Audit. Fix. Document. Defend.

The Digital Personal Data Protection Act, 2023 is India's federal personal-data law. If your business collects any personal data from individuals in India, names, emails, phone numbers, addresses, photos, KYC documents, it applies to you. There is no minimum size threshold for compliance. Even a single-doctor clinic, a small e-commerce store, or a B2B services business with a contact form is a Data Fiduciary under the Act.

Yes. The Digital Personal Data Protection Rules, 2025 were published on 13 November 2025. They operationalise the Act with detailed procedural requirements: notice formats, security safeguards (encryption, access controls, 72-hour breach notification), data retention timelines, and rights of Data Principals. The bulk of obligations under the Rules apply on a phased basis from 18 months of publication, meaning most businesses need to be compliant by mid-2027, but preparation should begin now.

RoseLeap's fixed-fee DPDP compliance package starts at ₹40,000 for a small marketing site (audit + privacy policy + basic consent flows + documentation). Mid-sized businesses with multiple data-collecting systems (CRM, email tools, analytics, payment processors) typically range from ₹1.2 lakh to ₹3 lakh. A full DPO-as-a-Service retainer runs ₹15,000 to ₹40,000 per month depending on data volume and complexity.

Penalties under the DPDP Act can reach ₹250 crore per breach for the most serious violations, with significant penalties for failure to give notice of a breach, failure to maintain reasonable security safeguards, and failure to fulfil data principal requests. Smaller violations attract proportionate penalties, but even at the lower end, fines are an order of magnitude larger than the cost of compliance. Most Indian SMBs underestimate this risk because the Data Protection Board is still ramping up enforcement; that will change.

Only Significant Data Fiduciaries (designated by the central government based on factors like data volume, sensitivity, risk of harm, and impact on national security) are formally required to appoint a DPO. Most Indian SMBs are not SDFs. However, having a designated person (in-house or outsourced) responsible for data protection is a strong defensive posture and clients increasingly expect it, especially in healthcare, financial services, defence, and any export-oriented vertical where overseas clients ask the question.

Yes, and this is increasingly being scrutinised. Government tenders (including state-level rate contracts for DPDP compliance services) now expect vendors to demonstrate their own data protection posture. If you handle citizen data, employee records, or any personal data as part of a government contract, you are a Data Processor under the Act and subject to all security safeguard and breach notification obligations. Non-compliance can cost you empanelment.

No. A boilerplate privacy policy you grabbed off the internet does not satisfy the DPDP Act's notice requirements, it almost certainly does not match your actual data flows, name your real sub-processors, or specify your actual retention periods. The Data Protection Board can require you to produce evidence that your policy matches reality. A real policy is drafted after auditing your real data, and is updated when your data flows change.

For a typical Indian SMB (a website, a CRM, a couple of email tools, an analytics setup, payment processing), the full audit and gap report takes about two weeks. Remediation, implementing changes on the website and documenting operational ones, usually adds another two to four weeks depending on the complexity of what needs fixing.

Yes. The DPDP Act applies extraterritorially to any organisation processing personal data of Data Principals located in India, including foreign businesses selling into the Indian market. We work with international clients to make their websites and consent flows compliant for Indian users.