Unified Startup Enablement & Growth Platform

DPDPA Compliance — India's Digital Personal Data Protection Act

The Digital Personal Data Protection Act, 2023 (DPDPA) is India's landmark data privacy law, modelled on GDPR principles and tailored for the Indian digital economy. Every startup collecting, processing, or transferring personal data of Indian residents must comply — including D2C brands, SaaS companies, fintech, edtech, and healthtech ventures.

Corpfy guides startups from first reading the DPDPA to achieving full compliance: consent architecture, Data Principal rights, cross-border transfer safeguards, breach notification, and Significant Data Fiduciary obligations.

Scope: All entities processing digital personal data of Indian Data Principals
Regulator: Data Protection Board of India (DPBI)
Max penalty: ₹250 crore per violation; ₹200 crore for breach notification failures
DSR SLA: 72 hours to respond to Data Subject Requests

Who Needs to Comply

Data Fiduciary Categories

DPDPA creates two tiers of obligation based on scale, sensitivity, and national-security risk

Category	Who Qualifies	Additional Obligations	Penalty Exposure
Regular Data Fiduciary	Any startup processing personal data of Indian residents — virtually all B2C and B2B2C companies	Consent, DSR handling, breach notification, DPO appointment (internal)	Up to ₹250 Cr per violation
Significant Data Fiduciary (SDF)	Notified by MeitY — large platforms, national-security adjacent services, sensitive-data processors	DPIA, Consent Manager integration, Data Auditor, cross-border restriction, enhanced logging	Up to ₹250 Cr + enhanced scrutiny

Five Core Obligations Corpfy Implements

1. Lawful Consent

Granular, informed, specific, and revocable consent for each processing purpose. Corpfy builds consent banners, preference centres, and audit trails compliant with S6–S9 of the Act.

2. Data Subject Rights (DSR)

Right to access, correct, erase, nominate, and grievance redressal. Corpfy sets up DSR portals with automated 72-hour SLA routing, ticketing, and audit log.

3. Breach Notification

Personal data breaches must be reported to the DPBI and affected Data Principals without delay. Corpfy installs detection pipelines, IR playbooks, and DPBI notification templates.

4. Cross-Border Transfers

Transfers to countries notified by MeitY are permitted; all others require safeguards. Corpfy maps your data flows and implements SCCs and Data Processing Agreements.

5. Data Minimisation & Retention

Collect only what's necessary, retain only as long as needed. Corpfy audits data collection forms, database schemas, and configures retention policies with automated purging.

Compliance Roadmap

PHASE 1

Data Mapping

Inventory all personal data, purposes, and third-party processors. Produce Records of Processing Activity (RoPA).

PHASE 2

Consent & Notices

Redesign sign-up flows, privacy notices, cookie banners; implement consent ledger with timestamps.

PHASE 3

DSR Portal

Build or configure DSR request intake, automated routing, 72-hr SLA tracking, and response templates.

PHASE 4

Breach & IR

Detection alerts, DPBI-ready incident report templates, breach drill, and DPO escalation chain.

PHASE 5

SDF Readiness

DPIA framework, Consent Manager integration, Data Auditor liaison (for SDFs or pre-emptive readiness).

Key Act Sections Corpfy Addresses

Section-by-Section Coverage

Corpfy maps implementation work directly to DPDPA statutory obligations

Section	Obligation	What Corpfy Delivers	Status
S4	Grounds for processing personal data	Consent audit; legitimate-use mapping	Implemented
S5	Notice to Data Principals	Multi-language privacy notice generator	Implemented
S6	Consent — form & withdrawal	Consent management platform (CMP) integration	Implemented
S9	Processing children's data	Age-gate UX + parental-consent flow	Configurable
S11	Right of access	DSR portal — access request template + DSAR automation	Implemented
S12	Right to correction & erasure	DSR portal — correction & deletion workflows	Implemented
S13	Right to grievance redressal	Grievance Officer designation + 30-day SLA	Implemented
S17	Obligations of Significant Data Fiduciary	DPIA template, Consent Manager API integration, Data Auditor SoW	SDF Only
S19	Data breach notification	DPBI notification template + breach drill playbook	Implemented
S20	Retention limitation	Automated data purging + retention schedules	Implemented

⚠️ What Happens Without DPDPA Compliance

Fines up to ₹250 crore per violation — existential for early-stage startups
DPBI investigation can suspend data processing — killing your product overnight
Enterprise sales blocked — B2B customers demand DPDPA compliance as a vendor requirement
Breach liability — unnotified breaches attract ₹200 crore penalty on top of violation fines
VC due diligence red flag — investors now run privacy-law due diligence at Series A

What Corpfy Delivers

Deliverables & Artefacts

Everything required for a complete DPDPA compliance posture

Deliverable	Description	Format
Data Mapping Report (RoPA)	Complete inventory of personal data flows, purposes, and processors	PDF + Excel
Privacy Notice & Cookie Policy	Lawyer-reviewed, multi-language, linked from your product	HTML / PDF
Consent Management Implementation	CMP integration (or custom-built) with consent ledger and revocation	Code + Docs
DSR Portal	Self-service portal for access/correction/erasure/grievance with 72-hr SLA	Web Component
Breach Notification Playbook	Detection → triage → DPBI notification workflow with fill-in templates	PDF Playbook
Retention & Purge Schedules	Per-data-type retention periods + automated deletion scripts	Policy Doc + Script
DPO Charter	Job description and escalation matrix for your Data Protection Officer	PDF
DPDPA Compliance Certificate	Corpfy-signed attestation of implementation status for due diligence	PDF

Frequently Asked Questions

Does DPDPA apply to my startup even if I am small?+

Yes — there is no size or revenue threshold. If you collect, store, or process digital personal data of any Indian resident for any commercial purpose, DPDPA applies from day one. This includes apps with free users, B2B SaaS collecting employee data, and marketplaces handling buyer phone numbers.

