DPDP Act 2023 Compliance in ERPNext

1. What's New: DPDP Act + Rules and the May 2027 Deadline

The Digital Personal Data Protection Act 2023 received Presidential assent on 11 August 2023, marking the end of a six-year journey to create India's first standalone data protection framework. For more than two years after, the Act sat largely dormant because the operational rules had not been notified. <strong>That changed on 13 November 2025</strong>, when the Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules 2025 along with the enforcement timelines and the establishment of the Data Protection Board of India.

1.1 The three-phase enforcement timeline

1.2 Why companies cannot wait until 2027

The May 2027 date is the deadline for being compliant, not the starting line. Three reasons companies that wait until late 2026 will be in trouble.

<strong>First, the Data Protection Board is already operational.</strong> While most enforcement powers come into force in Phase 3, the Board can already register Consent Managers and handle complaints from Phase 2 onwards. Companies named in early complaints will be the test cases when enforcement begins. The reputational hit comes before the financial penalty.

<strong>Second, DPIA and data audit obligations for SDFs are tied to the notification date.</strong> Rule 13 requires Significant Data Fiduciaries to conduct a DPIA and data audit yearly from 13 November 2025 (or from date of designation, if later). Companies likely to be designated SDFs cannot afford to be unprepared.

<strong>Third, ERPNext consolidation projects take 12 to 18 months.</strong> Starting that work in Q3 2026 leaves no margin to fix mistakes before May 2027.

2. Who Needs to Comply, and What the Penalties Look Like

The Act does not exempt small companies. Any organisation that determines the purpose and means of processing digital personal data is a Data Fiduciary. Companies that process data on behalf of a Data Fiduciary are Data Processors. Significant Data Fiduciaries face additional obligations and are designated by the Central Government.

2.1 The penalty structure

Penalties are flat ceilings (not turnover-linked like the GDPR), imposed per instance of contravention, so multiple breaches stack.

2.2 Significant Data Fiduciaries

The Central Government will designate certain organisations as SDFs based on volume and sensitivity of data, risk to rights of data principals, and effects on State security. Once designated, SDFs must:

• Appoint a Data Protection Officer (DPO) based in India.
• Appoint an independent Data Auditor.
• Conduct yearly DPIA and data audit from 13 November 2025 or date of designation.
• Adopt privacy-enhancing techniques.

2.3 The CERT-In overlap

CERT-In directives of April 2022 already require organisations to report cyber incidents within 6 hours. The DPDP framework requires breach notification to the Board within 72 hours. <strong>For personal data breaches that are also cyber incidents (which is most breaches), both timelines apply.</strong>

3. The Eight DPDP Obligations Mapped to ERPNext

The DPDP Act and Rules together impose eight categories of obligation on Data Fiduciaries. Some are native in ERPNext, some need configuration, and some need a thin custom Frappe app.

4. Personal Data Inventory: Where the Data Actually Lives in ERPNext

4.1 Doctypes that hold personal data

4.2 The data inventory exercise

• List every active doctype that contains personal data.
• Identify the data fields that constitute personal data; annotate sensitivity.
• Identify the source (collected directly, derived, third-party).
• Document the lawful basis (consent, legitimate use, statutory mandate).
• Document the purpose, retention period, and erasure trigger.
• List internal recipients (which roles) and external recipients (vendors, statutory bodies).
• Produce a Record of Processing Activities (ROPA). This is your DPDP audit evidence.

4.3 The role of the Role Permissions Manager

DPDP requires that personal data is accessible only to those who need it for the documented purpose. ERPNext's Role Permissions Manager is the system-level enforcement of this principle.

Example: a payroll executive's permissions under DPDP

• Employee doctype: Read + Write on basic fields; no access to Salary or Family Members fields (Field Level Permission).
• Salary Slip: Read + Write + Print, but only for assigned employees (User Permission filter on Department).
• Salary Component: Read only.
• Activity Log, Personal Data Download Request, Personal Data Deletion Request: no access. Only the DPO role.

5. Consent Capture and the Consent Register

Consent is the dominant lawful basis under DPDP. Consent must be free, specific, informed, unconditional, and unambiguous, given through a clear affirmative action. <strong>Generic terms-and-conditions acceptance does not satisfy this.</strong> Withdrawal of consent must be as easy as giving it.

5.1 The privacy notice requirement

Rule 3 requires every Data Fiduciary to issue a privacy notice in clear and plain language at the point of personal data collection. The notice must specify what data is collected, the purpose, the methods to exercise data principal rights, and the process for filing complaints with the DPBI. Available in English and any of the 22 scheduled languages.

5.2 The Consent Record doctype

5.3 Consent withdrawal channels

• Customer Portal: Manage My Consent page with Withdraw button.
• Email: one-click unsubscribe link in marketing emails.
• DPO email channel: data principals can email withdrawal requests.
• On withdrawal: Notification to DPO and Workflow triggers data minimisation check.

5.4 Phase 2: Consent Manager integration

From 13 November 2026, registered Consent Managers will operate as intermediaries with Rs. 2 crore minimum net worth and platform interoperability certification. They give data principals a single dashboard to manage consents across all Data Fiduciaries. ERPNext implementations will integrate via a thin Frappe app exposing consent grant, withdraw, and verify endpoints. For mid-market companies, this is a Q1 2027 implementation activity.

6. Data Principal Rights: Access, Correction, Erasure, Portability

Sections 11 to 14 grant four core rights: access, correction and erasure, grievance redressal, nomination. Rule 13 sets the response timeline at <strong>90 days</strong>.

