Compliance Challenges for Indian Startups under the Digital Personal Data Protection Act, 2023

The enactment of the Digital Personal Data Protection Act, 2023 (DPDP Act) marks a transformative shift in India’s data governance framework by introducing a comprehensive legal regime for the protection and processing of digital personal data. The legislation imposes statutory obligations upon data fiduciaries, including startups, to ensure lawful processing, data security, transparency, accountability, and protection of data principals’ rights. This research paper critically examines the compliance challenges faced by Indian startups under the DPDP Act, 2023, with particular focus on obligations relating to consent management, data security safeguards, grievance redressal, cross-border data transfers, children’s data processing, and penalties for non-compliance.