The Act distinguishes between Regular Data Fiduciaries (all companies) and Significant Data Fiduciaries notified by MeitY, with the latter having additional obligations. But consent, DSR, and breach notification obligations apply to every entity processing Indian personal data.

What exactly counts as "personal data" under DPDPA?+

Any data that can identify an individual, directly or indirectly. This includes: name, phone number, email, Aadhaar number, PAN, IP address, device ID, location data, biometric data, and combinations of data that together identify a person.

Unlike GDPR, DPDPA does not create a separate "special categories" tier — but the Data Protection Board can notify categories requiring enhanced treatment. Children's data (under 18) requires verifiable parental consent and prohibits tracking or behavioural advertising.

What is the 72-hour DSR SLA and how do we meet it?+

Under Sections 11–13 of DPDPA, a Data Principal can submit a request to access, correct, or erase their personal data. You must respond within 72 hours.

Meeting this requires: a publicly visible DSR intake channel, automated routing to the right team, a tracking system with SLA alerts, and pre-built response templates. Corpfy's DSR portal handles all of this, including acknowledgement emails and audit logs for regulatory evidence.

How does breach notification work — who do we notify and when?+

Under Section 8(6), every personal data breach must be reported to the Data Protection Board of India (DPBI) and affected Data Principals without undue delay — generally interpreted as within 72 hours of detection.

You must notify: (1) the DPBI with incident details, scope, and remediation steps; (2) every affected Data Principal in plain language. Corpfy installs detection pipelines and pre-filled DPBI notification templates so your team can respond immediately.

What is a Consent Manager and do we need one?+

A Consent Manager is a registered intermediary through which Data Principals can give, manage, review, and withdraw consent across platforms. Consent Managers are mandated for Significant Data Fiduciaries notified by MeitY.

For regular startups it is not mandatory — but implementing one voluntarily simplifies consent audit trails and signals strong privacy maturity. Corpfy can implement the integration proactively so it does not become a blocker if you later become an SDF.

What are the penalties for non-compliance?+

DPDPA penalties are tiered by violation:

Failure to implement security safeguards: up to ₹250 crore per instance
Failure to notify breach to DPBI or Data Principals: up to ₹200 crore per instance
Non-compliance with children's data provisions: up to ₹200 crore
Violation of SDF obligations: up to ₹150 crore
Violation of Data Principal rights: up to ₹10,000 per instance

The Board can also direct suspension of data processing — which effectively shuts down a product.

Key Takeaways — DPDPA Compliance for Indian Startups

DPDPA applies from day one, regardless of company size:

Any startup collecting digital personal data of Indian residents — even free-tier users — is a Data Fiduciary under the Act. Waiting until Series A to start compliance is too late; the consent architecture must be designed into the product from launch.

Consent must be granular, purpose-specific, and revocable at any time:

A single checkbox at sign-up does not satisfy DPDPA. You need separate consent for each processing purpose — marketing emails, analytics, third-party sharing — with clear plain-language descriptions. Data Principals must be able to withdraw consent as easily as they gave it.

The 72-hour DSR SLA requires infrastructure, not just intent:

Responding to access, correction, and erasure requests within 72 hours is not achievable with a manual process at scale. You need an intake form, automated ticket creation, routing to the data owner, pre-built response templates, and an audit trail.

Breach notification is mandatory even for minor incidents:

DPDPA requires notification of every personal data breach to the DPBI and affected Data Principals without undue delay. Your detection infrastructure — SIEM rules, DLP alerts, Firestore audit logs — must be capable of identifying breaches in near-real-time, not through a quarterly security review.

DPDPA and ISO 27001 controls overlap significantly — implement both together:

Over 25 ISO 27001:2022 Annex A controls directly address DPDPA technical safeguard obligations. Implementing them together costs 35–40% less than sequentially. A joint DPDPA + ISO 27001 engagement with Corpfy is the most cost-efficient path for startups facing both enterprise security and regulatory requirements.

Inside Corpfy DPDPA Audit

Corpfy's DPDPA Audit dashboard maps every section of the Digital Personal Data Protection Act 2023 (S4–S20) to an actionable compliance task — with owner, due date, risk rating, and evidence field. Your legal team and DPO get a live register, not a spreadsheet.

Capability	What it does	Output
Section-by-Section Register	S4–S20 compliance tasks with owner, due date, and risk level (Critical/High/Medium)	Compliance register ready for DPBI inspection
Consent Architecture Tracker	Tracks consent notice implementation, granularity, and withdrawal mechanism per S6	Consent audit trail per data processing purpose
DSR SLA Monitor	Logs Data Subject Requests with 72-hour response countdown	DSR response log with timestamps for regulatory evidence
Breach Notification Workflow	Pre-filled DPBI and Data Principal notification templates on breach detection	Notification evidence with dispatch timestamps
Penalty Risk Calculator	Maps current open gaps to specific DPDPA penalty provisions	Prioritised remediation plan ranked by financial exposure

Third-party tool integrations: Corpfy connects with payment platforms like Razorpay and Cashfree for payment data consent tracking, and integrates with Freshdesk and Zendesk for DSR intake workflow — so consent and DSR management flows through your existing customer tooling.