DPDP Act compliance for startups, run for you

India’s Digital Personal Data Protection Act is now on a fixed timetable. If your product has Indian users or customers, May 2027 is the date that matters. This page explains who the law applies to, what it requires, what software can automate, and what stays with your team and your lawyers. It is not legal advice.

What is the DPDP Act?

The DPDP Act sets out how organizations may collect and use personal data, what rights individuals have, and what happens when data is breached. The DPDP Rules, 2025 fill in the operational detail. A few terms come up constantly:

• Data Fiduciary: the organization that decides why and how personal data is processed.

• Data Processor: an organization that processes data on a Data Fiduciary’s behalf, such as a SaaS vendor.

• Data Principal: the individual the data is about.

• Significant Data Fiduciary: a Data Fiduciary the government designates, which carries additional obligations.

• Data Protection Board of India: the body that handles breach reports, complaints and penalties.

When do DPDP obligations apply?

Who needs to comply with DPDP?

• Indian startups that collect personal data from customers, users or employees.

• Companies outside India that offer goods or services to people in India.

• B2B SaaS companies acting as Data Processors, whose customers will push security and contract requirements down to them.

• Fintech, health tech, edtech and consumer apps that handle large volumes of personal data or data about children.

• Any company that may be designated a Significant Data Fiduciary.

What does DPDP compliance take?

• Notice and consent: clear, itemized notices, and consent that people can withdraw at any time, after which processing on that consent must stop.

• Reasonable security safeguards: Rule 6 lists measures such as encryption, masking or tokenization, access control, logging and monitoring, backups, and security obligations in contracts with Data Processors.

• Log retention: logs and related personal data kept for one year for detecting and investigating unauthorized access, unless another law requires otherwise.

• Breach intimation: notice to the Board and affected individuals without delay, and a detailed report to the Board within 72 hours.

• Retention and erasure: deleting data once the purpose is served.

• Rights and grievances: handling access, correction, erasure and grievance requests from Data Principals.

• Children’s data: verifiable consent from a parent or lawful guardian before processing data of anyone under 18.

What are the DPDP penalties?

The highest penalty, up to 250 crore rupees, applies to failing to take reasonable security safeguards to prevent a breach. Failing to notify a breach can attract up to 200 crore rupees. Security is the part of DPDP where the stakes are highest, and it is also the part software can help with most.

What NexusVoid automates vs what you still do

How NexusVoid gets you ready and keeps you ready

NexusVoid runs your security program like an autonomous CISO, and DPDP readiness is the by-product. If you have no CISO, it acts as one. If you have a CISO or vCISO, it automates most of their work. The loop is Detect, Prove, Resolve, Test, Verify.

• Argus finds and fixes: outside-in like an attacker with no credentials or installs to begin, then inward through code, dependencies, cloud and secrets, including exposed personal data paths. Fixes arrive as pull requests, each finding has an owner, and merged fixes are retested and filed as evidence.

• Aegis proves: tailored policies, automatic evidence, risk register, vendor management, employee security training, a device agent, questionnaires answered from evidence, and auditor-ready exports.

• Striker tests: vulnerability assessment and pentest across web, API, cloud and mobile, pay per scan, with a report in under 60 minutes.

Because DPDP shares controls with ISO 27001, SOC 2 and GDPR in Aegis, work you have already done for other frameworks counts here too.

Common DPDP mistakes

• Assuming DPDP only applies to Indian companies.

• Waiting until 2027 to start, when security safeguards and breach processes take months to build and prove.

• Treating GDPR work as automatically covering DPDP.

• Keeping logs for too short a period to meet the one-year retention rule.

• Having no rehearsed breach process, which makes a 72-hour report to the Board very hard.

• Using vendors that process personal data without security terms in the contract.

Frequently asked questions

When does the DPDP Act come into force?

In phases. The DPDP Rules, 2025 were notified on 13 November 2025, and the Data Protection Board provisions applied immediately. Consent manager registration applies one year after publication. The substantive duties for Data Fiduciaries, including notice, security safeguards, breach intimation, retention and data principal rights, apply 18 months after publication, on 13 May 2027.

Does the DPDP Act apply to companies outside India?

Yes, in some cases. The Act covers processing of digital personal data within India, and processing outside India when it is connected with offering goods or services to people in India. A foreign SaaS company with Indian customers or users should assume it is in scope and confirm the details with counsel.

What is the DPDP breach notification timeline?

Under Rule 7, a Data Fiduciary that becomes aware of a personal data breach must inform the Data Protection Board and each affected Data Principal without delay. It must then send the Board a detailed report within 72 hours of becoming aware of the breach. That means detection, triage and decision-making all need to be fast and documented.

What are the penalties under the DPDP Act?

The Act sets penalties by type of failure. The highest, up to 250 crore rupees, applies to failing to take reasonable security safeguards to prevent a personal data breach. Failing to notify the Board or affected individuals of a breach can attract up to 200 crore rupees. The Board considers factors such as the gravity of the breach and the steps taken to mitigate it.

Is GDPR compliance enough for DPDP?

It helps, but it is not enough on its own. Both laws need security safeguards, breach response and processor contracts, so much of your security work carries over. DPDP has its own rules for notice and consent, children’s data, retention, log keeping and breach reporting to the Board, so map it as a separate framework with shared controls.

If you handle Indian users’ data and want a clear view of what May 2027 means for you, book a call at /contact and we will walk through your setup.