DPDP Act Compliance for Indian Businesses: A Practical Guide
What India's Data Protection Law Means for Your Business
For most of the last decade, Indian businesses collected personal data with very little constraint. A phone number captured for a delivery got used for marketing three months later. Customer databases were exported to spreadsheets and shared over WhatsApp. Nobody deleted anything, ever.
The Digital Personal Data Protection Act changes the baseline expectation. It is not the European GDPR, and it is less onerous in several respects, but it establishes real obligations around consent, purpose, security and deletion.
I'm Ashish Sharma, founder of Codingclave. We build the systems that hold this data — CRMs, hospital software, e-commerce platforms, WhatsApp integrations — so this guide is written from an implementation standpoint. It is not legal advice. The Act's operational rules and enforcement timelines have been rolling out in stages, so confirm current requirements and deadlines with a qualified data protection lawyer before making decisions. What I can tell you reliably is what has to change in your software.
The Vocabulary You Actually Need
Four terms carry most of the weight.
Data Principal — the individual whose data it is. Your customer.
Data Fiduciary — you, if you decide why and how personal data is processed. Note the word: fiduciary, not merely controller. The framing implies a duty of care.
Data Processor — a vendor processing data on your behalf. Your cloud host, your CRM vendor, your WhatsApp provider.
Significant Data Fiduciary — a higher-obligation category for organisations processing large volumes or sensitive categories of data, attracting extra duties such as appointing a Data Protection Officer and conducting audits.
The critical point for most readers: you remain accountable for what your processors do. Choosing a vendor with poor security does not transfer the risk away from you.
The Obligations That Change How You Build
1. Consent has to be real
The standard is consent that is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action.
Translated into interface terms:
- Unticked checkboxes. A pre-ticked box is not an affirmative action.
- Separate purposes, separate consent. Order updates and promotional marketing are different purposes. One checkbox for both is a bundle, and bundling is precisely what the standard is designed to prevent.
- A plain-language notice at the point of collection. What you collect, why, and how to withdraw.
- No conditioning service on unnecessary consent. You may require a delivery address to deliver. You may not require marketing consent as the price of buying.
Withdrawal must be as easy as giving. If consent takes one tap, withdrawal cannot require an email to a support address that nobody reads.
2. Purpose limitation is a real constraint
You may use data for the purpose you stated. Reusing a number collected for appointment reminders to run a promotional campaign is a new purpose, and it needs its own consent.
This is the obligation that Indian businesses breach most casually, usually without any intent to do harm — the marketing team simply exports "all customers" and broadcasts. Building purpose tags into your CRM at the field level is the durable fix.
3. You must be able to delete
When consent is withdrawn or the purpose is complete, you are expected to erase the data, and to ensure your processors do too.
This is a software problem more than a policy problem. Most systems we audit cannot execute a genuine deletion because the same phone number lives in the CRM, the email tool, the WhatsApp platform, two exported spreadsheets and a nightly backup. Deletion has to be designed in. Retrofitting it is the single most expensive compliance task we see.
4. Security safeguards are mandatory
"Reasonable security safeguards" is the phrase, and failure here carries the heaviest penalty tier. In practice, the expected baseline includes encryption in transit and at rest, access control so staff see only what their role requires, audit logging, and prompt patching.
5. Breach notification
Personal data breaches must be reported to the Data Protection Board and to affected individuals. Practically, this means you need detection and an incident runbook before an incident. A business that discovers a breach three months later through a customer complaint has already failed.
6. Children's data is treated strictly
Processing data of anyone under 18 requires verifiable parental consent, and behavioural advertising directed at children is prohibited. This matters enormously for EdTech and coaching institutes, where the user is frequently a minor and the payer is a parent. If you run a school or coaching platform, this is your highest-risk area — see our work on school management software and LMS platforms, where parent-linked accounts are the standard design answer.
7. Grievance redressal
You must give individuals a way to complain and respond within a reasonable period. A published contact point and a tracked queue, not an unmonitored inbox.
What This Means for WhatsApp and SMS Marketing
This is where most Indian businesses have the largest gap, because the old habits were so ingrained.
Purchased contact lists are finished. There is no lawful basis for messaging people who never gave you consent. This was already against Meta's platform policy; it is now a legal exposure as well.
Consent must be specific to marketing. A number captured at checkout to send delivery updates does not authorise a weekend offer broadcast. Capture marketing consent separately, with its own checkbox and its own wording.