6.1 Right to access (Section 11)

ERPNext's native Personal Data Download Request workflow handles this elegantly. The data principal logs in, requests their data, verifies via email, and receives a JSON download.

• Data principal navigates to {host}/request-data and submits with their email.
• ERPNext sends an email with a verification link.
• On verification, the request is recorded in the Personal Data Download Request doctype.
• ERPNext compiles personal data from User, Customer, Contact, Address, Communication, Lead into JSON.
• Time-limited download link is emailed to the data principal.

<strong>Configuration to make this DPDP-ready:</strong> Extend the JSON export to include data from custom doctypes (Patient, customer-specific records). Set 90-day SLA via Website Settings. Build a notification rule that escalates at day 75.

6.2 Right to correction (Section 12)

Build a Correction Request doctype: <code>data_principal</code> (Dynamic Link), <code>field_to_correct</code>, <code>current_value</code>, <code>requested_value</code>, <code>supporting_evidence</code> (Attach), <code>status</code>. Workflow: Pending Verification → Pending Approval → Approved (apply correction) → Completed.

6.3 Right to erasure (Section 12)

ERPNext's native Personal Data Deletion Request workflow handles this with status states: Pending Verification → Pending Approval → On Hold / Deleted.

6.4 Right to portability and grievance redressal

The JSON export from Personal Data Download is portable: structured, machine-readable, transferable to another Data Fiduciary. For grievance redressal (Section 13), use ERPNext's Issue / Helpdesk doctype as the data privacy channel with auto-assignment to the DPO role and a 90-day SLA.

6.5 Data Principal Request Register

DPDP audits will ask: how many access, correction, and erasure requests did you receive last quarter? How many were closed within SLA? Build a Data Principal Request Register custom doctype that consolidates all requests into one auditable view.

7. Breach Detection and the 72-Hour Notification Runbook

Breach notification is the highest-stakes DPDP capability. Section 8(6) penalises failure to notify at up to <strong>Rs. 200 crore</strong>. Critically, the Rules contain <strong>no de minimis threshold</strong>: every personal data breach is reportable, regardless of severity.

7.1 The dual notification timeline

7.2 Incident Response Record doctype

• incident_id, discovery_datetime, incident_type, severity
• data_categories_affected, data_principals_count
• is_personal_data_breach, is_cyber_incident (trigger respective workflows)
• cert_in_notification_sent, dpbi_initial_notification_sent
• dpbi_detailed_report_sent (72-hour deadline auto-tracked)
• data_principals_notified, root_cause, remediation_actions

7.3 The drill matters more than the doctype

Building the doctype is the easy part. The hard part is muscle memory. <strong>Run a tabletop exercise quarterly:</strong> simulate a breach scenario, walk the team through the runbook, time the response, identify gaps. Most companies find that their first real breach happens at 11 pm on a Friday, and the runbook only works if people know it cold.

8. Security Baseline: Access, Encryption, Logging, Backup

Section 8(5) requires Data Fiduciaries to implement reasonable security safeguards. Rule 6 makes this concrete: encryption and masking, access control, access logging and monitoring, data backup, detection of unauthorised access. Access logs must be retained for at least 1 year.

8.1 The Rule 6 minimum security baseline

8.2 India region hosting and cross-border transfers

Section 16 allows the Central Government to restrict cross-border transfer of personal data. Document the basis for any cross-border transfer. The simplest compliance posture is to host ERPNext in India region.

8.3 Hosting options for DPDP-compliant data residency

• Frappe Cloud Mumbai region: official managed hosting, India region, daily backup, 2FA available.
• AWS Mumbai (ap-south-1) or Azure India South: self-hosted on Indian cloud regions.
• On-premise: full control but full responsibility for security, backup, DR, and patching.
• Avoid: hosting in non-India regions for Indian operations.

8.4 The vendor and Data Processor obligation

Under Section 8(1), the Data Fiduciary remains liable for compliance even when processing is undertaken by a Data Processor. Rule 6(f) requires that contracts with Data Processors include appropriate security safeguard provisions.

9. 12-Month Implementation Roadmap to 13 May 2027

Phase 1, Months 1-3: Diagnostic and Baseline

• Constitute DPDP Steering Committee with CEO, CFO, IT Head, HR Head, Legal.
• Appoint a DPO or DPDP Lead.
• Conduct personal data inventory across all ERPNext doctypes.
• Document the Record of Processing Activities (ROPA).
• Audit Role Permissions; reduce over-broad assignments.
• Mandate 2FA for high-privilege roles.

Phase 2, Months 4-6: Security and Breach Response

• Implement Rule 6 minimum security baseline.
• Build the Incident Response Record doctype with Workflow.
• Document the breach response runbook with CERT-In 6-hour and DPBI 72-hour timelines.
• Run the first tabletop exercise.
• Update Data Processor contracts with Rule 6(f) clauses.

Phase 3, Months 7-9: Consent and Data Principal Rights

• Build the Privacy Notice doctype; publish on Customer Portal, web forms, Patient Portal, Employee onboarding.
• Build the Consent Record doctype.
• Configure Personal Data Download/Deletion Request with 90-day SLA.
• Build Correction Request doctype and Workflow.
• Build Data Principal Request Register.

Phase 4, Months 10-12: Stabilisation and Audit

• Run a mock DPDP audit; close gaps.
• Run second tabletop breach exercise.
• Begin Consent Manager API integration once Phase 2 stabilises.
• For SDFs: complete first formal DPIA and data audit.
• Brief the board on DPDP posture before 13 May 2027.

11. Governance Checklist