How should a software company implement India's DPDP Act, step by step?

A software company implementing India's Digital Personal Data Protection Act should first decide whether it acts as a Data Fiduciary or a Data Processor, map the digital personal data it handles, then build notice and consent, security safeguards, breach intimation, erasure and grievance handling. Most substantive duties start 18 months after 13 November 2025.

When does the Act apply to you?

The Act (Act No. 22 of 2023) applies to processing of digital personal data within India where the data is collected digitally, or collected in non digital form and digitised later. Commencement is staged. The Gazette notification G.S.R. 843(E) of 13 November 2025 brought some provisions into force on publication, including the sections on the Data Protection Board (sections 18 to 26), and set later dates: one year after publication for section 6(9) and section 27(1)(d), and eighteen months for sections 3 to 5, most of section 6, sections 7 to 17, most of section 27, and sections 28 to 34 among others. Eighteen months from 13 November 2025 falls in May 2027. Confirm exact dates with counsel.

The substantive Data Fiduciary duties therefore are not yet enforceable at the time of writing, which makes this the build window, not the wait window.

Step one: are you a fiduciary or a processor?

A Data Fiduciary decides the purpose and means of processing. A Data Processor processes on its behalf. Section 8(1) says the Data Fiduciary stays responsible for compliance for processing done on its behalf by a Processor, regardless of any contract. A SaaS vendor handling customer data under instruction is usually a Processor for that data, and a Fiduciary for its own users, staff and prospects. Write down both roles.

Step two: map the data

List every system holding digital personal data: product databases, logs, analytics, support tools, backups, HR systems. For each, record what data, why, who can access it, where it goes, and how long it stays. This map drives everything else, and it is the first thing a regulator or a customer asks for.

Step three: notice and consent

Section 5 requires that each consent request be accompanied or preceded by a notice describing the personal data and purpose, how the person can exercise their rights, and how to complain to the Board. Audit sign up forms, mobile permission prompts and marketing opt ins against that list. Children need extra care: section 9(1) requires verifiable consent of a parent or lawful guardian before processing a child's data, in the manner the rules prescribe, and section 9(2) bars processing likely to harm a child's wellbeing.

Step four: security and breach duties

Section 8(5) requires reasonable security safeguards to prevent personal data breach, including for processing by your Processors. Section 8(6) requires intimation of a breach to the Board and each affected person, in the form and manner prescribed. The Schedule sets maximum penalties: up to 250 crore rupees for failing the safeguards duty, and up to 200 crore rupees for failing breach intimation. Practical work: access control, encryption, logging, vulnerability management, an incident response runbook with a named decision maker, and a template for notification. The rules prescribe timelines and content, so read them and fill your template accordingly.

Step five: retention, erasure and processor contracts

Section 8(7) requires erasing personal data when consent is withdrawn, or when it is reasonable to assume the purpose is no longer served, unless law requires retention, and making your Processors erase it too. Section 8(2) permits engaging a Processor only under a valid contract. Build deletion into your systems, including backups and logs, and put processing terms in every vendor contract.

Step six: rights, grievance and contact

Section 8(9) requires publishing business contact information of a Data Protection Officer, if applicable, or another person who can answer questions. Section 8(10) requires an effective grievance mechanism. Stand up an intake channel and a tracked workflow.

What about Significant Data Fiduciaries?

Section 10 lets the government notify some fiduciaries as Significant, which then must appoint a Data Protection Officer in India, an independent data auditor, and run periodic impact assessments. Watch for notifications that might cover you.

What to do

1. Decide your role per dataset: Fiduciary, Processor or both.
2. Build the data map and keep it versioned.
3. Rewrite notices and consent flows to the section 5 list.
4. Add verifiable parental consent if you serve children.
5. Document security safeguards, and test the breach runbook.
6. Implement erasure across production, backups and processors.
7. Publish a contact point and open a grievance channel.
8. Read the DPDP Rules for timelines and forms, then update the runbooks.

Safeguard's compliance automation can organise evidence for controls such as access, vulnerability management and incident handling; the Act itself is not a certification, and no tool makes you compliant.

Quick check

Sources

• Digital Personal Data Protection Act, 2023 (official text), MeitY, fetched 18 October 2026
• G.S.R. 843(E) commencement notification, 13 November 2025, Gazette of India, fetched 18 October 2026

Last reviewed: 18 October 2026.