DPDP Readiness: What Indian Businesses Must Do Before the Rules Fully Apply

Most founders and finance heads we speak to in Chennai know the DPDP Act exists. Ask what it actually needs from their business, though, and the answer usually trails off. That's fair. The law was passed in August 2023 and then sat quietly for two years, waiting for its rules.

The wait is over. The DPDP Rules were notified in November 2025, and the obligations that really matter switch on on 13 May 2027. That still sounds a long way off. It isn't. It's about seven months from now, roughly one budget cycle, and changing how a company collects consent, keeps logs and handles a breach always takes longer than people plan for.

So here's our plain-language take: what the law asks, where the dates sit, where businesses tend to slip, and what we'd do if we were starting this week.

What does the DPDP Act actually ask of you?

Take away the legal wording and DPDP comes down to a few habits. None of them are exotic. Most good companies already do some of them, just not consistently or on paper.

  • Tell people what you collect and why. Before you take someone's data, give them a short, clear notice. Not a twelve-page policy nobody reads.
  • Ask properly. Consent has to be for a specific purpose. No pre-ticked boxes, no bundling five purposes into one "I agree". And withdrawing it should be as easy as giving it.
  • Keep it safe. The Rules call this "reasonable security safeguards": encryption, access control, monitoring, backups. Processing logs need to be kept for at least a year.
  • Own up fast when something breaks. A breach has to be reported to the Data Protection Board and to the people affected, with a detailed report to the Board within 72 hours.
  • Answer people when they ask. Individuals can ask to see, correct or erase their data, or raise a complaint. You have 90 days at most to resolve a grievance.
  • Be careful with children's data. Anyone under 18 needs verifiable consent from a parent or guardian, for example checked through DigiLocker.

Two things catch people off guard. First, there's no small-business exemption for the core duties. A 20-person clinic is covered just like a large bank. Second, the law reaches outside India. A foreign SaaS company selling to Indian customers can fall within it.

A few large players will be named Significant Data Fiduciaries. They carry extra weight: an India-based Data Protection Officer, an independent data auditor and regular impact assessments. Everyone else should still assume the basics apply to them.

One piece of good news: there's no blanket data localisation. Data can move abroad unless the government blacklists a particular country. Keep a clear map of where your data goes, though, because that list can change.

When do the DPDP rules apply?

The law isn't switching on all at once. It's coming in three steps, and we're sitting between the first and second right now.

  • 13 November 2025: already in force. Definitions and the rules for the Data Protection Board.
  • 13 November 2026: Consent Managers. The Board can start registering consent platforms.
  • 13 May 2027: core duties apply. Notice, consent, security, breach reporting, individual rights, and penalties of up to ₹250 crore.

The first step was mostly scaffolding. It set up the Data Protection Board on paper and put the definitions in place. The Board itself still isn't fully staffed. The ministry invited applications for a chairperson and four members in May 2026, and as of mid-October no appointments had been announced.

The second step lets the Board register Consent Managers. These are platforms people can use to give, track and withdraw consent across companies. Most businesses won't become one. But if your product or app might plug into one, now is the time to check your consent setup can talk to it.

The third step is the one that counts. That's when the duties listed above apply in full, along with the penalties. The old IT Act privacy rules (the SPDI Rules of 2011) keep running until then, so there's no gap in the meantime.

One small update worth knowing: on 5 October 2026 the government issued a Removal of Difficulties Order. It fixed some wording in the sections on children's data and on audits for Significant Data Fiduciaries. It doesn't add new duties, so treat it as a tidy-up, not a reason to rework your plans.

Where do businesses usually slip?

The trouble is rarely the big, obvious system. It's the stuff nobody owns.

Picture a 60-person clinic. Patient records sit in the main software, and that part is fairly locked down. But appointment reminders go out through a WhatsApp tool someone signed up for in 2022. Old lab reports live in a shared drive. The marketing team exported a patient list for a camp last year and never deleted it. None of this is malicious. All of it is in scope.

