10 myths about the DPDP Act, busted

India’s data protection law has been debated for years, and myths have piled up. Here are ten we hear most often, and what the Act actually says.

Myth 1: “It only applies to big companies.”

The Act applies to any person who processes digital personal data for anything other than personal or domestic purposes: sole proprietors, clinics, schools, NGOs, housing societies and government bodies. Size matters only for extra duties on Significant Data Fiduciaries, and for possible exemptions the Government may notify for startups.

Myth 2: “It isn’t in force yet, so we can wait.”

The Act is in force in phases. The Board provisions started on 13 November 2025, Consent Managers on 13 November 2026, and most duties on 13 May 2027. Fixing consent flows, contracts and systems takes months. Waiting is the expensive option.

Myth 3: “Our privacy policy already covers it.”

A long legal policy rarely meets Rule 3, which wants a standalone, plain-language, itemised notice. Most existing policies need rewriting.

Myth 4: “Consent solves everything.”

Consent is one ground among several. Section 7 allows certain uses without consent, and even with consent you still owe security, accuracy, breach reporting and erasure.

Myth 5: “Directors can go to jail.”

The DPDP Act has no criminal offences. It uses financial penalties of up to ₹250 crore per breach, imposed by the Data Protection Board after an inquiry. Other laws may carry criminal liability, but not this one.

Myth 6: “We can keep data in case we need it later.”

Section 8(7) requires erasure once the purpose is served or consent is withdrawn, unless another law requires you to keep it. “Just in case” isn’t a purpose.

Myth 7: “Only big breaches need reporting.”

There’s no threshold. Every personal data breach must be reported to the affected people and the Board. Rule 7 sets the detail and a 72-hour window for the full report.

Myth 8: “Sensitive data gets special protection.”

Unlike the GDPR and the old SPDI Rules, the DPDP Act has no separate sensitive category. Sensitivity still affects what security is reasonable and whether you could become a Significant Data Fiduciary.

Myth 9: “People can claim compensation under the Act.”

Penalties go to the Consolidated Fund of India, not to individuals. People can complain to the Board, but the Act itself doesn’t give them compensation. Other legal routes may exist.

Myth 10: “Data can’t leave India.”

Transfers abroad are allowed unless the Government restricts a country by notification (section 16). Sector regulators, such as the RBI for payment data, may have stricter rules, and those still apply.

The takeaway

The Act is shorter and simpler than the GDPR, but it’s broad. Most organisations need to change something.

Go deeper

Our courses explain every section with practical examples. Browse the courses.

This article is for education and is not legal advice.