Data protection: India's DPDP Act, GDPR and privacy policies

1. The core idea#

Many deeptech founders assume privacy law is for consumer apps. It usually reaches them sooner than they expect:

• Every company holds personal data about its own people: employees, candidates, contractors, advisors, investors.
• Every website with analytics, a contact form or a newsletter collects it.
• Many deeptech products touch people directly: medical devices, wearables, diagnostics, cameras and lidar in public spaces, robots in workplaces, energy meters in homes, clinical or field trials.
• Enterprise customers ask about it in procurement, often before anything else. A data processing agreement and a security questionnaire can hold up a pilot by months.

The good news is that a pre-seed company does not need a full compliance programme. It needs a minimum viable privacy setup: know what personal data you hold and why, collect only what you need, tell people plainly, protect it, have a breach plan, and sign the right agreements with customers and suppliers. Doing that early costs days. Retrofitting it after a breach, an investor's diligence or an enterprise deal costs much more.

The main laws in this library's markets:

• India: the Digital Personal Data Protection Act 2023 (DPDP Act), with the DPDP Rules notified in November 2025. Most duties apply from 13 May 2027.
• EU: the General Data Protection Regulation (GDPR), in force since 2018, which applies to non-EU companies that offer goods or services to people in the EU or monitor them.
• UK: the UK GDPR and Data Protection Act 2018, amended by the Data (Use and Access) Act 2025, whose main changes took effect on 5 February 2026.
• US: no single federal law. Sector laws (HIPAA for health, COPPA for children) and around 20 state laws led by California's.

Who this is for: founders whose product, research or website touches data about identifiable people; anyone selling to enterprises, hospitals or governments; anyone preparing for diligence.

Pairs with: 4.14 (customer contracts and data processing agreements), 4.09 (employee data and confidentiality) and 2.17 (rights to research data and datasets).

2. What the law says now#

India: the DPDP Act and Rules are phased in. The Rules were notified on 13–14 November 2025 with an 18-month runway:

Key features that differ from GDPR:

• Two lawful grounds only: consent, or one of the listed "legitimate uses" in s.7. These include data a person gives voluntarily for a specified purpose without objecting, employment purposes, legal obligations, medical emergencies and certain state functions. There is no general "legitimate interests" ground.
• Consent must be free, specific, informed, unconditional and unambiguous, given with a clear affirmative action, after a standalone notice in plain language listing the data and purposes. Withdrawing must be as easy as giving it.
• Children are everyone under 18. Processing their data needs verifiable consent from a parent, and tracking, behavioural monitoring and targeted advertising aimed at children are banned, with limited exemptions.
• Breaches must be reported to the Board and to each affected person without delay, with a detailed report to the Board within 72 hours.
• Transfers abroad are allowed except to countries the government restricts. Sector rules (such as RBI's for payments data) still apply.
• Penalties go up to ₹250 crore for failing to take reasonable security safeguards, and ₹200 crore for failing to report breaches or breaching children's-data duties. The Act grades penalties by the nature, duration and size of the breach.
• Startups can be exempted. Section 17(3) lets the government exempt classes of fiduciaries, including startups, from some duties. Check whether any notification covers you before assuming either way.

EU GDPR. Six lawful bases, including legitimate interests. Applies to non-EU companies that target or monitor people in the EU, which usually requires appointing an EU representative (Article 27). Breaches must be reported to the authority within 72 hours where there is a risk to people. Fines go up to €20 million or 4% of worldwide turnover. Transfers to the US can rely on the EU–US Data Privacy Framework if the US recipient is certified; otherwise use the Standard Contractual Clauses (SCCs). India has no EU adequacy decision, so EU-to-India transfers need SCCs.

UK GDPR after the Data (Use and Access) Act 2025. From 5 February 2026 the UK added a seventh lawful basis, "recognised legitimate interests" (such as crime prevention, safeguarding and emergencies), which needs no balancing test; confirmed that direct marketing, intra-group admin transfers and network security can be legitimate interests (still with a balancing test); relaxed rules on automated decision-making and some cookies; eased consent for scientific research; and raised fines for cookie and marketing breaches (PECR) to GDPR levels. For most startups the practical change is modest: UK and EU compliance remain very close.

