India's DPDP Act for freelancers and the businesses that hire them: a practical primer

Freelancers handle a surprising amount of other people's personal data: customer lists inside a client's CRM, order data in a Shopify admin, email addresses in a newsletter tool, job applicants' CVs in an HR automation. India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, 2025 create obligations around that data — mostly for the business that decides how it is used, but with practical consequences for the freelancers they hire.

This primer explains the core ideas in plain English. It is not legal advice. The law is new, the Rules are being phased in, and guidance from the Data Protection Board will develop over time — so check the official sources and take advice for your situation.

The timeline

The Ministry of Electronics and Information Technology (MeitY) published the DPDP Rules, 2025 in November 2025, as announced by the Press Information Bureau. The Rules come into force in phases:

• Rules setting up the Data Protection Board took effect on publication.
• Rules on Consent Managers take effect one year after publication.
• Most of the substantive obligations — notices, security safeguards, breach intimation, data principal rights and retention — take effect 18 months after publication, which is around May 2027.

That gives businesses time to prepare, but contracts signed today often run past that date, so it makes sense to build good habits now.

Four terms you need to know

• Data principal: the person the data is about (a customer, a job applicant).
• Data fiduciary: the business or person that decides the purpose and means of processing. When you hire a freelancer to work on your customer data, you are usually the data fiduciary.
• Data processor: someone who processes data on behalf of a fiduciary. A freelancer working inside a client's systems is usually a processor.
• Personal data breach: unauthorised processing, disclosure, loss of access or similar incident affecting personal data.

The Act places primary responsibility on the data fiduciary, including for what its processors do. That is why careful clients will ask freelancers to accept data-handling terms in their contracts.

What clients (data fiduciaries) need to think about

A lawful basis — usually consent

Under the Act, personal data is generally processed on the basis of the person's consent, given after a clear notice, or for certain "legitimate uses" listed in the Act. Consent must be free, specific, informed, unconditional and unambiguous, and as easy to withdraw as to give.

Reasonable security safeguards

Fiduciaries must take reasonable security safeguards to prevent breaches, and the Rules describe measures such as encryption or similar techniques, access controls, logging and monitoring, and backups. The Act's schedule of penalties sets the highest amounts — up to ₹250 crore — for failing to take reasonable security safeguards.

Breach intimation

If a breach happens, the fiduciary must inform the Data Protection Board and each affected data principal, in the form and within the timelines set by the Rules. You cannot do that if your freelancer doesn't tell you quickly — so put a short notification deadline in the contract.

Processors under contract

A fiduciary may engage a processor only under a valid contract. Practically, that contract should say what data the freelancer can access, for what purpose, what security measures apply, how fast incidents must be reported, and that data is deleted or returned at the end.

Children's data

Processing the personal data of children (under 18) generally requires verifiable consent from a parent or lawful guardian, and the Act restricts tracking, behavioural monitoring and targeted advertising directed at children.

What freelancers (data processors) should do

You may not be the one the law holds primarily responsible, but you are the one with your hands on the data. Good practice that clients will value:

1. Use the client's accounts and systems, not copies on your laptop. If you must export data, take the minimum, encrypt it, and delete it when done.
2. Use test or anonymised data for development wherever possible.
3. Secure your own setup: full-disk encryption, a password manager, two-factor authentication on every account, up-to-date software.
4. Don't paste personal data into AI tools or other services unless the client has approved that tool for that data.
5. Report incidents immediately — a lost laptop, a leaked API key, a misdirected email — even if you're not sure it's a breach.
6. Delete data and remove access at the end of the project, and confirm in writing.

When freelancers are fiduciaries too

Freelancers are data fiduciaries for the personal data they collect for their own purposes — for example, enquiries through their website, a newsletter list, or contact details of their own clients. For that data, you need a clear notice, a lawful basis, reasonable security, and a way for people to contact you about their data.

A clause checklist for freelance contracts

Ask your lawyer to cover:

• Description of the personal data and the permitted purpose.
• Instruction to process only on the client's documented instructions.
• Security measures expected (accounts, encryption, two-factor authentication).
• Incident notification within a short period (for example, 24 hours of becoming aware).
• No sub-processing (including AI tools) without approval.
• Deletion or return of data at the end, with written confirmation.
• Cooperation with data principal requests and with any Board inquiry.

Our broader freelance contract checklist shows where this fits.

Cross-border work

The DPDP Act allows the transfer of personal data outside India except to countries the government may restrict by notification. Other sector-specific rules can still impose stricter localisation requirements. If you are an Indian freelancer working on data of people in the EU or UK, the GDPR or UK GDPR may also apply to that work; your client should tell you which obligations flow down to you.

A one-page data-handling note freelancers can send clients

Clients rarely ask, but they appreciate it. Before a project that touches personal data, send a short note covering:

• What I will access: for example, "the order export and customer table in your Shopify admin, through a staff account you create".
• What I will not do: "I will not download customer lists to my own devices or upload them to third-party tools without your written approval."
• How I secure my work: "Encrypted laptop, password manager, two-factor authentication on every account."
• What happens if something goes wrong: "I will tell you within 24 hours of noticing any incident, such as a lost device or a leaked key."
• What happens at the end: "I will delete any working copies and ask you to remove my access, and confirm both by email."

It takes ten minutes to write, it signals professionalism, and it gives the client what they need to meet their own obligations.

Common misconceptions

• "It only applies to big companies." The Act applies to digital personal data processed in India, and to processing outside India connected with offering goods or services to people in India, regardless of business size. Some exemptions exist, but small size alone is not one of them.
• "Business contacts aren't personal data." A named person's work email and phone number are personal data.
• "Consent once means consent forever." People can withdraw consent, and processing based on that consent must then stop within a reasonable time.

How Freelancers India handles this

We are preparing our own Privacy Policy for the DPDP framework. It is currently a draft pending legal review, and we show its version number at signup. Users can delete their account from settings and can contact support about their data. We do not sell personal data.

Frequently asked questions

Does the DPDP Act apply to freelancers?

Yes, in two ways. When you process a client's personal data on their behalf you are usually a data processor working under the client's (the data fiduciary's) responsibility. When you collect personal data for your own purposes — such as your own leads — you are a data fiduciary.

When do the DPDP Rules take effect?

The Rules were published in November 2025 and come into force in phases. Most substantive obligations, including notice, security, breach intimation and data principal rights, apply 18 months after publication.

What is the maximum penalty under the DPDP Act?

The Act's schedule provides for penalties of up to ₹250 crore for a data fiduciary's failure to take reasonable security safeguards to prevent a personal data breach. Other breaches carry different maximums.

Can I use AI tools on a client's customer data?

Only if the client has approved that tool for that data and the tool's terms are appropriate. Otherwise, use anonymised or test data.

Is Freelancers India's privacy policy final?

No. It is a draft pending review by qualified counsel, and we label it that way.

Sources

• Digital Personal Data Protection Rules 2025 (MeitY)
• DPDP Rules, 2025 notified — PIB explainer (November 2025)
• DPDP Rules 2025 — Gazette text (unofficial mirror)