Your startup collects customer phone numbers. Does India’s data protection law apply to you?
The DPDP Act applies to digital personal data regardless of company size. Consent, purpose limitation and security obligations follow.
- Published
- Reading time
- 5 min
- Level
- Foundation
01 The question
A D2C brand collects names, phone numbers and addresses through its website. What does the Digital Personal Data Protection Act change?
02 Short answer
Very likely, yes. The Digital Personal Data Protection Act, 2023 applies to processing of digital personal data within India. Businesses that decide why and how such data is processed are Data Fiduciaries and must obtain valid consent (or rely on a legitimate use), give notice, protect the data and honour individuals’ rights. Implementation is being phased in under the DPDP Rules.
03 The rule
The DPDP Act, 2023 requires consent to be free, specific, informed, unconditional and unambiguous, preceded by a notice describing the data and its purpose. Data Fiduciaries must implement reasonable security safeguards and notify breaches.
The Act also provides for Significant Data Fiduciaries with additional obligations, and for a Data Protection Board with the power to impose substantial penalties.
04 Simple example
Scenario
A Jaipur-based D2C brand uses checkout phone numbers for order updates and also sends promotional WhatsApp messages.
Order updates are linked to the purpose for which the data was given. Marketing messages are a separate purpose and generally need their own clear consent.
The brand also needs a way for customers to withdraw consent and to request erasure.
05 Why it matters
Penalties are significant, and obligations extend to vendors such as payment and marketing processors.
Customer trust increasingly depends on visible, transparent data practices.
06 Practical takeaway
- 01Map what personal data you collect, why, and where it goes.
- 02Separate consent for core service and marketing purposes.
- 03Review contracts with data processors for security and deletion obligations.
07 Source / reference
- Digital Personal Data Protection Act, 2023
- Digital Personal Data Protection Rules, 2025 — Phased commencement
References are to the provisions as generally understood at the time of writing. Provisions may since have been amended, renumbered (including under the Income-tax Act, 2025) or interpreted differently.
8. Educational disclaimer
Keep reading
Why can a GST invoice be valid but ITC still be denied?
You hold a proper tax invoice, you paid the supplier in full, and the goods are in your warehouse. Why might your input tax credit still be challenged?
A valid invoice is only one of several conditions for claiming ITC. Credit also depends on what your supplier reports and pays.
Section 43B(h): Why does delayed payment to an MSME matter?
Your company books an expense for a micro supplier in March but pays in May. Can you still deduct it in the year you booked it?
Late payments to micro and small enterprises can push your tax deduction into a later year — even though the expense is genuine.
Does every payment to a foreign company attract withholding tax?
Your company pays a US vendor for a software subscription. Do you always need to deduct tax before remitting the money?
Withholding applies only to sums chargeable to tax in India. The answer turns on the nature of the payment and the tax treaty.