The Digital Personal Data Protection Act, 2023 and its Rules mark a significant shift in how Indian companies must think about personal data. For large enterprises with dedicated legal and compliance teams, the adjustment is significant but manageable. For mid-market companies, the challenge is different: the law applies equally, but the internal resources are not the same.
This post is a practical starting point for finance and compliance teams at mid-size Indian companies. It is not legal advice. It is a map of what the Act requires and where most companies currently have gaps.
What the DPDP Act covers
The Act applies to the processing of digital personal data of individuals in India. Personal data includes names, contact details, financial information, employee records, customer data, and anything else that identifies a person.
If your company collects customer data for sales, processes employee records for payroll, or handles any personal data of Indian residents in digital form, the Act applies to you.
The core obligations for data fiduciaries (companies that determine the purpose and means of processing) include:
- Consent management. Personal data must be processed only for a specified purpose, with valid consent or under a legitimate lawful basis. Consent must be free, specific, informed and unambiguous.
- Data principal rights. Individuals have the right to access their data, correct it, erase it, and in some cases, withdraw consent. Companies need a mechanism to handle these requests.
- Data retention limits. Personal data should not be retained beyond the period necessary for the specified purpose.
- Security obligations. Reasonable security safeguards must be implemented. The standard of “reasonable” will be developed through Rules and guidance.
- Grievance redressal. A Data Protection Officer or grievance mechanism must be in place for individuals to raise concerns.
- Breach notification. In the event of a data breach, the Data Protection Board must be notified along with affected data principals.
Where most mid-market companies currently are
Most mid-market companies we have spoken with are in one of three states:
Aware but not started. Leadership knows the DPDP Act exists and understands it has compliance implications. No formal project has started. The gap between awareness and action is usually a resource question: who owns this, and what does “done” look like?
Partially mapped. The company has identified the most obvious data touchpoints: customer CRM, HR system, finance records. But the full data map, covering every workflow that touches personal data, has not been completed. Shadow processes like WhatsApp customer communications and manual Excel trackers are typically invisible.
Checklisting without depth. Some companies have produced a checklist from an online template. The checklist is not wrong, but it is not connected to actual workflows. When the Data Protection Board begins enforcement, checklist compliance without operational evidence will not be sufficient.
The compliance calendar problem
One of the clearest operational gaps is calendar management. Statutory compliance in India already carries a dense filing calendar: GST returns, TDS, PF, ESI, ROC filings, and more. DPDP adds a new layer of obligations with their own timelines.
Most mid-size companies track compliance deadlines on personal calendars, shared Excel files, or in email threads. Near-misses are common. Escalations happen only when someone remembers.
A compliance calendar agent addresses this directly. It tracks every deadline, alerts the responsible person at 7 days, 3 days, and 24 hours, logs near-misses, and reconciles filed-versus-due after each deadline. The log becomes an audit trail.
This is exactly the kind of operational problem that a one-time build can fix permanently.
A starting point for your team
If you are beginning your DPDP compliance process, the most useful first step is a data audit: map every workflow in your business that touches personal data of customers, employees, or vendors. For each workflow, identify what data is collected, why, how it is stored, who has access, and how long it is retained.
The audit will surface gaps quickly. Most companies find that a significant portion of their personal data processing happens in workflows that are not visible to the compliance team: WhatsApp threads, local Excel files, paper forms that get scanned and forgotten.
From the audit, the compliance roadmap becomes clear. The highest-priority items are usually consent management for customer data and a process for handling data principal requests.
Verum’s Compliance Flow track covers DPDP compliance alongside the broader statutory compliance calendar. The MSME Suite Pro tool on this site provides a free starting point for understanding statutory obligations under other Indian law. The compliance calendar agent built in Verum engagements is a permanent operational system, not a one-time report.
If you want to understand what DPDP compliance looks like as an operational workflow rather than a legal exercise, that is where the work starts.