Explore / Company, law and compliance / Data protection

Data protection · checked 11 November 2026

Most DPDP Act duties bind from 13 May 2027: give a plain notice for each purpose, take real consent, and report a breach within 72 hours.

The Act has no small-business carve-out: collect a customer's name or phone number and you are a data fiduciary. Collect only what each purpose needs, erase it once the purpose is served, get verifiable parental consent for anyone under 18 and put security clauses in vendor contracts. The heaviest penalty, up to ₹250 crore, is for failing to keep data secure, and GDPR still applies separately if you have customers in the EU.

The steps 7 answers

  1. I'm building an app that collects user data. What does the DPDP Act actually require me to do? Starting Up
  2. Do I actually need to worry about DPDP as a small D2C brand, or is this a big-company problem? D2C
  3. What exactly counts as valid consent under DPDP for my checkout and signup forms? D2C
  4. What tools should I use to get DPDP-compliant without hiring a lawyer for every step? D2C
  5. What actually happens to my brand if I don't comply, what are the real penalties? D2C
  6. I sell internationally, do I also need to worry about GDPR on top of DPDP? D2C
  7. We buy contact lists and run outbound in India. What do the DPDP rules and TRAI's spam rules change for us? GTM

The readingMost used across these answers

The terms

DPDP ActData FiduciaryConsent ManagerData Privacy

eChai Partner Brands The partnership →