India's DPDP Rules: What Growing Businesses Should Start Doing Now

India's Digital Personal Data Protection (DPDP) Act was passed in 2023, and the rules that put it into practice were notified on 14 November 2025. Some parts applied straight away; most of the obligations on businesses are being phased in over the following 12 to 18 months. If your website, app or internal system collects personal data — customer names, phone numbers, emails, addresses — this affects you.

This isn't legal advice, and for your specific situation you should speak to a legal professional. But there are sensible steps every business can start on now, and most of them are good practice anyway.

1. Know what personal data you hold

Make a simple list: what personal data you collect, where it comes from (website forms, billing, WhatsApp, spreadsheets), where it's stored, and who can see it. Many businesses are surprised by how many copies of customer data are scattered across tools and devices.

2. Ask clearly, and keep a record

People should know what you're collecting and why, in plain language, before they share it. Your forms and apps should ask for consent clearly, and your systems should record when and how it was given — and make it just as easy to withdraw.

3. Collect less, keep it for less time

Only collect what you actually need for the purpose you've stated, and decide how long you'll keep it. Data you don't hold can't be leaked, and it's one less thing to manage.

4. Protect it, and plan for when things go wrong

• Limit access so staff only see the data they need for their role.
• Use secure logins, encrypted connections and regular backups.
• Decide in advance who does what if there's a data breach, including how affected people and the authorities will be informed.
• Check that the vendors and tools you use handle your customers' data responsibly too.

5. Be ready to respond to requests

People have rights over their data, including asking to see it, correct it or have it erased. If your data is spread across spreadsheets and chat apps, responding properly is painful. A well-built system lets you find, update or delete a person's data in minutes.

How software helps

Much of DPDP readiness comes down to how your systems are built: proper consent capture, role-based access, audit logs, retention rules and clean deletion. If you're building or upgrading a website, app or ERP in the next year, it's the right moment to build these in — far cheaper than bolting them on later.