Navigating India's DPDP Act: A Global Perspective

For multinational corporations (MNCs) already compliant with GDPR or CCPA, India's new Digital Personal Data Protection (DPDP) Act brings both familiarity and unique challenges. Here is your roadmap to compliance.

1. The Privacy Triad: DPDP vs. GDPR vs. CCPA

If you are operating in India, simply "porting" your GDPR policy won't work. The DPDP Act is unique in its reliance on "Consent Managers" and its strict penalties without a turnover cap.

Feature	India (DPDP Act 2023)	EU (GDPR)	USA (CCPA/CPRA)
Core Philosophy	Notice & Consent (Opt-in)	Rights & Principles (Opt-in)	Notice & Choice (Opt-out)
Data Scope	Digital Personal Data only	Any Personal Data (Manual & Digital)	Personal Information of Consumers
Consent Standard	Strict. Needs to be Free, Specific, Informed, Unconditional.	Specific, Informed, Unambiguous.	Required mainly for "Sale" of data.
Minors' Data	Strict verifiable parental consent (Under 18). No tracking/ads.	Parental consent needed (Age varies 13-16).	Opt-in for sale required (Under 16).
Penalties	Up to ₹250 Cr per instance. No criminal jail term.	Up to €20M or 4% of global turnover.	$2,500 - $7,500 per violation.

2. Operational Playbook: Dos and Don'ts

For foreign entities with offices or customers in India, here is the immediate operational checklist.

✅ What You MUST Do

Map your Data: Identify all personal data collected from Indian residents.
Update Notices: Privacy policies must be available in English + 22 scheduled Indian languages.
Implement "SARAL": Ensure consent forms are Simple, Accessible, Rational, and Actionable.
Consent Manager Integration: Prepare APIs to integrate with government-registered Consent Managers.
Delete Legacy Data: Remove data for which the "purpose" has been satisfied or consent withdrawn.

❌ What You MUST Avoid

Do Not Track Children: Absolutely no behavioral monitoring or targeted advertising for users under 18.
No "Deemed Consent": Do not assume consent from silence or pre-ticked boxes.
No Mixed Processing: Do not mix personal data processing with other activities without clear separation.
Don't Ignore Breaches: Failure to report a breach to the Data Protection Board is a punishable offense.

3. Are you a "Significant" Data Fiduciary?

The Act categorizes organizations based on the volume and sensitivity of data they handle. This classification dictates your compliance burden.

Standard Data Fiduciary

Most B2B companies, small businesses, or entities with low data volume.

Must implement security safeguards.
Must handle grievances.
Must report breaches.

Significant Data Fiduciary (SDF)

High data volume, sensitive data (Health, Biometrics), or impact on democracy/sovereignty.

Mandatory: Appoint a Data Protection Officer (DPO).
Mandatory: Appoint an Independent Data Auditor.
Mandatory: Conduct periodic Data Protection Impact Assessments (DPIA).

4. The Role of the DPO

If you are classified as a Significant Data Fiduciary (SDF), appointing a DPO is not optional. Unlike GDPR, where a DPO can sometimes be external, the Indian context implies a key role accountable to the Board.

Who can be a DPO?

The DPO must be an individual based in India (for SDFs) who represents the Data Fiduciary. They are the primary point of contact for the Data Protection Board and for citizens (Data Principals) raising grievances.

5. Compliance Timeline: The Countdown

Based on the notification of rules (Nov 2025), here is the deployment schedule organizations should follow.

Timeline	Compulsory (Must Have)	Strategic (Good to Have)
Immediate (Month 0-3)	• Register on DPB Portal • Appoint DPO (if SDF) • Establish Breach Response Team	• Internal Data Audit • Vendor Contract Review
Short Term (Month 3-6)	• Deploy Multilingual Privacy Notices • Set up Grievance Redressal Mechanism	• Training Staff on "SARAL" Principles • Mock Breach Drills
Medium Term (Month 6-12)	• Consent Manager API Integration • Age-gating mechanisms for Minors	• ISO 27001 / 27701 Certification update
Long Term (Month 12-18)	• Complete removal of legacy non-consented data • First Independent Data Audit (for SDFs)	• Advanced Privacy-Enhancing Technologies (PETs)

Disclaimer: This guide is for informational purposes and does not constitute legal advice. Please consult with legal counsel for specific compliance requirements.

For a deeper dive into the foundational principles of this Act before these new rules were notified, check out our previous analysis:

Understanding the DPDP Act Framework (Previous Blog)