India's Digital Personal Data Protection Act Takes Effect: Companies Face ₹250 Crore Fines for Violations

India's Digital Personal Data Protection (DPDP) Act has taken full effect, with the government announcing strict enforcement beginning July 2026. Companies found violating data protection rules face penalties of up to ₹250 crore per incident.

The Data Protection Board of India (DPBI) has been established with the authority to investigate complaints, impose penalties, and block platforms that repeatedly violate the Act. The first 50 companies have already been issued compliance notices. The DPDP Act differs significantly from GDPR in that it applies to all digital personal data processed within India, regardless of company size. Even startups must comply. The Act also introduces the concept of 'Consent Managers' — licensed intermediaries that manage user consent across platforms.

"The DPDP Act is India's digital constitution for data rights. It balances citizen privacy with innovation, and the enforcement framework ensures that data fiduciaries take their obligations seriously."

— Rajeev Chandrasekhar, Former Minister of State for Electronics & IT

Major tech companies including Meta, Google, and Amazon have established dedicated India data protection teams and appointed Data Protection Officers. Indian startups have been given a 12-month transition period for compliance. The Act has significant implications for India's digital advertising industry, which is valued at ₹50,000 crore. Companies can no longer process personal data for targeted advertising without explicit user consent. The DPBI has published detailed consent notice guidelines that must be followed. Non-compliance penalties have already begun with the DPBI issuing a ₹100 crore penalty to a major fintech company for a data breach affecting 20 million users — the first major enforcement action under the Act.