US. No federal privacy law. California's CCPA/CPRA applies to for-profit businesses with over about $26.6 million in annual revenue, or that buy, sell or share data on 100,000+ California residents or households, or earn half their revenue from selling or sharing it. Most pre-seed companies fall below these thresholds. But HIPAA can apply to medtech working with US providers, FTC rules apply to everyone (unfair or deceptive practices, including promises in your privacy policy), and Illinois's Biometric Information Privacy Act (BIPA) has produced large class actions over face and fingerprint data.

Deeptech-specific points. Sensor data can be personal data when it can identify a person: images, voices, gait, location, energy-use patterns from a single home, health readings. Research data from participants is personal data even when it is used for science. GDPR and UK law give research some exemptions, but they need safeguards such as pseudonymisation.

3. The method: a minimum viable privacy setup#

Aim to complete this in about a week before your first pilot or public launch, then review it every six months.

Step 1: Map your data (half a day)#

Make a one-page table: what personal data you hold, about whom, where it comes from, why you need it, where it is stored, who can see it, which suppliers process it, how long you keep it.

Under GDPR this becomes your record of processing (Article 30). Small companies are partly exempt from keeping a formal record, but not if processing is regular or involves health data.

Step 2: Collect less, separate more#

The cheapest risk reduction is not holding the data. Use pseudonymous IDs for test subjects, keep the key separate, blur faces in camera data at the edge, aggregate meter data, and delete raw recordings once features are extracted. Design for this now: it is hard to retrofit into a device or pipeline later. GDPR calls this data protection by design (Article 25).

Step 3: Write notices people can read#

• A website privacy policy: who you are, what you collect, why, lawful basis, who you share with, transfers abroad, retention, rights, contact. One to two pages. Don't copy a template that describes things you don't do; the FTC and EU authorities treat inaccurate policies as deceptive.
• A consent notice for any study or pilot with people: plain language, specific purposes, how to withdraw. Under DPDP it must be standalone and available in English or any of the 22 scheduled languages of the Constitution on request. An employee privacy notice, given at hiring (4.09).
• Cookie banner only if you use non-essential cookies; many startups can avoid one by using privacy-friendly analytics.

Step 4: Sign the right contracts#

• With customers: when you process personal data on their behalf (for example, your device sends patient readings to your cloud for a hospital), you are a processor. They will ask for a data processing agreement (DPA, Article 28). Have your own template

ready (4.14).

• With suppliers: cloud, CRM, analytics and payroll providers are processors for you. Accept their DPAs and keep copies.
• Transfers: for EU or UK data going to India or the US, use SCCs (or the UK International Data Transfer Agreement or Addendum), or a US supplier certified under the Data Privacy Framework.

Step 5: Basic security and a breach plan#

Multi-factor authentication everywhere, least-privilege access, encryption at rest and in transit, logging, and offboarding checklists. Write a one-page breach plan: who decides, who calls the lawyer, how to notify authorities within 72 hours (EU/UK; India's detailed report also within 72 hours) and affected people. Run a 30-minute drill once.

Step 6: Handle rights requests#

People can ask to see, correct or delete their data, and (EU/UK) object or move it. Set up one email address, a simple log, and a response deadline (one month under GDPR; under DPDP, within the period you publish, at most 90 days).

Step 7: Decide who owns it#

Name one founder as responsible. A formal Data Protection Officer is required under GDPR only for large-scale monitoring or large-scale special-category (such as health) data; under DPDP only for Significant Data Fiduciaries. A medtech startup running large studies may need one; most others do not.

Worked example#

PulseLoop, a Bengaluru startup, makes a chest-patch ECG sensor. It runs a 200-patient pilot with a Mumbai hospital and a 50-patient study with a UK NHS trust, and stores data in the cloud.

1. Data map: ECG traces, age, sex and a hospital patient code. No names; the hospitals keep the key. This makes the data pseudonymised, but still personal data under GDPR and DPDP because it can be linked back.

2. Roles: for clinical care the hospitals are the controllers and PulseLoop is a processor. For using the data to improve its algorithm, PulseLoop wants to be a controller, so the consent forms say so explicitly, and patients can opt out of that use separately.
3. Contracts: a DPA with each hospital; the UK International Data Transfer Addendum for UK data processed by the Indian team; the cloud provider's DPA; UK data stored in a UK region.
4. Security: encryption, MFA, access logs, deletion of raw traces after 3 years.
5. Outcome: the NHS trust's information governance review, which often takes months, finishes in six weeks because PulseLoop's documents are ready. For India, the company sets 13 May 2027 as its deadline for full DPDP notices and its breach process, but adopts them now.

