Short answer: if you collect customers’ personal data (names, phone numbers, addresses), India’s data protection law applies to you. Tell people clearly why you collect it, get their consent, keep it safe, delete it when you no longer need it, and get a parent’s consent for children’s data. The main duties apply from around mid-May 2027.
This is general information, not legal advice. Check with a lawyer for your situation.
When does the DPDP law start applying?
The DPDP Rules were notified on 13 November 2025 with an 18-month phase-in, so most obligations bite from around mid-May 2027. That’s the time to get ready, not the time to start.
What do I have to do?
- Give a clear notice. Before collecting data, tell people in simple language what you collect and the specific purpose.
- Get consent where it’s needed, and let people withdraw it as easily as they gave it.
- Keep it secure. Reasonable security safeguards are required.
- Delete it when the purpose is over, unless another law says to keep it (for example tax records).
- Handle requests. People can ask to see, correct or delete their data, and to complain.
- Report breaches. If data leaks, the people affected and the Data Protection Board must be told.
What about children’s data?
For anyone under 18 you need verifiable consent from a parent or guardian, with some exceptions (such as certain healthcare, education and safety purposes). Schools, coaching centres and clinics should take this seriously: the penalties for children’s-data violations are among the highest.
What are the penalties?
According to the government explainer: up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore each for breach-notification failures and children’s-data violations, and up to ₹50 crore for other violations.
I use software to store customer data. Who is responsible?
You are the Data Fiduciary: you decide why the data is collected. Your software provider is usually a Data Processor, acting on your instructions under a written contract. Ask your providers for their data processing agreement.
Reveaxa’s parental consent tool helps schools and coaching centres record verifiable parent consent.
Reveaxa guide reference: RVX-B-dpdp-act-small-business-guide