The Digital Personal Data Protection Act, 2023 and its Rules apply to most businesses that handle customer or employee data. Compliance is easier to build in phases than all at once.
Map the data
Start with what personal data is collected, why, where it is stored and who it is shared with. Every later step depends on this inventory.
Notice and consent
Notices must be clear and itemised, and consent must be free, specific and as easy to withdraw as it was to give. Legacy forms and app flows usually need redesign.
Vendors and processors
The business remains responsible for its processors. Contracts should fix security obligations, breach notification and deletion at the end of the engagement.
Breach readiness
A breach must be reported to the Data Protection Board and to affected individuals, with a detailed report to the Board within 72 hours. A tested incident plan turns that deadline from a crisis into a procedure.
This note is general information, not legal advice. For advice on your own matter, see our Data Protection & IT Law practice or contact the firm.
