The DPDP Act Is Live. Your Employees Are the Biggest Gap.

There is a specific and costly irony in how most Indian companies have approached the DPDP Act so far. The legal team has read it. The DPO has a terms-of-reference document. The IT team has mapped data flows. And yet the person in your HR department who just forwarded an employee's home address to a vendor, the customer-facing executive who collected a PAN number on a sticky note, the finance team member who emailed a salary statement to the wrong address — none of them know what the Act requires of them, or that they were the breach.

The DPDP Act, 2023 does not just regulate what your organisation does with data. It governs what your people do with data. And that is precisely why training is not a soft add-on — it is the compliance obligation itself.

What does the DPDP Act require of employers and their employees?

It requires your organisation to process personal data lawfully, for a stated purpose, accurately, securely and for no longer than needed, and to report breaches. Employees carry out every one of those duties day to day.

The Digital Personal Data Protection Act, 2023 governs the processing of digital personal data within India, and outside India where it relates to offering goods or services to people in India — whether that data belongs to customers, employees, or any other individual (called a Data Principal under the Act). Your organisation, as the entity that determines the purpose and means of processing, is the Data Fiduciary.

The Act's core obligations on Data Fiduciaries translate directly into employee training requirements:

1. Lawful processing only. Personal data may only be processed for a lawful purpose with the Data Principal's consent, or under one of the statutory exemptions. Every employee who collects data — during onboarding, sales, customer service, or vendor management — needs to understand what "consent" means and when it is required.
2. Purpose limitation. Data collected for one purpose cannot be repurposed without fresh consent. An employee who collected a customer's phone number for delivery confirmation cannot use it for a promotional campaign. This is not an IT control — it is a behavioural one.
3. Data minimisation. Collect only what you need. The employee who asks for a photocopy of an Aadhaar card when a masked copy or a reference number would suffice is creating a liability.
4. Data accuracy. Personal data that is used for decisions affecting individuals must be accurate and up to date. HR teams handling employee data, and credit or underwriting teams handling customer data, have a specific duty here.
5. Storage limitation. Data should not be retained beyond the period needed. Employees who accumulate spreadsheets of customer information — "just in case" — create a breach surface that grows silently.
6. Security safeguards. The Act requires reasonable security practices. What "reasonable" means in practice is the subject of ongoing rules — but an employee sharing a file containing personal data over WhatsApp, or storing it on a personal device, is already on the wrong side of this line.
7. Breach notification. Every personal data breach must be notified to the Data Protection Board and to each affected Data Principal; the Act sets no materiality threshold. Under Rule 7 of the DPDP Rules, 2025, intimation is due without delay, with a detailed report to the Board within 72 hours. The window is narrow. Employees need to know what a breach looks like, how to report it internally, and that a delay in internal escalation is itself a compliance failure.

What are the penalties under the DPDP Act?

The Schedule to the Act sets maximum penalties of up to ₹250 crore, imposed by the Data Protection Board. The highest tier is for failing to take reasonable security safeguards to prevent a personal data breach.

The DPDP Act introduced a tiered penalty structure that is among the most significant in Indian regulatory history. The numbers matter because they are the reason this is a board-level issue, not just an HR or IT compliance matter.

These are per-violation maximums. In a company with thousands of employees handling personal data, the number of potential violations in any given month is not one. It is very large. The Data Protection Board of India has the authority to investigate, summon, and impose penalties — and unlike earlier Indian regulatory frameworks, the Act does not require criminal intent. A systemic failure of training and process is sufficient.

"The most common GDPR enforcement trigger in Europe was not a sophisticated cyberattack. It was an employee who sent an email to the wrong address, or a team that kept a spreadsheet longer than it should have. India will see the same pattern."

Does the DPDP Act cover employee personal data, and why does HR have the biggest gap?

Yes. Employees are Data Principals too, and HR processes their personal data at scale at every stage from hiring to exit.

Most DPDP compliance discussions focus on customer data. The HR function is frequently underweighted in the analysis, and this is a significant oversight.

Your employees are Data Principals too. Their Aadhaar numbers, PAN cards, bank account details, salary information, medical certificates, performance reviews, home addresses, and family details are all personal data under the Act. Every HR process — hiring, onboarding, performance management, payroll, exits, background verification — involves the collection, processing, and retention of personal data at scale.

HR teams routinely share employee data with third-party vendors: background check companies, payroll processors, insurance providers, statutory compliance vendors. Each of these is a data-sharing arrangement that the Act requires to be governed by a Data Processing Agreement — and many existing vendor contracts predate the DPDP Act entirely.

