What is DPDP Act?
Digital Personal Data Protection Act 2023
Definition, formula, India benchmarks, and the operator-grade nuance behind it.
DPDP Act 2023 is India's privacy law governing collection, processing, and storage of digital personal data. It applies to any business processing data of Indian residents. Penalties for non-compliance reach ₹250 crore per violation. Marketers must obtain explicit consent + provide opt-out + minimize data collection.
DPDP Act 2023 = India's privacy law for digital data.
Penalty: ₹250 crore per violation.
Marketing compliance: explicit consent, purpose, opt-out, deletion.
DPDP Act compliance requires explicit consent, purpose limitation, data minimization, and operational consent-management infrastructure for businesses processing data of Indian residents.
DPDP Compliance = Consent + Purpose Limitation + Data Minimization + Right to ErasureThe operator's read on DPDP Act
DPDP Act came into effect in 2023 with phased implementation through 2024–2025. By 2026, full enforcement is active. Marketers must: (1) Obtain explicit consent (opt-in checkboxes, not pre-ticked). (2) Disclose purpose at collection. (3) Provide opt-out + erasure. (4) Minimize collection (only what's needed). (5) Implement breach notification. WhatsApp, email, SMS marketing all require explicit consent. Frameleads recommends Consent Management Platforms for any client at scale.
India 2026 benchmarks — DPDP Act
- DPDP penalty cap: ₹250 crore per violation
- Compliance rate among Indian D2C: 50–70% as of 2026
- Consent capture rate for compliant flows: 70–85%
- Consent Management Platform adoption: 30–50% of mid-market
- Data Protection Officer requirement: businesses processing significant data
Common mistakes to avoid
- Pre-ticked consent checkboxes (non-compliant).
- Bundled consent for multiple purposes.
- Not implementing data deletion on request.
- Treating DPDP as one-time compliance vs ongoing.
Frequently asked questions
What's a typical DPDP Act value in India?
India 2026 benchmarks vary by category: DPDP penalty cap: ₹250 crore per violation; Compliance rate among Indian D2C: 50–70% as of 2026; Consent capture rate for compliant flows: 70–85%. Bands compress in saturated CPM regimes and widen as products move from impulse to considered. The right benchmark for your business depends on stage, gross margin, and channel mix.
What are the most common mistakes when tracking DPDP Act?
Three mistakes recur most often: Pre-ticked consent checkboxes (non-compliant).; Bundled consent for multiple purposes.; Not implementing data deletion on request.. The simplest defense is to define each metric explicitly in your reporting playbook and avoid mixing definitions across teams.
How does DPDP Act relate to other unit-economics metrics?
DPDP Act is most useful in context. Pair it with GDPR and KYC to build a complete picture. DPDP Act alone can mislead — the relationship between metrics matters more than any single number.
Should I optimize DPDP Act or accept industry-standard values?
Optimization depends on your stage. Early-stage businesses often have DPDP Act values outside healthy bands and need to fix structural issues (audience, creative, retention) before chasing the metric. Established businesses can compound through marginal improvements. Frameleads' Growth System maps which lever moves which metric in your specific category.
How DPDP Act behaves per industry
DPDP Act is a universal metric, but its band, drivers, and optimisation levers vary by category. Drill into the industry-specific version below for the deep view.
- DPDP Act for Real Estate DevelopersCAC 3,500–35,000 ₹ · CPC 40–280 ₹Open
- DPDP Act for D2C BrandsCAC 250–2,200 ₹ · CPC 8–60 ₹Open
- DPDP Act for B2B SaaS StartupsCAC 15,000–3,00,000 ₹ · CPC 50–1,200 ₹Open
- DPDP Act for Healthcare Clinics & HospitalsCAC 500–15,000 ₹ · CPC 15–250 ₹Open
- DPDP Act for Education & EdTechCAC 400–4,500 ₹ · CPC 12–160 ₹Open
- DPDP Act for Financial ServicesCAC 1,500–20,000 ₹ · CPC 30–950 ₹Open
- DPDP Act for Professional ServicesCAC 800–12,000 ₹ · CPC 20–500 ₹Open
- DPDP Act for Restaurants, Cafes & Cloud KitchensCAC 150–2,500 ₹ · CPC 8–120 ₹Open
- DPDP Act for Fashion & Apparel D2CCAC 200–1,200 ₹ · CPC 10–55 ₹Open
- DPDP Act for Gyms, Studios & Fitness AppsCAC 250–1,800 ₹ · CPC 12–80 ₹Open
- DPDP Act for Automotive Dealers & OEMsCAC 600–4,500 ₹ · CPC 18–120 ₹Open
- DPDP Act for Manufacturing & MSMEsCAC 3,000–35,000 ₹ · CPC 25–220 ₹Open
Questions about DPDP Act
Long-form guides on related topics
Pair this with
Sources & references
Cited primary and analyst sources. Independent of Frameleads' own data.
- IBEF — India Brand Equity Foundation: Indian Industry Reports — IBEF (Ministry of Commerce & Industry)
Sector-level market size, growth, and policy context for Indian industries.
- IAMAI — Internet & Mobile Association of India — IAMAI
Digital advertising industry body; reports on India internet user base, ad spend, and platform shares.
- MoSPI — Ministry of Statistics and Programme Implementation — Government of India
Primary source for India macro-economic indicators (CPI, GDP, household consumption).
- ASCI Code for Self-Regulation of Advertising in India — Advertising Standards Council of India
Mandatory baseline for all advertising claims in India — including digital, influencer, and comparative ads.
Talk to a senior Frameleads operator.
Bring your hardest growth question. We'll give you a sharp, no-pitch 30-minute consult.