Keep the evidence. For each contact, store the timestamp, the exact notice text displayed, the channel, and the IP or device context where available. If a complaint arrives, "we think they agreed" is not a defence. A record is.
Honour opt-outs immediately and permanently. Suppression must be global across every tool you use, not per-campaign. This is a systems requirement: if your WhatsApp platform and your SMS tool have separate suppression lists, you will eventually message someone who opted out.
We built consent logging and global suppression into PayPerWA for exactly this reason, and it is the first thing I check when auditing an existing setup. Our guides to WhatsApp Business API pricing and choosing a provider cover what to ask vendors about consent records and data export.
Sector Notes
Healthcare. Health data is sensitive by nature, and hospital systems frequently hold decades of records. Access control by role is the priority — a receptionist should not be able to browse clinical notes. Where you also handle ABDM and ABHA flows, consent artefacts have their own requirements; see our ABDM compliance work and hospital management software.
Education. Minors, parental consent, and long retention periods. The compliant pattern is parent-owned accounts with student profiles beneath them.
E-commerce. High volume, many processors — payment gateway, logistics, marketing tools, analytics. Your processor inventory is the work here. Every vendor touching customer data needs a contract covering their obligations.
Real estate and financial services. Long sales cycles mean leads sit in a CRM for years. Retention policy matters: a lead from four years ago who never converted has no lawful basis to remain in your marketing list.
SaaS products. If you serve business customers, you are a processor for their data and a fiduciary for your own users. Both hats, both sets of obligations. Expect enterprise customers to start sending you data protection questionnaires, and expect to lose deals if you cannot answer them.
A Practical Implementation Sequence
Ordered by dependency, not by how impressive it looks in a board deck.
Step 1 — Map your data
A simple table: what personal data you collect, where it is stored, why you have it, who can access it, how long you keep it, and which vendors touch it.
Every business we audit is surprised at this stage. There is always a spreadsheet on someone's laptop, an old tool nobody cancelled, or a WhatsApp group where customer details get pasted.
Step 2 — Fix consent capture
Rework every collection point: website forms, app signup, checkout, in-store, phone. Unticked boxes, separate purposes, plain-language notices, and consent records stored with a timestamp.
Step 3 — Write a privacy notice people can read
Purposes, data categories, retention, rights, and how to contact you. Plain language beats legal boilerplate — the standard is informed consent, and nobody is informed by four thousand words of clauses. Our own privacy policy is a reasonable structural reference.
Step 4 — Build the rights workflows
Access, correction, erasure and grievance requests all need a route in and an owner. Automate the lookup even if a human approves the action — this is also how you avoid deletion requests turning into a two-day manual hunt. Many sites now publish a dedicated route for this, as we do at data deletion.
Step 5 — Set retention periods and enforce them
Decide how long each data category lives, then implement automatic deletion. A policy document nobody enforces is worse than none, because it evidences that you knew.
Step 6 — Review your processors
List every vendor touching personal data. Check where they store it, what their security posture is, and whether your contract covers their obligations. Replace the ones that cannot answer.
Step 7 — Prepare for incidents
A short runbook: who is called, how you assess scope, who notifies the Board and affected individuals, how you record it. Rehearse it once.
The Honest Cost
For a typical Indian SMB with a website, a CRM and marketing tools, the technical work is usually a few weeks: rebuilding consent capture, adding consent logging, building deletion workflows, tightening access control, and cleaning up data sprawl.
The expensive scenario is a business with years of accumulated systems, no data map, and customer records scattered across tools nobody owns. That is a project, not a task.
The cheapest possible moment to handle this is while you are already rebuilding something. If a CRM replacement or website rebuild is on your roadmap, fold compliance into that scope rather than running it as a separate initiative later. We handle it that way in custom software projects because retrofitting consent and deletion into a finished system costs several times more than designing it in.
Related Reading
- Custom software vs SaaS in 2026 — where your data actually lives
- WhatsApp Business API pricing in India
- Healthcare software development in India
- GST-compliant software guide
- Build vs buy: CRM decisions in India
Founder note: nearly every business I audit fails the same test — I ask them to delete one specific customer completely, and nobody can confirm it is done everywhere. Try it on your own systems this week. Whatever you find is your real starting point. Questions on the technical side: +91 92771 84741. For the legal side, please talk to a lawyer.