Upon Commencement of the DPDP Act 2023: Which Provision is Repealed?

Upon commencement of the Digital Personal Data Protection Act, 2023, the repealed provision is Section 43A of the Information Technology Act, 2000, along with the related SPDI Rules, 2011. Section 44(2)(a) of the DPDP Act explicitly mandates that Section 43A shall be omitted. The search query mentions other legal components. Section 66A of the Information Technology Act and the Intermediary Guidelines, 2021 are not repealed by the DPDP Act. Section 79 of the Information Technology Act and the Safe Harbour rules remain unaffected by this specific data privacy legislation. Section 72A of the Information Technology Act and the IT (Amendment) Rules, 2009 also survive this transition. The DPDP Act targets the old corporate data protection framework exclusively. Data Fiduciaries must discard their old SPDI compliance structures and apply the new requirements defined in the DPDP Rules, 2025.

Enterprise buyers review a company's data protection posture during the due diligence process. Seed to Series B founders face immediate friction if they retain legacy Section 43A documentation. Submitting an old SPDI privacy policy to answer a security questionnaire signals that a vendor does not track current Indian law. Investors conduct deep legal audits before releasing funds. Pointing to an omitted statute creates a hard blocker in procurement and funding cycles. Exactly 210 days remain until the hard compliance deadline of 13 May 2027. Upgrading your documentation directly impacts deal velocity. Startups must prove they handle digital personal data according to the current DPDP Act mandates. A modern compliance posture clears investor checklists. A legacy framework stalls negotiations.

The transition away from Section 43A requires fundamental changes to how an application collects information. The old regime allowed broad privacy policies and generic clickwrap agreements. The DPDP Act introduces a different scope under Section 3. The law applies to the processing of digital personal data within the territory of India where the data is collected in digital form. It also applies to data collected in non-digital form and digitised subsequently. Startups must present the Data Principal with an itemised notice before collecting this data. The DPDP Rules, 2025 require a clear list specifying exactly what data the application collects and the specific purpose for each data point. Consent is the primary basis for processing, except where Section 7 legitimate uses apply. Companies can no longer hide data collection practices inside massive legal documents.

The omission of the SPDI rules changes how foreign companies interact with Indian users. Section 3(b) of the DPDP Act sets up an extraterritorial scope that the IT Act 2000 did not enforce in the same manner. The new law applies to processing of digital personal data outside the territory of India if that processing connects to offering goods or services to Data Principals within India. A foreign startup without a physical office in Bengaluru or Delhi still falls under the DPDP Act if it targets Indian users. These offshore entities must discard any reliance on Section 43A equivalency. They need to designate a representative in India and deploy the same itemised consent flows as domestic companies. The law creates a unified standard for any entity processing data for users located within the country.

Founders must evaluate their database architecture against the updated legal reality. The DPDP Rules, 2025 specify exact timelines for reporting personal data breaches. The 2011 SPDI rules lacked these strict notification deadlines. When a startup suffers a data breach today, the Data Fiduciary must intimate the affected Data Principals and the Data Protection Board. The rules mandate submitting a detailed incident report within 72 hours. Engineering teams need automated systems to detect anomalies and generate these mandatory reports. Manual tracking creates unacceptable delays during a crisis. If a startup serves users under the age of eighteen, the platform requires verifiable parental consent mechanics. Developers must set up technical barriers that prevent minors from accessing the service until a parent approves the data processing.

The old SPDI framework treated specific financial and biometric information as separate categories with heavier compliance burdens. The DPDP Act, 2023 removes this tiered approach. The law applies uniform rules to all digital personal data. Section 3(c) provides specific exemptions. The Act does not apply to personal data processed by an individual for any personal or domestic purpose. It also excludes data made publicly available by the Data Principal or by another person under a legal obligation. The Central Government assesses the volume and risk of a company's data processing to determine if it qualifies as a Significant Data Fiduciary. These designated entities face extra duties, including appointing an India-based Data Protection Officer and executing independent data audits. Most early-stage startups escape this classification initially. Tracking data volume remains a baseline requirement for future audits.

Modern technology companies depend on international SaaS providers for hosting and analytics. The old Section 43A rules placed specific conditions on transferring certain information abroad. Under the DPDP Act, cross-border transfers are generally permitted. The Central Government retains the power to restrict transfers to notified countries or territories. This negative list mechanism means startups can usually retain their existing global cloud infrastructure. The Data Fiduciary still bears legal responsibility for the actions of these downstream vendors. Enterprise clients expect mathematical proof that a startup's data processors comply with Indian law. Companies must execute new Data Processor agreements. These contracts obligate the vendor to follow the exact same security and breach reporting standards that the primary startup owes to the Data Principal.

Legal teams need a structured timeline to transition away from the omitted IT Act provisions before May 2027. Map all data inputs across the application and log their exact database locations. Draft new itemised notices matching the DPDP Rules, 2025 formats. Inject these notices into the user registration flow. The law requires a technical mechanism allowing users to withdraw consent just as easily as they gave it. Engineering must build dashboards where Data Principals can view and revoke permissions with a single click. Configure server monitoring tools to trigger the required 72-hour reporting cycle if unauthorized access occurs. The financial risks of ignoring these steps are severe. The Data Protection Board can impose penalties up to Rs 250 crore for failing to take reasonable security safeguards to prevent a personal data breach.

Replacing repealed Section 43A procedures consumes thousands of engineering hours. Building custom consent managers and audit logs pulls developers away from shipping core product features. Purpose-built compliance software automates itemised notice delivery and tracks every consent version mathematically. These tools generate the exact compliance reports that enterprise auditors demand during vendor onboarding. Achieving a SOC2-style posture for Indian data privacy requires verifiable evidence trails. Static text documents no longer suffice. Startups evaluate software solutions based on implementation speed and API compatibility with their existing technology stack. Founders can identify the gaps between their current SPDI policies and the new legal requirements by running an evaluation at https://www.complydp.com/audit-preview today.