DPDP Act Compliance Roadmap: What Indian Businesses Must Do Before 13 May 2027

What the DPDP Act and Rules actually require

The DPDP Act became law in 2023, and the government notified the detailed Rules in November 2025. The rollout is staggered. The provisions that set up the Data Protection Board took effect straight away, while the core obligations for businesses come into force after an 18-month transition, which ends on 13 May 2027. Until then, the older SPDI Rules of 2011 continue to apply, so there is no gap in the law.

Three terms come up again and again, so it helps to know them:

• Data fiduciary: the business that decides why and how personal data is processed. In most cases, that is you.
• Data principal: the individual whose data it is, such as a customer, employee or app user.
• Data processor: a vendor that handles data on your behalf, such as a cloud provider or a payroll platform.

In everyday terms, the law asks a data fiduciary to do the following:

• Ask clearly: give a plain-language notice that explains what data you collect and why, and get consent that is specific, informed and easy to withdraw.
• Collect only what you need: use data only for the stated purpose and delete it when that purpose is over, unless the law requires you to keep it.
• Protect it: put reasonable security safeguards in place.
• Respect people’s rights: let individuals access, correct and erase their data, and give them a way to raise grievances.
• Take extra care with children: obtain verifiable parental consent before processing the data of anyone under 18.
• Report breaches: tell the Data Protection Board and the affected individuals when personal data is compromised.

The penalties are large enough to get a board’s attention. The Act’s schedule allows fines of up to ₹250 crore for failing to take reasonable security safeguards and up to ₹200 crore for failing to notify a breach.

Does this apply to you?

Most likely, yes. The law covers digital personal data processed in India, and it also reaches businesses outside India that offer goods or services to people in India. That includes SaaS companies, fintechs, edtech platforms, hospitals, e-commerce brands and IT service providers. It also includes a small company with nothing more than a website contact form and an HR database.

A smaller group will be notified as Significant Data Fiduciaries, based on factors like the volume and sensitivity of the data they handle. They face extra duties, such as appointing a Data Protection Officer based in India and arranging independent audits. As of this writing, that list has not been formally notified, but you should not wait for it to start your preparation.

Your six-step DPDP compliance roadmap

Step 1: Find out what data you actually hold

You cannot protect what you cannot see. Start with a simple data inventory: what personal data you collect, where it is stored, why you collect it, who can access it, how long you keep it and which vendors touch it. A spreadsheet is a perfectly good starting point. Include the less obvious places, such as old backups, marketing lists and spreadsheets shared over email.

Step 2: Rewrite your notices and consent flows

Review every place you collect data, including web forms, mobile apps, onboarding screens and offline sign-up sheets. Each one needs a clear notice. Consent should be requested separately for each purpose rather than buried in a long set of terms, and people should be able to withdraw it as easily as they gave it. Keep a record of who agreed to what, and when.

Step 3: Build a process for rights requests and grievances

Decide who receives a request to access, correct or erase data, how you will verify the person, and how quickly you will respond. The Rules set a maximum of 90 days for resolving grievances, so create a simple tracker and an owner for each request.

Step 4: Strengthen your security safeguards

Reasonable safeguards usually mean encryption, role-based access, strong authentication, activity logging and tested backups. The Rules also include a one-year minimum retention requirement for certain logs and data, so confirm the details of Rule 8(3) with your legal advisor. This is also where an independent review of your controls pays off, because it shows whether the safeguards work in practice, not only on paper.

Step 5: Get ready for a breach before it happens

Write an incident response plan and rehearse it. Under the Rules, affected individuals must be told without delay, and the Data Protection Board expects a detailed report within 72 hours. Remember that CERT-In has a separate rule that requires certain cyber incidents to be reported within six hours. Your plan needs to handle both clocks.

Step 6: Update your vendor contracts

You remain responsible for personal data even when a vendor processes it for you. Review contracts with cloud, analytics, payroll, CRM and support providers. Add clauses on security, breach notification, data return or deletion and sub-processors, and ask vendors how they protect your data.