What are the biggest DPDP training gaps?

Three gaps recur: employees cannot recognise personal data, front-line staff are untrained on consent and purpose, and breach escalation has never been practised.

1. Employees do not know what counts as personal data

The DPDP Act's definition of "personal data" is intentionally broad: any data about an identifiable individual. In practice, employees routinely fail to classify names combined with contact details, employment information, financial records, health data, or location data as personal data requiring protection. This is not a technology failure — it is a knowledge failure. Training has to create an instinct, not just awareness.

2. Nobody has trained front-line staff on consent and purpose

Customer-facing employees — call centre agents, sales executives, relationship managers, field staff — are the people who actually collect personal data in most organisations. They handle consent forms, record data in CRM systems, and sometimes improvise when the system does not support what the customer is asking for. Without training on what consent means, what a valid consent record looks like, and what to do when a customer withdraws consent, these employees are the organisation's biggest compliance vulnerability.

3. Breach escalation paths are not practiced

Most organisations have a breach response policy in a document. Far fewer have actually drilled employees on how to recognise a personal data breach, what to do in the first hour, and who to call. The DPDP Act's notification timeline is tight. The window between an employee noticing something wrong and the DPO being aware of it needs to be minutes, not days — and that only happens if employees know the path.

What does an effective DPDP training programme look like?

Effective DPDP employee training is not a one-hour mandatory module that everyone clicks through before the deadline. It is a role-segmented, scenario-based programme that gives different employee populations the specific knowledge they need.

The goal is not to turn every employee into a privacy lawyer. It is to create a population of employees who, when they encounter a data-handling decision in their daily work, have an instinct for the right thing to do — and know where to go when they are unsure.

What extra obligations apply to Significant Data Fiduciaries?

Under section 10(2), a Significant Data Fiduciary must appoint a Data Protection Officer based in India, appoint an independent data auditor and carry out periodic Data Protection Impact Assessments.

The DPDP Act creates a separate, more demanding tier of obligations for organisations designated as Significant Data Fiduciaries by the central government. Designation is based on volume of data processed, sensitivity, risk to Data Principals, and potential impact on national security or public order.

SDFs must appoint a Data Protection Officer based in India (not just any DPO), conduct periodic Data Protection Impact Assessments, and undergo independent data audits. For most large Indian enterprises — BFSI companies, large IT/ITeS firms, healthcare networks, and e-commerce platforms — SDF designation is not a question of if, but when. The training obligation for SDFs is correspondingly higher: it is not sufficient to have done training. The organisation must be able to demonstrate, through documented records, that training was role-appropriate, assessed, and recurring.

How should you start a DPDP training programme this quarter?

Map data-handling roles, test what employees know, start with the highest-risk teams, build breach escalation into every module and document everything.

The organisations that will be best positioned when enforcement begins are not the ones that started earliest with the most sophisticated programme. They are the ones that moved from awareness to action. Here is a practical starting sequence:

Step 1: Map your data-handling roles. Identify which employee populations handle personal data as part of their core function. HR, customer service, sales, finance, IT, and procurement are the common ones. Each needs a different training track.

Step 2: Run a baseline assessment. Before building the training, test what your employees actually know. The results will almost certainly be sobering — and they will tell you exactly where to focus first.

Step 3: Prioritise high-risk populations. Customer-facing employees who collect data at point of contact, and HR teams who manage employee personal data at scale, carry the highest breach risk. Start there.

Step 4: Build breach recognition and escalation into every module. This is the single most time-sensitive skill. Even a basic drill — "this is what a breach looks like, this is who you call, this is the timeline" — dramatically reduces the response time when something actually goes wrong.

Step 5: Track and document everything. The audit trail of who completed what training, when, and with what assessment score is itself a compliance asset. If the Data Protection Board asks what steps you took to prevent a breach, training records are part of the answer.

Our DPDP Essentials course covers the foundational obligations for all employees — what personal data is, how consent works, and how to handle a suspected breach. For compliance teams, privacy officers, and senior HR leaders, the DPDP Compliance Pro programme goes deeper: SDF obligations, DPIA methodology, vendor management under the Act, and building an audit-ready training record. Both sit within our DPDP training hub.

The DPDP Act does not care whether your employees meant to cause a breach. It cares whether you took reasonable steps to prevent one. Training is the most direct, most documented, and most defensible step available to every Indian organisation right now.