A message to every organisation that collects, uses or processes personal data
“It is our personal data. If you protect it properly under the DPDP Act, 2023, you will earn our confidence. Responsible data protection can also help your organisation avoid penalties of up to ₹200 crore for certain contraventions.”
Every time we open a bank account, purchase an insurance policy, visit a hospital, use a mobile application, shop online or share our information with a company, we place a degree of trust in that organisation.
We share our names, addresses, telephone numbers, email addresses, financial details, identification documents, health information and other personal details because we expect these organisations to use our information responsibly.
But an important question remains:
Are organisations protecting our personal data with the same care with which we entrust it to them?
- Personal Data Belongs to People, Not Just Databases
For a company, personal data may be a record in a database, a customer profile, an application form or a digital file.
For an individual, that same data represents their identity, privacy, financial security and personal life.
A data breach or misuse of personal information can expose individuals to fraud, identity theft, financial loss, unwanted communications and a loss of privacy. The consequences can extend far beyond the organisation’s IT systems.
Data protection, therefore, is not merely a technical exercise. It is a responsibility towards every individual whose information an organisation handles.
- The DPDP Act, 2023: A Step Towards Responsible Data Governance
India’s Digital Personal Data Protection Act, 2023 establishes a legal framework governing the processing of digital personal data, subject to the Act’s scope, provisions and applicable exemptions.
The law places important responsibilities on organisations that determine the purposes and means of processing personal data, referred to as Data Fiduciaries under the Act.
Depending on the applicable provisions, organisations must address matters such as:
- Providing appropriate notices and obtaining valid consent where required.
- Processing personal data for lawful purposes and in accordance with applicable legal requirements.
- Implementing reasonable security safeguards to prevent personal data breaches.
- Establishing procedures for handling personal data breaches and fulfilling applicable notification obligations.
- Providing mechanisms for individuals to exercise their rights under the Act.
- Addressing grievances and complying with applicable data-retention, erasure and other obligations.
Compliance should not be treated as a document prepared merely to satisfy an audit. It should be reflected in the organisation’s everyday decisions, technology, contracts, employee practices and customer interactions.
- ₹200 Crore: A Financial Risk That Organisations Must Take Seriously
The DPDP Act, 2023 provides for substantial monetary penalties for specified contraventions.
Under the Act’s Schedule, failure by a Data Fiduciary to take reasonable security safeguards to prevent a personal data breach may attract a penalty of up to ₹250 crore. Failure to notify the Board or affected individuals of a personal data breach, where required, may attract a penalty of up to ₹200 crore.
These are maximum statutory penalties for specified contraventions, not automatic fines imposed on every organisation that experiences a data breach. The applicable legal provisions, facts and adjudication determine the consequences.
For corporate leadership, the message is clear: inadequate data protection can expose an organisation to serious regulatory and financial risks, apart from reputational damage, customer dissatisfaction and loss of business confidence.
Investing in compliance before a problem arises is a more responsible approach than trying to repair the damage afterwards.
- Compliance Is More Than Avoiding a Penalty
A responsible organisation should ask itself:
- Do we know what personal data we collect and why we collect it?
- Do we inform individuals how their data will be used?
- Do we collect only the information that is necessary for our purposes?
- Do we have appropriate technical and organisational security safeguards?
- Do our employees understand their responsibilities concerning personal data?
- Do we have a documented procedure to identify, respond to and report data breaches as required?
- Do we have a process for handling requests, grievances, retention and erasure of personal data in accordance with applicable law?
- Have we assessed the responsibilities of our vendors, service providers and technology partners?
If these questions cannot be answered confidently, the organisation should consider undertaking a structured DPDP readiness assessment and developing an appropriate compliance programme.
The DPDP Act and Rules provide for phased implementation. The principal provisions governing data-fiduciary obligations are scheduled to commence 18 months after the commencement notification published on 13 November 2025, which works out to 13 May 2027. Organisations should use this transition period to prepare rather than wait until the deadline approaches. <Cite refs={[“turn939042search1″,”turn939042search9”]}/>
- Data Protection Builds Customer Confidence
Imagine a customer choosing between two organisations offering similar products or services.
One organisation is transparent about its data practices, takes security seriously, explains its policies clearly and provides accessible channels for addressing privacy concerns.
The other collects information without adequate transparency and leaves customers uncertain about how their personal data is being used.
Which organisation is more likely to earn lasting trust?
Data protection can become an important part of an organisation’s reputation. It can strengthen customer relationships, support responsible digital innovation and demonstrate that the organisation values the people behind the data.
Trust is not earned merely by collecting customers’ information. Trust is earned by protecting it.
- A Call to Corporate India
We urge companies, banks, hospitals, insurance providers, educational institutions, e-commerce platforms, startups and other organisations handling digital personal data to make data protection a priority at the highest level of management.
Corporate leaders should consider taking the following steps:
- Assess: Identify the personal data collected, the purposes for which it is processed and the applicable legal obligations.
- Prepare: Develop a practical, organisation-specific DPDP compliance roadmap.
- Protect: Review access controls, security measures, vendor arrangements and incident-response procedures.
- Train: Educate employees and management about responsible data handling.
- Implement: Establish appropriate policies, notices, procedures and accountability mechanisms.
- Review: Periodically assess compliance and improve safeguards as business operations and legal requirements evolve.
Compliance should be proportionate to the organisation’s activities, size, risks and legal obligations. A well-designed programme should be practical, sustainable and capable of implementation in day-to-day operations.
- Our Message to Every Organisation
We, the people, entrust you with our personal data because we need your products and services.
We expect you to respect our privacy, use our information responsibly and protect it against unauthorised access, misuse and disclosure.
When you do so, you earn something more valuable than a database of customers: you earn our confidence.
When you take data protection seriously, you also reduce the risk of regulatory action, financial penalties, reputational damage and the loss of customer trust.
The potential penalties under the DPDP Act make the financial consequences clear. But the larger responsibility is to the individuals whose information you hold.
Our personal data is our trust in you. Protect it. Respect it. Comply with the law. Earn our confidence.
The time to prepare is now.
A final message for corporate decision-makers
Do not wait for a data breach, a customer complaint or a regulatory notice to begin your DPDP compliance journey. Start by understanding your obligations, identifying the gaps and implementing the safeguards your organisation needs.
Because ultimately, data protection is not only about avoiding penalties. It is about building a business that people can trust.