These are the gaps we see again and again:

  • Nobody knows where all the data is. Spreadsheets, inboxes, backups and third-party tools hold far more personal data than the main system.
  • Consent was "handled" years ago. A single tick box on a sign-up form, covering everything, with no record of who agreed to what.
  • Vendors aren't covered. Payroll, CRM, cloud hosting, call centres. If they process your customers' data, your contract with them needs to say how.
  • Logs get overwritten. Plenty of systems keep 30 or 90 days of logs by default. The Rules expect at least a year.
  • There's no breach drill. People assume they'd know what to do. Then it's 11 pm on a Friday and nobody knows who calls whom.
  • Old data never leaves. Former customers, rejected job applicants, ex-employees. If there's no reason to keep it, it shouldn't be there.

What would we do if we were starting this week?

You don't need a giant programme to get going. You need someone in charge and a sensible order of work. Here's the order we'd follow.

  1. Name an owner. One person who's accountable, with backing from leadership. Without that, DPDP becomes everyone's side job and nobody's priority.
  2. Map your data. List what personal data you hold, where it sits, who touches it and why. Include the spreadsheets and the vendor tools. This is the slowest step and everything else depends on it.
  3. Fix the front door. Rewrite your privacy notices in plain language. Rebuild consent so it's purpose-by-purpose, recorded, and easy to withdraw.
  4. Tighten security and logging. Check encryption, access rights and backups. Make sure logs are kept for at least a year.
  5. Sort out your vendors. Update contracts so every processor knows what it can and can't do with your data, and must tell you fast if something goes wrong.
  6. Set up a way to handle requests. A simple inbox or ticketing flow for access, correction, erasure and complaints, with the 90-day clock tracked.
  7. Rehearse a breach. Run a tabletop exercise. Who spots it, who decides, who writes to the Board, who tells customers. Do it before you need it.
  8. Clean out old data. Set retention periods by data type and delete what's past its date.
  9. Train your people. Short, practical sessions for the teams that actually handle customer data: front desk, sales, support, HR.

If that looks like a lot for seven months, it is a fair amount. Steps 1 and 2 are where to put your energy in the next few weeks. Get those right and the rest moves much faster.

How big are the DPDP penalties?

The fines are large enough that they tend to end the conversation about whether this is worth doing. These are the maximums the Board can impose:

  • ₹250 crore for failing to keep data reasonably secure, leading to a breach
  • ₹200 crore for not reporting a breach to the Board and affected people
  • ₹200 crore for breaking the rules on children's data
  • ₹150 crore for a Significant Data Fiduciary missing its extra duties
  • ₹50 crore for any other breach of the Act or Rules

These are ceilings, not fixed amounts. The Board is meant to weigh how serious the breach was, how long it lasted and what you did to fix it. That last part matters. A company that can show a real effort, with records to back it up, is in a very different position from one that did nothing.

The less visible cost is the rush. Teams that leave it to April 2027 end up rewriting forms, renegotiating vendor contracts and reworking systems all at once, under pressure. That's when mistakes creep in. Starting now is simply cheaper.

How can Indiquer help?

Our sister company Indiquer GRC helps companies get audit-ready without drowning in paperwork. A compliance tool and a template only go so far if nobody knows where the data actually lives.

Our team works alongside yours. We do the data mapping, review your notices and consent flows, check vendor contracts, test your security and run the breach drill with you. If you're also working towards ISO 27001, SOC 2 or HIPAA, a lot of that effort overlaps, and we'll plan it so you don't do the same work twice. And because Indiquer builds and runs software too, we can help fix the systems, not just write a report about them.

If you'd like a straight answer on where you stand, write to us at [email protected] or call +91 78068 21856. We'll start with a short conversation and an honest view of what you need, and what you don't.

This article is general guidance, not legal advice. For decisions specific to your business, speak to a qualified lawyer.

Sources

Read more articlesTalk to our team