What is the DPDP Act?
The Digital Personal Data Protection Act 2023, DPDP, is India's first comprehensive horizontal data protection law. It was passed by Parliament in August 2023 and is being brought into force in stages. The DPDP Rules, 2025 were notified in November 2025; the main duties on businesses start 18 months after the 13 November 2025 Gazette, about mid-May 2027. The Act creates the legal framework for processing personal data of Indian residents.
DPDP draws conceptual inspiration from GDPR (consent, purpose limitation, rights of data subjects) but adapts these to Indian conditions: simpler structure, fewer process-heavy obligations, different penalty structure, and India-specific provisions for children's data and significant data fiduciaries. The Act establishes a Data Protection Board to handle complaints and enforcement.
Two principal roles exist under DPDP. The data fiduciary (the equivalent of GDPR data controller) determines purposes and means of processing; the data processor processes on behalf. The data principal is the individual whose personal data is processed. Solar EPCs are data fiduciaries for their customer data.
Why DPDP matters for solar EPCs
Solar EPCs sit at the intersection of multiple personal data streams. Customer onboarding collects PAN, bank details (for subsidy DBT), property documents, sometimes Aadhaar details, electricity bills (revealing consumption patterns), site photographs, and GPS coordinates. Lead capture collects phone numbers, names, addresses, sometimes income proxies. Each stream is personal data under DPDP.
Non-compliance carries serious penalty exposure. The Schedule to the Act provides for monetary penalties of up to INR 250 crore for failure to take reasonable security safeguards, up to INR 200 crore for breach notification failure, and up to INR 50 crore for any other provision. Penalties are imposed by the Data Protection Board after inquiry.
Beyond penalties, customer trust depends on data handling discipline. A residential solar buyer who shares bank details and identity documents with an EPC expects responsible handling. Reputation damage from a data breach can be more costly than the fine. That makes data privacy a client-facing trust issue, not just a regulatory checkbox, for EPCs choosing where customer records live.
How DPDP compliance is structured
- Data mapping. Identify what personal data is collected, where stored.
- Consent flow design. Clear notice, explicit consent capture.
- Purpose limitation. Use data only for stated purposes.
- Data minimisation. Collect only what is needed.
- Storage limitation. Retain only as long as needed.
- Security safeguards. The Rules list, at the minimum, encryption or masking, access control, logs and monitoring, and backups (Rule 6).
- Breach response plan. Detect, then inform each affected person and the Board without delay; the Board also needs detailed information within 72 hours (Rule 7).
- Data principal rights handling. Access, correction, erasure.
- Grievance redressal. Internal officer and process.
- Vendor diligence. CRM, hosting, analytics vendors' compliance.
Benefits of DPDP compliance
- Penalty avoidance. Maximum penalty of up to INR 250 crore.
- Customer trust. Responsible data handling.
- Buyer questions. Some corporate buyers may ask how you protect their data.
- Investor confidence. Compliance signals operational maturity.
- Data hygiene. Cleaner records, better analytics.
- Risk reduction. Breach exposure controlled.
- Vendor alignment. Forces evaluation of tool partners.
Limitations and challenges
Phased start. Main duties begin about mid-May 2027; timelines may change if the Rules are amended.
Small EPC burden. Compliance overhead disproportionate.
Vendor gaps. Ask each tool vendor how it holds and protects your data.
Cross-border data transfers. Rule 15 makes transfers subject to requirements the Government may specify.
Legacy data audit. Old records may not have consent trail.
DPDP impact across solar EPC operations
| Activity | DPDP compliance focus |
|---|---|
| Lead capture (website, WhatsApp) | Consent flow, purpose specification |
| Aadhaar handling | Collect only if needed; storage safeguards, retention limits, consent |
| Site photographs | Consent for capture and use |
| WhatsApp marketing | Opt-in, opt-out mechanism |
| Customer data export from CRM | Access logs, audit trail |
| Subcontractor sharing | Data processor agreement |
Quick facts
| Full name | Digital Personal Data Protection Act 2023 |
|---|---|
| Authority | Data Protection Board, MeitY |
| Roles | Data fiduciary, processor, principal |
| Top penalty | Up to INR 250 crore (security safeguards); up to INR 50 crore for any other provision |
| Consent standard | Free, specific, informed, unambiguous |
| Comparable | GDPR (EU) with India-specific adaptations |
| Implementation | Rules notified 13 to 14 Nov 2025; main duties after 18 months (about mid-May 2027) |
Common mistakes about DPDP
- Waiting for the last day. Main duties start about mid-May 2027, but data mapping and consent fixes take time.
- Bundled consent in forms. Not valid.
- Excel files for customer data. Inadequate security.
- No breach response plan. Notification timelines missed.
- Sharing without processor agreement. Liability transfer fails.
- Indefinite data retention. Violates storage limitation.
- Cold WhatsApp outreach. Without consent.
- Ignoring vendor compliance. Liability extends through chain.
Key takeaways
- DPDP is India's data protection law, passed August 2023.
- Solar EPCs are data fiduciaries handling significant personal data.
- Consent must be free, specific, informed, unambiguous.
- Maximum penalties up to INR 250 crore, and up to INR 50 crore for any other provision.
- Compliance involves data mapping, consent, security, breach response.
- Rules notified November 2025; main duties start about mid-May 2027.
Frequently Asked Questions
What is the DPDP Act?
