Article · 15 min read

Compliance under the DPDP Act for startups collecting customer data

Corrida Legal Free Beginner India

This is the founder-facing counterpart to the DSCI summary: instead of restating the law, it turns it into an 8-step implementation roadmap for a small team, from writing a real notice to enabling deletion to logging breaches. It is honest that founders can be personally liable and that penalties run into hundreds of crores, but it also says the security safeguards need not be expensive for a small team, which is the practical read you want before you over-engineer.

  • Non-compliance is not just a fine: in some cases founders carry personal liability, so this is not a task you can indefinitely defer
  • Users need genuine, user-friendly ways to exercise access, correction, erasure, and consent withdrawal, which is a product requirement, not a legal footnote
  • A Data Protection Officer in India is only mandatory once you are classed a Significant Data Fiduciary (by data volume and sensitivity), so most early startups do not need one yet
Open on corridalegal.com ↗

The question it answers

  1. I'm building an app that collects user data. What does the DPDP Act actually require me to do?

Read with it

  1. DSCI is India's industry body on data security (a NASSCOM initiative), so this is about as close to a canonical plain-language... Data Security Council of India Article · 10 min read The Digital Personal Data Protection Act, 2023: DSCI Summary Data Security Council of India (DSCI)
  2. Most privacy policy generators are US-shaped (GDPR or CCPA) and bolt India on as an afterthought. PriView is built India-first... IDfy Tool · 15 min to generate PriView: Free Privacy Notice Generator (by DSCI and Privy/IDfy) DSCI and Privy by IDfy
eChai Partner Brands The partnership →