How audits and certifications can help

Frameworks like ISO 27001 and SOC 2 are not the same as DPDP compliance, but they overlap in useful ways. Access control, logging, incident response and vendor management are the backbone of all of them. If you already have these controls working, you have a head start on the security side of the law.

What these frameworks do not cover is the part that is unique to DPDP: consent, notices, individual rights and children’s data. An Information System audit can test whether your technical and operational controls are working, and a privacy-focused review can then fill in the DPDP-specific gaps. Running them together saves your team from collecting the same evidence twice.

Common pitfalls to avoid

• Treating a new privacy policy as the finish line. A policy page does nothing if your forms, systems and vendors behave differently.
• Forgetting legacy data. Old customer lists and archived files count too.
• Leaving vendors out. A processor’s weak security becomes your problem.
• Never rehearsing a breach. The first time you test your plan should not be during a real incident.
• Starting in the last quarter. Consent changes and system fixes take longer than most teams expect.

Where to start

You do not need to do everything at once. Begin with the data inventory, because every other step depends on it. Then work through consent, rights, security, breach readiness and vendors in that order, and leave time at the end to test what you have built.

If you would like an outside view of where you stand, the team at VIES Consulting can review your controls and help you build a practical plan for data protection and privacy. Book an appointment with us to talk through your DPDP readiness.

Frequently Asked Questions

1. What is the DPDP Act?

The Digital Personal Data Protection Act, 2023 is India’s main law on the processing of digital personal data. It sets out how organisations must collect, use, store and protect personal data, and it gives individuals rights over their own data. The detailed DPDP Rules were notified in November 2025.

2. When does DPDP compliance become mandatory?

The Data Protection Board provisions took effect when the Rules were notified in November 2025. The main obligations for businesses, including notice and consent, security safeguards and breach reporting, apply after an 18-month transition, which ends on 13 May 2027.

3. Who needs to comply with the DPDP Act?

Any organisation that processes digital personal data in India must comply. The law also applies to organisations outside India that process data in connection with offering goods or services to people in India. It applies regardless of the size of the business.

4. What is the difference between a data fiduciary and a data principal?

A data fiduciary is the organisation that decides why and how personal data is processed. A data principal is the individual the data relates to. The law places duties on the fiduciary and gives rights to the principal.

5. Do small businesses and startups have to comply?

Yes. The core obligations apply whether you are a startup or a large enterprise. Some provisions, such as those for Significant Data Fiduciaries, apply only to certain organisations, and the Rules provide a limited set of exemptions, but a small business that collects personal data should assume it is covered and confirm any exemption with legal counsel.

6. What are the penalties for non-compliance?

The Act’s schedule sets penalties of up to ₹250 crore for failing to take reasonable security safeguards and up to ₹200 crore for failing to notify a data breach. Other penalty tiers apply for different violations. The Data Protection Board decides the amount after considering factors such as the nature and seriousness of the breach.

7. Is a Data Protection Officer mandatory under the DPDP Act?

Not for every organisation. The requirement to appoint a Data Protection Officer based in India applies to Significant Data Fiduciaries. As of this writing, the government has not formally notified which organisations fall into that category.

8. How quickly must a data breach be reported under the DPDP Rules?

Affected individuals must be informed without delay, and a detailed report must go to the Data Protection Board within 72 hours. Separately, CERT-In requires certain cyber incidents to be reported within six hours, so your response plan should cover both timelines.

9. How is the DPDP Act different from the GDPR?

Both are consent-driven privacy laws, but they differ in scope and detail. The DPDP Act covers digital personal data, relies mainly on consent and a defined list of legitimate uses, and requires a Data Protection Officer only for Significant Data Fiduciaries. The GDPR has a broader set of lawful bases and applies more obligations to all organisations. If you serve customers in both regions, you will need to meet each law’s requirements.

10. Can ISO 27001 or SOC 2 make us DPDP compliant?

Not on their own. They help with security safeguards, access control, logging and incident response, which overlap with DPDP requirements. They do not fully address consent, notices, individual rights or children’s data, so you will need DPDP-specific measures on top.