DPDP Act Compliance for Kerala Businesses

From 13 May 2027, every business in Kerala that collects personal data in digital form must comply with the Digital Personal Data Protection Act, 2023 (DPDP Act). That is six months away, and the law carries penalties of up to ₹250 crore.

This week marks the second milestone. On 13 November 2026, the Consent Manager framework under the DPDP Rules, 2025 comes into force. The third and final phase, which carries the obligations that affect almost every business, follows on 13 May 2027.

As a lawyer and DPDP compliance consultant advising business owners in Calicut (Kozhikode), Kochi and across Kerala, I hear the same three questions. Does this law apply to me? What exactly do I have to do? What happens if I do nothing? This article answers all three in plain language.

What is the DPDP Act, and when does it apply?

The DPDP Act is India's first dedicated law on personal data. It regulates how any organisation collects, uses, stores and shares the digital personal data of individuals.

The law uses three terms you will see everywhere. The Data Principal is the individual whose data it is. The Data Fiduciary is the business that decides why and how the data is processed. The Data Processor is a vendor that handles data on the fiduciary's behalf.

The Act was passed in August 2023, but it was switched on only when the DPDP Rules were notified on 13 November 2025. The Government chose a three-phase rollout.

Phase	Date	What comes into force
1	13 November 2025	Definitions and the Data Protection Board of India
2	13 November 2026	Registration and obligations of Consent Managers
3	13 May 2027	Notice, consent, security, breach reporting, individual rights and penalties

Phase 2 matters mainly to companies that plan to register as Consent Managers or build systems that connect to them. Phase 3 is the one that reaches every clinic, school, shop, startup and exporter that holds customer or employee data.

Does the DPDP Act apply to my business?

If you hold names, phone numbers, email addresses, Aadhaar or passport copies, health records, student records or payment details on a computer, phone or cloud app, the answer is yes. The Act has no turnover threshold and no blanket exemption for small businesses.

It covers data collected digitally and paper records that are later digitised. It also covers businesses outside India that offer goods or services to people in India.

Here is how it lands on the sectors we see most often in Kerala:

• Hospitals, clinics and diagnostic labs: patient registration data, reports, prescriptions and insurance details.
• Schools, colleges, coaching centres and edtech: student and parent data. Most students are under 18, so the stricter rules on children's data apply.
• Overseas recruitment, travel and study-abroad agencies: passports, visas, certificates and medical reports, often shared with partners in the Gulf.
• Jewellery, textile and retail chains: loyalty programmes, WhatsApp marketing lists and CCTV footage.
• NBFCs, gold loan companies, chit funds and cooperative societies: KYC documents and financial records.
• IT and software companies in Cyberpark, Infopark and Technopark: client data processed under contract, plus product user data.
• Hotels, resorts and homestays: guest identity documents and booking data.
• Every employer: employee records, payroll, attendance and background checks.

What does the law require you to do?

The Act places eight core duties on every Data Fiduciary from 13 May 2027.

Two groups carry extra duties. Businesses that process children's data need verifiable consent from a parent and cannot track children or target advertising at them, subject to limited exemptions. Businesses notified as Significant Data Fiduciaries must appoint a Data Protection Officer based in India and carry out annual audits and impact assessments.

What are the penalties for non-compliance?

The Data Protection Board of India can impose penalties of up to ₹250 crore for a single breach. These are maximum amounts, and the Board must consider the gravity, duration and repetition of the breach and the steps taken to reduce harm.

Failure	Maximum penalty
Not taking reasonable security safeguards to prevent a data breach	₹250 crore
Not notifying the Board and affected individuals of a breach	₹200 crore
Breaching the obligations on children's data	₹200 crore
Breaching the additional obligations of a Significant Data Fiduciary	₹150 crore
Breaching any other provision of the Act or Rules	₹50 crore

1. Give a clear notice. Before or when you collect data, tell the individual in plain language what data you are taking, the specific purpose, and how to withdraw consent or complain.
2. Take valid consent. Consent must be free, specific, informed and given by a clear affirmative action. Pre-ticked boxes and bundled consent will not work. Withdrawing consent must be as easy as giving it.
3. Use data only for the stated purpose. Some uses, such as certain employment purposes and legal compliance, are permitted without consent as "legitimate uses". Everything else needs consent.
4. Secure the data. The Rules expect measures such as encryption, access controls, activity logs and backups, with logs kept for at least one year.
5. Report breaches. If personal data is breached, inform the affected individuals and the Data Protection Board without delay, and file a detailed report with the Board within 72 hours.
6. Delete data you no longer need. Once the purpose is served or consent is withdrawn, erase the data unless another law requires you to keep it.
7. Honour individual rights. People can ask to access, correct or erase their data and to nominate someone to act for them. Grievances must be resolved within 90 days.
8. Control your vendors. You may use a Data Processor only under a valid contract, and you remain responsible for what the processor does.

The practical point is that the Board will look at what you did before the breach. A business that can show its notices, consent records, security measures and vendor contracts is in a very different position from one that has nothing on paper.

A six-month DPDP compliance plan

Six months is enough time if you start now. This is the sequence I recommend to clients.

1. Month 1: Map your data. List what personal data you hold, where it sits, why you collected it, who can access it and which vendors receive it.
2. Month 2: Find the gaps. Compare what you do today with what the Act and Rules require. Identify data you hold without a clear purpose.
3. Month 3: Fix your documents. Rewrite the privacy notice and consent forms, update employee and customer forms, and sign data processing agreements with vendors.
4. Month 4: Fix your systems. Put in place access controls, encryption, logging and backups. Set a retention and deletion schedule.
5. Month 5: Prepare for requests and breaches. Publish a contact point for data queries, set up a grievance process, and write a breach response plan that can meet the 72-hour deadline.
6. Month 6: Train and test. Train the staff who handle data, run a mock breach drill, and keep records that prove what you have done.

The businesses that struggle will be the ones that begin in April 2027.

Do you need a DPDP compliance consultant?

A small business with simple data can do much of this work in-house. Most others benefit from a DPDP consultant for three parts of it: the gap assessment, the legal documents and the vendor contracts.

When you choose a DPDP compliance consultant in Kerala, check three things. They should work from the text of the Act and Rules, not a generic GDPR template. They should have legal drafting capability, because notices, consent forms and data processing agreements are legal documents. And they should be able to work with your IT team, since half the obligations are technical.

DPDP compliance consultants in Calicut, Kochi and across Kerala

Legacy Partners works as a DPDP compliance consultant and legal adviser to businesses across Kerala, from our offices in Calicut (Kozhikode) and Kochi. Our teams in Mumbai and Dubai support clients who also operate in the Gulf.

Our DPDP work covers:

• Data mapping and a gap assessment against the Act and Rules
• Privacy notices, consent forms and internal data protection policies
• Data processing agreements with vendors and group companies
• Breach response plans and grievance redressal procedures
• Staff training and ongoing compliance support

To discuss where your business stands, contact our Calicut or Kochi office or message us on WhatsApp at +91 9562 4444 70.

Frequently Asked Questions