DPDPA 2023: What It Means for Data Kept in India
The new law sets clear rules for what a firm may keep. It says who it hits and where a record must stay. Host in India and keep that record close to your team.
The Digital Personal Data Protection Act 2023 (DPDPA) is India's first full privacy law. It came into force bit by bit. That ran through 2024 and 2025. It covers any firm with details on people in India. That is nearly all shops. It covers most software firms that sell to India too.
What DPDPA requires.
The law sets rules, not steps. In short, it asks four things.
- Consent first. A firm can use details for one good reason. They must agree to it. The firm must stop. It stops as soon as it does not need them.
- Care for it. The data fiduciary is the firm. It sets why and how it gets used. It must take fair steps. It must guard them. It must tell the Data Protection Board about any leak. That must go out in 72 hours.
- Rights for the person. They can ask to see them. They can ask for a fix. They can ask to wipe them. They can complain and get a reply. A firm must reply in 30 days.
- Limits on moving it out. The government can name the countries where it may not go. As of 2026, the list leaves out the European Union. The United States is not on it either. The list can change later.
What hosting in India gives you.
If you serve clients in India, the best plan is to keep their details in India. We host in Palitana, Gujarat. They do not leave India. They stay while you use the site. We never copy them out.
The law that applies is the law of India. Any case goes to a court here. Any leak goes to the Board. The board can fine a firm. It can charge up to Rs 250 crore. It charges that each time the law was broken.
How WebHost24 fits.
Our plans keep to the law from day one. Your data sits with us. We report a leak to you in 72 hours. That is the window the law asks for. We reply in 30 days. Our data processing agreement at /dpa says who does what.
If you have a strict rule on where it must sit, we can help. Our data protection officer can plan one server for you. A trade under law may need this. So may a government client. So may health records. You can get a plan of its own. One tenant means one server. One client uses it. Message us on WhatsApp.