4. Side-by-side comparison#

India in practice.

• Until May 2027, the older rules under the IT Act (the 2011 SPDI Rules for sensitive data such as health and financial data) still apply in part.
• The DPDP Act covers foreign companies processing data of people in India if it is to offer them goods or services.
• The Board operates digitally. Appeals go to the TDSAT.
• Watch for government notifications under s.17(3) on startup exemptions, and sector rules (health data under the Ayushman Bharat Digital Mission, RBI rules for payments).

EU and UK in practice.

• If you sell to EU or UK customers from India or the US, appoint an Article 27 representative (several firms offer this for a few hundred euros a year) unless your processing is only occasional and low-risk.
• For health and biometric data, do a data protection impact assessment (DPIA) before you start.
• The EU AI Act adds separate duties for some AI systems, including many medical and safety components; it is a separate law, but your DPIA and AI Act documentation overlap.

US in practice.

• Most pre-seed companies are below CCPA thresholds, but enterprise customers will still ask for a DPA and a security questionnaire. Expect SOC 2 questions by seed if you sell software.
• If you handle data for US hospitals, you are likely a HIPAA business associate and must sign a business associate agreement (BAA).
• If your product captures faces, fingerprints or voiceprints, check BIPA (Illinois) and similar laws in Texas and Washington before any US deployment.

5. Scripts, mistakes, related playbooks, sources#

Scripts#

When an enterprise customer sends a privacy and security questionnaire:

"Thanks, we'll return this within [5] working days. To speed things up, attached are our data map for the pilot, our standard DPA and our security overview. Could you tell us whether your team will treat us as a processor for the pilot data, and whether you need data kept in [country]?"

In a pilot or study consent form (plain-language core):

"We will record [data] from the sensor while you wear it, for [purpose]. We will not record your name; the hospital keeps the link between you and your code. We will keep the data for [period] and then delete it. You can stop at any time and ask us to delete your data by writing to [address]. Separately, we would like to use your coded data to improve our device. You can say no to that and still take part."

First message after discovering a possible breach:

"We've found a possible security incident affecting [system] at [time]. We've [contained it / revoked access]. We're assessing what data was involved and will update you by [time]. Please don't discuss outside this group until we know more." Then start the clock: 72 hours for regulators in the EU and UK, and for India's detailed report.

Common mistakes#

1. "We're B2B, so this doesn't apply." Employee, contact and sensor data are personal data.
2. Copied privacy policies that describe processing you don't do, or omit what you do.
3. Collecting raw data "in case it's useful", which turns every leak into a serious breach.
4. No DPA ready when the first enterprise or hospital pilot arrives.
5. Ignoring transfers: EU or UK data accessed by an Indian or US team needs SCCs or equivalent.
6. Assuming India can wait until 2027. Design choices made now (consent flows, retention, logs) are expensive to change later, and customers ask already.
7. Bundled consent in India: consent hidden in terms of service, or a condition of using a service it is not needed for.
8. Health or biometric data without a DPIA.
9. No breach plan, so the 72-hour window passes while people work out who to call.
10. Treating anonymised and pseudonymised data as the same. Coded data that can be linked back is still personal data.

Related playbooks#

• 2.17 Rights to research data and datasets
• 4.09 Employment contracts, NDAs and invention assignment
• 4.10 Contractor and consultant agreements
• 4.14 Customer contracts: MSAs, SOWs and pilot agreements
• 4.16 Export controls: ITAR, EAR, SCOMET
• 4.18 Compliance calendar: ROC filings, annual returns, Delaware franchise tax

Sources#

• India: Digital Personal Data Protection Act 2023; DPDP Rules 2025, notified November 2025 (PIB explainer); timeline summaries from Mondaq and TaxGuru.
• EU: Regulation (EU) 2016/679 (GDPR), arts. 3(2), 6, 9, 25, 27, 28, 30, 33, 37, 83; EU–US Data Privacy Framework adequacy decision (July 2023).
• UK: Data (Use and Access) Act 2025; Commencement No. 6 Regulations, effective 5 February 2026 (Hill Dickinson, DLA Piper, Bird & Bird).
• US: California Civil Code §1798.100 et seq. (CCPA/CPRA); Illinois BIPA, 740 ILCS 14; HIPAA, 45 CFR Parts 160 and 164; COPPA, 16 CFR Part 312.