DPDP for Founders and CEOs: What You Own and What to Do First
TL;DR
For founders and CEOs, the DPDP Act is a leadership issue, not just a legal one. Penalties reach ₹250 crore per instance, enterprise customers and investors will ask about compliance, and the main obligations apply from 13 May 2027. Leadership must own five decisions: an accountable owner, budget, which data the business really needs, risk appetite on vendors and marketing, and how progress is reported to the board.
Who this is for: founders, CEOs, managing directors and board members who need to understand what the DPDP Act means for their business, and what they personally need to decide.
Most DPDP guidance is written for lawyers and privacy teams. But the decisions that determine whether a company is ready, and how much risk it carries, sit with leadership: who owns the programme, how much it gets, which data the business really needs, and how much risk it will accept in growth and vendor choices.
This briefing covers what you need to know and what you need to decide. For the full legal picture, your team can start with The DPDP Act, Explained.
Why this is a leadership issue
The exposure is material. Penalties reach ₹250 crore per instance for security failures, ₹200 crore for failing to report a breach or protect children's data, and ₹50 crore for most other breaches. They are fixed amounts, not a share of turnover, which makes them proportionately larger for smaller companies. See DPDP Act penalties.
Customers and investors will ask. Enterprise buyers are adding DPDP clauses to contracts and security questionnaires. Investors and acquirers are adding it to due diligence. A credible answer wins deals; a vague one slows them.
The deadline is fixed. The main obligations apply from 13 May 2027. Work started in late 2026 has roughly six months. See the DPDP compliance timeline.
It changes how you grow. Consent rules affect marketing, cross-selling and partnerships. Data minimisation affects product design. Vendor accountability affects every tool your teams buy.
What the law requires, in one paragraph
If you process personal data of people in India, you must tell them clearly what you collect and why, obtain valid consent where a specific legitimate use does not apply, collect only what you need, keep it secure, delete it when the purpose ends, honour their rights, report every breach to them and the Data Protection Board, hold your vendors to the same standard, and be able to prove all of it. Children's data and large-scale processing carry extra duties.
The five decisions only leadership can make
1. Who owns it
Name one accountable owner with the authority to cross functions: product, engineering, marketing, HR, procurement. If you are likely to be a Significant Data Fiduciary, that will need to be a Data Protection Officer based in India and reporting to the board.
2. What it gets
Allocate budget and people. The largest costs are usually internal time, consent and data-mapping tools, legal review of vendor contracts, and engineering work to integrate consent and erasure. Under-resourcing is the most common reason programmes miss deadlines.
3. What data the business actually needs
The cheapest data to protect is data you do not collect. Ask each function to justify the data it holds against a specific purpose. Data you cannot justify is pure risk.
4. How much risk you accept
Leadership must set the line on questions that trade growth against risk: aggressive retargeting, partner data sharing, using customer data to train AI models, using unvetted SaaS tools. These are business decisions with legal consequences.
5. How you will know
Agree what the board will see, and how often: obligations met, evidence available, open risks, rights requests and breaches. If leadership cannot see progress, it is not happening.
A 30-60-90 plan for leadership
| Window | Leadership actions | What the team delivers |
| Days 1–30 | Appoint the owner, approve budget, set risk appetite, brief the board | [Scope assessment](/blog/does-dpdp-apply-to-me), [data map](/blog/ropa-dpdp), gap analysis |
| Days 31–60 | Decide on tooling, approve data reductions, sponsor cross-team changes | Notices, consent flows, rights process, breach plan |
| Days 61–90 | Review readiness, approve residual risks, set the operating rhythm | Vendor contracts, retention schedule, tests, board report |
Your team can follow the detailed 90-day DPDP compliance roadmap.
Questions to ask your team this week
- What personal data do we hold, and do we know every place it lives?
- Which of our consents would pass the DPDP standard today?
- If we had a breach tonight, who would notify customers and the Board, and how fast?
- Which vendors hold our customers' data, and do our contracts cover DPDP?
- Do any of our users or customers include under-18s?
- What will we be able to show the Board, or a customer, on 13 May 2027?
Common leadership mistakes
- Delegating it entirely to legal. Most of the work is operational and technical.
- Waiting for enforcement. By the time cases appear, the evidence you need must already exist.
- Treating it as a one-off project. Compliance becomes part of how products are built and vendors are bought.
- Assuming a startup exemption. None has been notified.
How ConsentifyAI helps
ConsentifyAI gives leadership and teams one platform for the DPDP programme: a data map, consent and notices, rights requests and an audit trail, with reporting that shows the board what is in place and what is at risk. Teams move faster, and leadership can see progress rather than ask for it.
Sources & references
- DPDP Act, 2023 — Sections 3, 6, 8, 9, 10, 17(3), 33
- DPDP Rules, 2025 — Rules 3, 6, 7, 13
Frequently asked questions
Does the DPDP Act apply to startups?
Yes. There is no size threshold. The government can exempt notified classes of fiduciaries, including startups, from specific provisions, but no such exemption had been notified at the time of writing.
Is the CEO personally liable under the DPDP Act?
Penalties under the Act are imposed on the Data Fiduciary, not on individual executives. But the board and leadership remain accountable for governance, and failures will be reflected in customer, investor and reputational outcomes.
How much does DPDP compliance cost?
It depends on data volume, systems, sector and starting point. The largest costs are usually internal time, consent and data-mapping tooling, vendor contract work and system integration.
Do we need a Data Protection Officer?
Only Significant Data Fiduciaries must appoint one. Every company should nonetheless name an accountable owner for the programme and publish a privacy contact.
What should we tell investors about DPDP?
Your scope, your main risks, the owner, the plan and timeline to 13 May 2027, and the evidence you will have. Due diligence teams increasingly ask for this.
Related reading
The DPDP Act, Explained: The Complete 2026 Guide for Indian Businesses
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's first comprehensive data protection law. It applies to almost every organisation that processes digital personal data of individuals in India, including foreign companies serving Indian users. The DPDP Rules, 2025 were notified on 13 November 2025, and most obligations (notice, consent, security, breach reporting, rights and grievance handling) become enforceable on 13 May 2027. Penalties reach ₹250 crore per instance. The organisations that will be ready are the ones treating compliance as an operating model, not a policy update.
ReadDPDP Compliance Checklist: A 90-Day Roadmap From Zero to Audit-Ready
A DPDP programme can reach audit-ready in roughly 90 days if work runs in parallel across six streams: governance, data mapping, notice and consent, rights and grievances, security and breach response, and vendors and retention. This roadmap sets out week-by-week tasks, owners and the evidence each step must produce, with a master checklist at the end. The deadline for most obligations is 13 May 2027.
ReadDPDP Act Penalties: What a ₹250 Crore Fine Actually Looks Like
The DPDP Act sets maximum penalties per instance of breach: up to ₹250 crore for failing to take reasonable security safeguards, ₹200 crore for failing to notify a breach or protect children's data, ₹150 crore for Significant Data Fiduciary failures, and ₹50 crore for any other breach. The Board must weigh factors including gravity, duration and how quickly you mitigated. One incident can trigger more than one penalty. Penalty powers apply from 13 May 2027.
Read