India’s DPDP Act: What Technology Due Diligence Misses in Indian Targets
Last reviewed: 1 November 2026. This is a technology view, not legal advice. Confirm dates and duties with counsel and the official text.
The short version
- India’s Digital Personal Data Protection Rules were notified on 14 November 2025. The main duties for companies that handle personal data start in May 2027.
- Legal due diligence usually reviews policies. The DPDP Act is also a technology problem: can the systems find, protect, delete and report on personal data?
- The Act sets security and breach duties with maximum penalties of up to ₹250 crore and ₹200 crore respectively, under its Schedule.
- Ask the target eight technology questions now. Price the gaps, or fund the fix in the first hundred days.
Where the law stands
The Digital Personal Data Protection Act became law in 2023. The Rules that make it workable were notified by the government on 14 November 2025, with a phased timeline of up to 18 months, according to the press release from India’s Press Information Bureau.
In broad terms:
- November 2025: the Rules take effect for the basic framework, including setting up the Data Protection Board.
- November 2026: the rules for consent managers begin.
- May 2027: the main obligations apply, including notice and consent, security safeguards, breach reporting, retention and erasure, children’s data and the extra duties on significant data fiduciaries.
Dates differ by a day between published summaries, so check the official text for the exact day. A target that closes in 2026 will operate under these duties within the first year of ownership.
What this means for a company’s technology
The Act applies to digital personal data processed in India, and to processing outside India connected to offering goods or services to people in India. A company that decides why and how personal data is processed is a data fiduciary and carries the duties.
For a technology team, the duties translate into work like this:
- Know the data. A reliable inventory of personal data, where it sits and who can see it.
- Prove consent and give notice. Records showing what each person agreed to, and notices that match what the systems really do. Data collected earlier needs attention as well.
- Protect it. The Rules call for reasonable security safeguards, including measures such as encryption, masking or tokens, monitoring of access, and keeping logs for a set period. Contracts with processors have to carry the same safeguards.
- Report breaches. Affected people have to be told without delay, and a detailed report goes to the Data Protection Board within a short window, reported as 72 hours.
- Delete when the purpose ends. Storage limits and erasure requests mean the company must be able to remove one person’s data from every system.
- Treat children’s data with care. Verifiable parental consent in most cases.
- Significant data fiduciaries have more duties, including independent audits and impact assessments.
What the penalties look like
The Schedule to the Act sets maximum penalties:
| Failure | Maximum penalty |
|---|---|
| Failing to take reasonable security safeguards | Up to ₹250 crore |
| Failing to notify the Board and affected people of a breach | Up to ₹200 crore |
| Failing duties on children’s data | Up to ₹200 crore |
| Failing duties of a significant data fiduciary | Up to ₹150 crore |
| Any other provision of the Act or Rules | Up to ₹50 crore |
These are ceilings. The Data Protection Board decides the actual amount on the facts, including how serious the failure was and what the company did about it. No one can predict a number for a given company. But the top of the range is large enough that an investor should know where the target stands.
What technology due diligence usually misses
Legal due diligence reads the privacy policy, the consent text and the contracts. Technology due diligence reads the architecture, the security posture and the team. Between the two there is a gap that neither fills: whether the systems can actually do what the documents promise.
A policy that says “we delete data on request” is not evidence that deletion works across the database, the backups, the analytics tools and the vendors. A consent record is not evidence that the marketing system respects it.
Eight questions to ask the target’s technology team
- Where is personal data stored, and is there an up to date inventory?
- Which systems and vendors process it, and who signed which contract?
- How do you record consent and notice, and can you show a sample for one customer?
- Can you delete or correct one person’s data across production, backups and analytics, and has anyone tested it?
- How is data protected in storage and in transit, and who can access it?
- Are access events logged, and for how long are the logs kept?
- What is the breach process, who decides, and when was it last rehearsed?
- What is the plan to reach compliance by May 2027, who owns it and what is the budget?
Good answers come with a document, a screen or a named owner. Gaps are normal at this stage. A target with no plan and no owner is a different case from one that is halfway there.
How to reflect it in the deal
- Findings in the report: list each gap, the system it affects and an estimate of the cost to close it.
- Price or holdback: where the cost is clear, adjust the price. Where it is uncertain, hold back part of it until named fixes are delivered.
- Specific protections: ask counsel about warranties and indemnities for data protection matters before closing.
- First hundred days: include a funded data protection workstream with an owner and a date. Carry the work into the value creation plan.
- For cross-border investors: check how data moves between the target and the parent, and have counsel confirm which transfers are allowed.
For how to size and price this kind of work, see how investors should price technical debt. The general data questions are in the technology due diligence checklist, and after closing the work belongs in technology governance.
Eidoran advises investors and boards on this through its technology due diligence and governance practice. Related reading: technology due diligence checklist, how investors should price technical debt, technology governance vs technology due diligence.
Frequently asked questions
When do the main DPDP Act duties start?
The Rules were notified on 14 November 2025 with a phased timeline of up to 18 months. The main obligations, including notice and consent, security safeguards and breach reporting, apply from May 2027.
What is a data fiduciary?
A data fiduciary is the person or company that decides the purpose and means of processing personal data. Most businesses that collect customer or employee data in digital form fall into this category.
How large are the penalties under the DPDP Act?
The Schedule sets maximums, including up to ₹250 crore for failing to take reasonable security safeguards and up to ₹200 crore for failing to notify a breach. The Board decides the actual amount case by case.
Does the DPDP Act matter for foreign investors?
Yes, if the target processes personal data in India or offers goods or services to people in India. The duties pass to the company the investor owns, so they affect value and the plan after closing.
Should technology due diligence cover the DPDP Act?
Yes. Legal review covers the documents. Technology review tests whether the systems can find, protect, delete and report on personal data, which is what the law requires in practice.
Evaluating a deal in India?
Request a confidential briefing on independent technology due diligence.
This material is prepared for the general information of boards, investors and advisors, and does not constitute investment, legal or accounting advice.
