Understanding Recent Amendments to the DPDP Act 2023

The DPDP Act 2023 has undergone substantial amendments as of July 2026, aimed at enhancing data privacy in India. Among these changes, Section 8(1) now mandates explicit consent from individuals before their data can be collected, processed, or shared. This shift toward stricter consent requirements reflects a global trend towards user empowerment in data privacy. Organizations must ensure they have clear, transparent consent mechanisms to avoid penalties. Additionally, the amendments have expanded individual rights, allowing users to access, rectify, and even erase their data. Companies must develop processes to honor these rights, which may require significant adjustments to existing data handling practices.

With the recent changes, businesses across sectors are facing heightened compliance challenges. For example, the 72-hour breach reporting requirement under Rule 7(2)(b) necessitates swift action following a data breach. Organizations must establish incident response protocols that enable them to assess and report breaches within this short timeframe. This can be particularly difficult for companies that lack mature data governance frameworks. Moreover, the requirement for appointing a Data Protection Officer (DPO) adds another layer of complexity to compliance efforts. The DPO must not only understand the regulations but also ensure that all employees are trained and aware of their data protection responsibilities.

Consider a mid-sized e-commerce company that collects customer data for order fulfillment. Following the amendments to the DPDP Act, the company must revise its data collection practices to ensure explicit consent is obtained from customers. This might involve updating their website to include clear opt-in mechanisms and providing detailed information on how customer data will be used. In the event of a data breach, the company has 72 hours to report the incident as stipulated in Rule 7(2)(b). They must have a dedicated incident response team ready to act quickly, assess the breach, and provide necessary notifications to affected individuals and the Data Protection Board, ensuring compliance with the new regulations.

The recent amendments to the DPDP Act are set to reshape data protection practices across India. Companies must now prioritize data privacy as a core aspect of their operational strategies. By implementing robust data protection measures, businesses can build trust with their customers while safeguarding themselves against potential fines. Additionally, organizations are encouraged to leverage technology solutions, such as CompliYUG's BreachBlitz tool, which automates compliance processes and simplifies breach reporting. This not only ensures adherence to the DPDP Act but also allows organizations to focus on their core business objectives without compromising on data protection.