The Digital Personal Data Protection Act, 2023 is India's law on how organisations collect, use and protect personal data. For employers it means two things: employee data is covered too, and staff who handle personal data need to know what is expected of them. Training should be built role by role, because a payroll executive and a plant supervisor handle different data in different ways.
Last reviewed: 2 November 2026.
What is the DPDP Act?
The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) sets rules for processing digital personal data. An organisation that decides why and how data is processed is a Data Fiduciary. The person the data is about is a Data Principal. In most companies, the employer is the Data Fiduciary and each employee, candidate and customer is a Data Principal.
The Act is supported by the DPDP Rules, 2025, notified in November 2025 with obligations coming into force in phases. Confirm the current commencement dates on the Ministry of Electronics and Information Technology website before you plan a rollout, and ask counsel how the dates apply to your business. This article explains the Act in plain terms and is not legal advice.
Does the DPDP Act cover employee data?
Yes. Employee data is personal data, so the Act applies to it. The Act does, however, allow some processing without consent. Section 7(i) permits processing for the purposes of employment, or to safeguard the employer from loss or liability, such as protecting trade secrets or providing a service or benefit an employee has asked for.
That exemption is narrower than it sounds. It covers employment purposes, not every use of employee data, and the Act doesn't define the phrase further. Monitoring, background checks and sharing data with third parties are where HR and legal teams should check the position with counsel before training anyone to treat them as routine.
Is DPDP training mandatory?
The Act text doesn't use the word "training" and doesn't set a training requirement. What it does require is that the Data Fiduciary implement appropriate technical and organisational measures to observe the Act (section 8(4)) and take reasonable security safeguards to prevent a personal data breach (section 8(5)).
Staff awareness is a common way to show those measures exist, since most breaches begin with a person's action. Whether your company needs formal training, and how much, is a judgement for your data protection lead and counsel. Treat training as evidence of good practice, not as a certificate of compliance.
What are the penalties under the DPDP Act?
The penalties sit in the Schedule to the Act. A breach of the duty to take reasonable security safeguards may attract a penalty of up to two hundred and fifty crore rupees. Other breaches carry their own limits in the same Schedule, and the Data Protection Board decides each case on its facts.
The practical point for training is that the largest penalty relates to security safeguards, which are exactly the behaviours staff control every day: who they send data to, where they store it, and whether they report a mistake.
Who in the company needs data protection training?
Everyone who touches personal data, at a depth that matches the role. The table below is a design starting point. Adapt it to the data your teams actually handle.
| Role | What the module should cover |
|---|---|
| All employees | What personal data is, safe sharing, how to spot and report a breach |
| HR and payroll | Employee and candidate data, employment purposes, retention, access limits |
| Customer-facing and sales | Collecting and using customer data, notices, handling requests |
| IT and security | Access control, vendor and processor handling, incident escalation |
| Managers and supervisors | Who to escalate to, what staff may ask, shop-floor and shift-level data such as attendance |
| Leadership | Accountability, the reporting line to the data protection lead |
Frontline staff are often missed. Shift workers may still handle attendance records, ID copies or customer details, and they usually learn best from a short module in their own language, followed by a supervisor check.
How should data protection modules be designed and reviewed?
Start from a map of the data each role handles, then write one clear behaviour per lesson: for example, "do not forward an ID copy over a personal messaging app." Short scenario videos suit this, since the risky moment is usually a small decision.
Review matters as much as production. Have your legal or data protection lead approve the script against the current Act and Rules before recording, and schedule a re-review when the law, your tools or your processes change. A policy update may need an edit to the existing module or fresh footage, depending on what changed, so agree update ownership and source-file handover in the project scope. Our guides to an accuracy checklist for AI training videos and POSH training decisions show the same review discipline for other legal topics.
Where does Probbit fit?
Probbit is a corporate training video studio in India. For compliance topics we turn your approved policy and legal review into short, role-specific modules in the language versions you agree, with your reviewers signing off each version. The LMS package format, languages and delivery timing are confirmed in the project brief after the source material and review rounds are known. See our compliance training video work, or schedule a call to plan a programme.