The DPDP Act 2023: a plain guide for coaches and counsellors

India's Digital Personal Data Protection Act, 2023 applies to any practice that keeps clients' personal data digitally, including a spreadsheet. This is a plain summary, not legal advice.

The basics

You are the Data Fiduciary: you decide why and how your clients' data is used.
Consent should be free, specific, informed, unambiguous and given by a clear action, such as ticking a box that is not pre-ticked.
Notice: tell people what you collect and why, in clear language.
Withdrawal must be as easy as giving consent.
Children: for anyone under 18, verifiable consent from a parent or guardian is needed.
Rights: people can ask for a summary of their data, correction, erasure, and can nominate someone to act for them.
Breaches must be reported to the Data Protection Board and to affected people.
Penalties can be large, up to ₹250 crore for some failures.

What your software should do

Record consent per purpose, with the date and the notice shown.
Stop marketing to anyone who withdrew, automatically.
Limit who on your team can see contact details.
Let you export and delete data on request.
Avoid tracking people without telling them.

How CoachKeep helps

CoachKeep records consent per purpose with its source and notice version, re-checks it before every marketing email, masks contact details from staff who do not need them, keeps each practice in its own database, keeps an audit trail, does not track email opens or clicks, and provides a default privacy notice for each practice to adapt.

Try CoachKeep

₹1,999 a month for the whole practice, with up to 3 team seats. Founding practices pay ₹1,199 a month, paid quarterly. No GST is charged, and there is no lock-in. Book a 30-minute walkthrough or message +91 91744 55550 on WhatsApp.

More guides

Last updated 5 November 2026. Questions? Support.