DPDP Act 2024: A Plain-English Implementation Guide for Indian Companies
The Digital Personal Data Protection Act 2024 is live. This plain-English guide tells Indian companies exactly what they need to do to comply.
An overview of India's BRSR framework — who must report, what data is required, and how to build a compliant BRSR disclosure.
Business Responsibility and Sustainability Reporting (BRSR) is now mandatory for India's top 1,000 listed companies by market capitalisation under SEBI's Listing Obligations and Disclosure Requirements. For financial year 2024-25 onwards, the BRSR Core is subject to reasonable assurance for the top 150 companies — meaning the data you report must be independently verified.
This guide covers what BRSR requires, where companies most commonly fail, and how to build a reporting process that holds up to assurance.
BRSR is organised around nine principles of the National Guidelines for Responsible Business Conduct (NGRBC):
The BRSR Core is a subset of key performance indicators that are subject to reasonable assurance for top companies. These are the data points you need to treat with the highest rigour:
Environment: Scope 1 and Scope 2 GHG emissions with intensity ratios. Total energy consumption broken down by source. Water consumption and discharge. Waste generated and managed. Air emissions for relevant industries.
Social: Total employees and contract workers, with gender breakdown. Median wages for employees and workers. Employee benefits coverage. Health and safety incident rates. Training hours per employee. Turnover rates by gender and category.
Governance: Board composition with diversity breakdown. Percentage of spending on locally sourced goods. Corrective action on supply chain audits. Complaints from customers, employees, and communities.
The single biggest challenge for most companies is data collection — specifically for environmental metrics and for supply chain data. Most companies don't have systematic processes to capture energy consumption by source, water usage by facility, or waste data by category and disposal method.
Building these collection systems takes 3–6 months. If your next BRSR report deadline is in the annual report for FY 2025-26, you need to start data collection now — because you'll need 12 months of data.
BRSR's Principle 2 requires disclosure on sustainable sourcing and supply chain responsibility. For top 1,000 companies, this means you're expected to extend your ESG assessment into your supplier base. SEBI has indicated that this cascade expectation will increase over time — making BRSR relevant not just to listed companies but to their key suppliers.
Chabil Consulting supports listed Indian companies with BRSR reporting, data collection systems, and assurance preparation. Our BRSR programme runs 8–12 weeks and produces audit-ready data and a complete disclosure. Contact us at hello@chabilconsulting.com.
The Digital Personal Data Protection Act 2024 is live. This plain-English guide tells Indian companies exactly what they need to do to comply.
CSRD Wave 1 is live. The materiality assessment is the foundation of your disclosure. Here's how to do it properly — step by step
An exploration of why Scope 3 supply chain emissions are so difficult to measure accurately, and the practical steps companies can take to improve data quality.
Related topics
Want to discuss this topic?
Our advisors are available for a no-obligation conversation.