A practitioner's playbook for operationalising India's Digital Personal Data Protection Act, 2023. Written for HR leaders and operations managers, not for legal counsel. Implementation-first, with checklists, vendor questions, and reference clauses you can apply directly.
Enter your work email below to receive the PDF. We respect inboxes — one follow-up email at most, no marketing spam.
We've also emailed a copy to your inbox. The link below opens the PDF directly.
Download the PDFIndia's Digital Personal Data Protection Act, 2023 is in force. For HR teams, it is the most significant change to how employee data must be handled since the Information Technology Act, 2000. Yet the operational guidance available to HR practitioners is dominated by legal interpretations rather than implementation playbooks.
This whitepaper is the implementation playbook. It's written for HR leaders, HR operations managers, and the IT teams supporting them — not for legal counsel. It assumes you have already accepted that the Act applies to you and now need to know what to do, in what order, by when.
HR leaders, HR operations managers, and the IT/security teams supporting them. We've assumed you have an HR function processing employee data in India — whether you're a ten-person startup or a thousand-person enterprise. The framework scales; the operational obligations don't materially change with size.
If you are a legal counsel evaluating the Act in detail, this is not the document you want. We have referenced the Act and its rules where relevant, but we have not attempted to substitute for qualified legal advice. We have tried to give your operating colleagues a clear, actionable view of what compliance looks like in practice — so the legal conversation can happen against a shared operational vocabulary.
Beneath the legal text, the Act asks HR teams to internalise six operational principles. Every implementation project worth doing is structured around these:
For each, the whitepaper translates the legal requirement into the concrete operational obligation it creates for HR teams.
Why HR teams should read the Act before anyone else in the company does: HR holds the broadest and most sensitive set of personal data in most organisations. Salaries, family details, medical information, performance records, identification documents, banking details. If a DPDP compliance project gets prioritised by data sensitivity, HR will be either the first workstream or the first thing that goes wrong if compliance is neglected.
The whitepaper provides a realistic six-month implementation plan in five phases:
Most of your DPDP exposure runs through your HR software vendor. The whitepaper provides fifteen specific questions to ask any vendor before signing, covering data residency, sub-processors, encryption, audit logs, rights fulfilment, breach notification, cross-border transfers, and AI training. It also lists the thirteen reference clauses your DPA should contain — with the level of specificity that distinguishes a real DPA from a vague one.
This whitepaper was written by the Sphere product team at Infomaze Sphere LLP, the product division of the Infomaze group. Infomaze has been building operational software for businesses in India and globally for fifteen-plus years, with substantial experience in HR systems specifically. HRPLANR — our workforce operations platform — was designed ground-up with DPDP compliance as a first-class priority. The implementation patterns and vendor evaluation framework in this whitepaper are drawn from that work.
This whitepaper is a practitioner's guide. It is not legal advice. Decisions about how the DPDP Act applies to your specific situation should involve qualified legal counsel.
If the framework in this whitepaper resonates with how you want to handle HR data, HRPLANR was designed around the same principles. India compliance is native, not a bolted-on module. Free for teams up to ten — no credit card.