Vendor is on the hook.

If you are a vendor (e.g., a Payroll provider), you must only do what the client tells you. However, you must implement the same strict security (encryption/logs) as the client. If you leak data, the Client gets fined, but they will sue you for damages.

Users are in control.

People can ask you: “What data do you have on me?” and “Delete my data.” You must respond (usually within a prescribed time). They can also nominate someone to handle their data after their death (a digital heir).

Leave the kids alone.

You cannot track children online or show them targeted ads. To process their data, you must prove you got permission from their actual parent (using ID proof or digital tokens).

It will cost you money, not jail time.

Unlike the old IT Act, executives won’t go to prison. But the fines are massive—up to ₹250 Crore ($30 Million) for failing to secure data. The focus is on financial accountability.

Global flow is okay (mostly).

You can send data to the US, Europe, or Singapore freely, unlessthe Government puts a specific country on a “Negative List.” This is much simpler than the GDPR’s complex “Adequacy” requirements.