The Digital Personal Data Protection Act, 2023 establishes India's first comprehensive data protection framework. Every business handling personal data should assess its readiness.
## 1. Map your data Identify what personal data you collect, why, where it is stored, and who has access.
## 2. Establish a consent mechanism Consent must be free, specific, informed, and unambiguous. Provide notice in clear language and support withdrawal of consent.
## 3. Appoint the right people Significant Data Fiduciaries must appoint a Data Protection Officer based in India and conduct Data Protection Impact Assessments.
## 4. Prepare for breaches Have an incident response plan; the Act requires notification to the Data Protection Board and affected individuals.