India DPDP Act 2023

The Digital Personal Data Protection Act 2023 (DPDP Act) is India's first comprehensive privacy law, modelled loosely on GDPR but with important differences. Penalties go up to ₹250 crore (~$30M USD) per violation. This skill is the engineering checklist.

When to use

• Building a product that processes data of users in India (regardless of where the company is based).
• Pre-launch privacy review for an Indian-facing app.
• Audit of an existing product against DPDP requirements.
• Setting up consent flows, data principal request handling, breach response.

When NOT to use

• Pure B2B with no consumer PII (less stringent — but business contact data is still PII).
• No Indian users and no plans to expand — defer.
• Looking for legal advice — this is engineering scope; lawyer-review is mandatory before launch.

The actors and definitions