The Digital Personal Data Protection Act 2023 is India's comprehensive data protection law. Enacted in August 2023, with the DPDP Rules, 2025 notified in November 2025 and the main duties starting in phases (see below), it governs how organisations collect, process, store, and share personal data of Indian residents. DPDP imposes obligations on data fiduciaries (the equivalent of GDPR data controllers) and grants rights to data principals (individuals).
Why does DPDP matter for solar EPCs?
Solar EPCs collect substantial personal data: customer PAN, bank details, electricity bills (consumption), addresses, site photographs, and sometimes Aadhaar details where a DISCOM, bank or other process asks for them. All of this is personal data under DPDP. The Act's Schedule sets maximum penalties of up to INR 250 crore for failing to keep reasonable security safeguards and up to INR 50 crore for any other provision of the Act or Rules.
What are the key obligations under DPDP?
Notice and consent before processing, purpose limitation, data minimisation, accuracy, storage limitation, security safeguards, breach notification, grievance redressal, and special protections for children's data. Significant data fiduciaries face additional requirements (Data Protection Officer, audits, impact assessments).
Is DPDP fully in force in 2026?
Partly. The DPDP Rules, 2025 were notified on 13 to 14 November 2025 (G.S.R. 846(E)), and G.S.R. 843(E) brought parts of the Act into force on 13 November 2025 (such as the provisions setting up the Data Protection Board). The main duties on businesses (notice, consent, security safeguards, breach intimation and the penalty provisions) start 18 months after the Gazette date, which is about mid-May 2027; confirm the exact day on meity.gov.in, and check there for any amendment. It is sensible to prepare now.
What is consent under DPDP?
Consent must be free, specific, informed, and unambiguous, given by clear affirmative action. Consent must be revocable, and withdrawing it must be as easy as giving it. Consent must be limited to the data needed for the stated purpose, and the business must be able to prove that notice was given and consent obtained (section 6).
What is the difference between DPDP and GDPR?
DPDP is India's framework; GDPR is EU's. Both share core concepts (consent, purpose limitation, rights of data subjects) but differ in details: DPDP has different bases for processing, different penalty structures, different cross-border data transfer rules, and India-specific provisions for children and significant data fiduciaries.
What rights do data principals have?
Right to information about processing, right to access data, right to correction and erasure, right to grievance redressal, and right to nominate someone to exercise rights post-death. A person must first use the business's grievance redressal mechanism and can then complain to the Data Protection Board (section 13).
Is WhatsApp marketing affected by DPDP?
Yes, once the main duties start. Processing a phone number needs consent or another lawful ground, such as a person voluntarily giving the number for a specified purpose (section 7(a)). Solar EPCs should capture clear consent before adding contacts to marketing lists, especially when those contacts are later moved into <a href="/glossary/marketing-automation">marketing automation platforms</a>. Check the messaging platform's own opt-in rules as well; see <a href="/glossary/whatsapp-business-api">WhatsApp Business API</a>.
What about purchased lead lists?
Risky under DPDP. Lead lists from third-party aggregators (JustDial, IndiaMART) should have consent flow that allows the EPC to contact, but the EPC must verify. Buying scraped or unverified lists exposes the EPC to DPDP violations.
Is Aadhaar data subject to DPDP?
Yes. An Aadhaar number is personal data under DPDP, and the Aadhaar Act, 2016 adds its own rules (for example, section 29 bars publishing or displaying Aadhaar numbers publicly). Collect it only where a process needs it: the national PM Surya Ghar portal consumer manual (July 2024) says not to upload an Aadhaar file.
What is the penalty for DPDP non-compliance?
The Schedule to the Act sets maximums ("may extend to"): INR 250 crore for failing to take reasonable security safeguards; INR 200 crore for failing to notify a personal data breach; INR 200 crore for breaching the children's data provisions; INR 150 crore for significant data fiduciary obligations; INR 10,000 for a data principal's duties; and INR 50 crore for any other provision of the Act or Rules. The Board considers factors such as gravity, duration and the steps taken to reduce harm (section 33).
Should small EPCs worry about DPDP?
Yes. The Act lets the Government exempt some classes such as startups from certain duties (section 17(3)), but the Rules text we read (checked 31 October 2026) names no such exemption. Practical steps for a small EPC: consent wording in lead capture, secure data storage (not Excel files on unprotected laptops), retention limits, and a breach response plan. Whatever CRM you use, ask the vendor in writing how it holds and protects your data.
Run your solar business on Quickest Solar CRM
India's mobile-first solar CRM. Send subsidy-ready proposals on WhatsApp in 60 seconds. Free for 10 proposals a month, no card.
Start free →Sources
- Digital Personal Data Protection Act 2023. Full text. meity.gov.in
- DPDP Rules, 2025 (G.S.R. 846(E)) and commencement notification G.S.R. 843(E), 13 November 2025. Duties, timelines and penalties. meity.gov.in
- PIB, 14 November 2025. Government notifies DPDP Rules.
- Data Protection Board orders. Enforcement decisions.
- Aadhaar Act 2016 and UIDAI guidelines. Aadhaar-specific rules.
- PM Surya Ghar national portal consumer manual (July 2024). Documents to upload.
Written by Parth Maru, Sales & Operations Lead, Quickest Solar CRM (Surat).
Last updated: 31 October 2026.