DPDP Act
Also called DPDP and Digital Personal Data Protection Act
India's Digital Personal Data Protection Act, 2023, the law on how businesses collect and use people's personal data, put into effect by the DPDP Rules notified in November 2025. Most of its duties bind from 13 May 2027.
Why it matters
Any startup that handles customer or employee data in India is covered. It requires clear notice and consent, reasonable security, reporting a breach to the people affected and to the Data Protection Board, verifiable parental consent for under-18s, and deleting data once its purpose is served, with penalties running to hundreds of crores. Until May 2027 the IT Act's existing data rules and CERT-In's six-hour incident reporting still apply.
For example
A health app rewrites its signup to explain what data it collects and why, adds a way to withdraw consent, and sets each record to be deleted once its purpose ends, ahead of May 2027.
Go deeper
Related terms
Also in Starting Up
See how founders actually handle this on Co-founders, team and legal, part of the Starting Up hub.
eChai Partner Brands
The partnership →
