DPDP Act Basics for US Startups with Users in India

Does India's data protection law apply to a US startup, and what does it ask for? It can. The Digital Personal Data Protection Act, 2023 (the DPDP Act) applies to processing of digital personal data outside India if the processing is connected with offering goods or services to people in India. This article explains in plain English who is covered, what the main duties are, and when they start. It is general information, not advice on any particular company's situation.

Does the Act reach a company outside India?

Section 3 of the DPDP Act applies to the processing of digital personal data within India. It also applies to processing outside India if that processing is connected with any activity of offering goods or services to individuals in India.

A US startup that offers an app, website or SaaS product to people in India may therefore be within the Act's reach. Whether a particular product is covered depends on the facts of how it is offered.

The Act uses a few terms throughout:

• Data Principal: the individual the personal data is about. For a child or a person with a disability, this includes the parent or lawful guardian.
• Data Fiduciary: the person who decides why and how personal data is processed. This is roughly what the GDPR calls a controller.
• Data Processor: a person who processes data on behalf of a Data Fiduciary, such as a hosting or analytics vendor.
• Significant Data Fiduciary: a Data Fiduciary that the Central Government notifies because of factors such as the volume and sensitivity of the data it handles. It carries extra duties.

(Source: DPDP Act 2023, Sections 2 and 3.)

When do the obligations start?

The Act is Act No. 22 of 2023. Under Section 1(2), its provisions come into force on dates the Central Government notifies, so the duties are being switched on in stages. The Digital Personal Data Protection Rules, 2025 (the Rules) were notified on 13 November 2025. Rule 1 sets out when each part of the Rules starts, counted from the date of publication:

• Rules 1, 2 and 17 to 21 (short title, definitions and the Data Protection Board) took effect on publication, 13 November 2025.
• Rule 4 (registration of Consent Managers) starts one year after publication, which is 13 November 2026.
• Rules 3, 5 to 16, 22 and 23 start eighteen months after publication, which is 13 May 2027. These cover most of the operational duties, including notice, security safeguards, breach reporting, children's data, the rights of Data Principals and transfers outside India.

A Consent Manager is an entity registered with the Board that lets individuals give, manage and withdraw consent through one platform. The dates above are calculated from the Rules as published. The official gazette text is the authority, and the Central Government can notify changes, so readers should check it directly.

What are the main duties of a Data Fiduciary?

These are the duties the Act and Rules describe. Most of the operational ones start on 13 May 2027, as set out above.

A lawful ground. The Act recognises two grounds for processing. One is the Data Principal's consent (Section 6). The other is a defined list of "certain legitimate uses" (Section 7). The Act does not use the GDPR's list of six lawful bases, and "legitimate interest" in the GDPR sense is not one of its grounds.

Notice and consent. A request for consent must come with a notice. The notice describes the personal data and the purpose, explains how the person can withdraw consent and exercise their rights, and says how to complain to the Board (Section 5; Rule 3). Consent must be free, specific, informed, unconditional and unambiguous, and given by a clear affirmative action (Section 6). The request must be available in English or any language listed in the Eighth Schedule to the Constitution of India.

Reasonable security safeguards. A Data Fiduciary must protect the personal data in its control, including data processed by a Data Processor on its behalf (Section 8). Rule 6 sets out the minimum the safeguards should cover, such as encryption or similar measures, access control, and logging and monitoring.

Breach reporting. After a personal data breach, the Data Fiduciary must inform the Board and each affected Data Principal (Section 8(6)). Rule 7 sets out what the notice to individuals should contain. It also requires a more detailed report to the Board within 72 hours, or a longer period if the Board allows.

Erasure and grievance handling. Personal data must be erased when the purpose is served or consent is withdrawn, unless the law requires it to be kept. The Data Fiduciary must publish business contact details for a person who can answer questions, and must have a grievance redressal process (Section 8).

Children's data. For anyone under 18, a Data Fiduciary must obtain verifiable consent from a parent or lawful guardian (Section 9; Rule 10). It must not carry out tracking, behavioural monitoring or targeted advertising directed at children. Rule 12 and the schedule it refers to provide exemptions from some of these requirements for specified classes of Data Fiduciary and specified purposes.

(Sources: DPDP Act 2023, Sections 5 to 9; DPDP Rules 2025, Rules 3, 6, 7, 10 and 12.)

What rights do individuals have, and what extra duties apply to Significant Data Fiduciaries?

Data Principals can ask for a summary of the personal data processed and the identities of those it has been shared with. They can ask for correction, completion, updating and erasure. They can use the Data Fiduciary's grievance process, and they can nominate another person to exercise their rights if they die or become incapacitated (Sections 11 to 14).

A Significant Data Fiduciary must also appoint a Data Protection Officer based in India. It must appoint an independent data auditor and carry out periodic Data Protection Impact Assessments (Section 10). These are not general requirements. They apply only if the Central Government notifies a company as a Significant Data Fiduciary.

What about sending data from India to the US?

The Act takes a different approach from the GDPR's adequacy model. Under Section 16, a Data Fiduciary may transfer personal data outside India except to countries or territories that the Central Government restricts by notification. The Act also says that any existing Indian law giving a higher degree of protection or restriction on transfers continues to apply.

Rule 15 adds that transfers are subject to requirements the Central Government may specify. Notifications can change, so the current ones are worth checking before any transfer arrangement is settled.

(Sources: DPDP Act 2023, Section 16; DPDP Rules 2025, Rule 15.)

What are the penalties?

Under Section 33(1), if the Data Protection Board finds after an inquiry that a breach of the Act or Rules is significant, it may impose a monetary penalty. The maximum amounts are set out in the Schedule to the Act:

• up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach;
• up to ₹200 crore for failing to notify the Board and affected Data Principals of a breach;
• up to ₹200 crore for breaching the obligations on children's data;
• up to ₹150 crore for breaching the additional obligations of a Significant Data Fiduciary;
• up to ₹10,000 for breaching a Data Principal's duties under the Act;
• up to ₹50 crore for breaching any other provision of the Act or Rules.

These are upper limits. Under Section 33(2), the Board must consider factors such as the nature, gravity and duration of the breach, the type of personal data affected, and the mitigating steps taken, when deciding an amount.

(Source: DPDP Act 2023, Section 33 and the Schedule.)

What practical preparation could a startup consider?

The Act does not prescribe a preparation process, so the checklist below is good practice, not a legal requirement. It reflects the duties described above.

The order matters. A record of what Indian users' data the company holds, and where it goes, is the natural starting point. Notices, consent screens, vendor contracts and breach plans all depend on it.

General information, not legal advice. Prepared with AI assistance and checked against the official sources cited. Laws change; check the date above.