DPDP Act 2023 · DPDP Rules 2025
India’s Digital Personal Data Protection Act becomes fully enforceable in May 2027, and most of what it asks for is operational: knowing where personal data sits, keeping it safe, telling the Board and the people affected when something goes wrong, and answering requests on time. P J Networks delivers DPDP compliance services in India as an operator rather than a paper exercise — we run the discovery, the controls and the breach response on the PrahiX Data Protection Console, and hand your DPO the evidence.
ISO/IEC 27001:2022 certified · NOC and SOC in Mayapuri, New Delhi · operating enterprise security since 2002
The DPDP implementation timeline
The Digital Personal Data Protection Rules, 2025 were notified in November 2025 and phase the Act in over eighteen months. The Data Protection Board provisions took effect at once. Registration of Consent Managers — the regulated intermediaries that let people give and withdraw consent across many businesses — follows twelve months later. Everything a typical Data Fiduciary has to do, along with the penalty regime, lands at eighteen months, in May 2027.
Scroll the timeline sideways on a phone →
Two developments are worth knowing about. In January 2026 MeitY consulted stakeholders on compressing parts of the timeline to twelve months, particularly for Significant Data Fiduciaries; as of October 2026 no amendment has been notified, so May 2027 stands. And in October 2026 MeitY issued a Removal of Difficulties Order under section 43, correcting the drafting of sections 9 and 10; it did not move any deadline.
Eighteen months sounds generous until you count what it contains. A first discovery scan typically finds personal data in places nobody had listed — Downloads folders, old shares, exports in sent mail — and every one of those becomes a policy, an erasure task or a register entry. Organisations that start in 2027 will be doing that clean-up under the penalty regime rather than before it.
Dates are stated as months because official sources differ by a day on the notification date. Monitor MeitY and the Gazette for changes.
What the DPDP Act actually requires of a Data Fiduciary
Strip the law down and it asks a Data Fiduciary — anyone who decides why and how personal data is processed — for eleven things. Each one below is mapped to its source in the Act or the Rules, and to the operational work that satisfies it. This is the mapping we use in a gap assessment.
| Obligation | Source | What does the work |
|---|---|---|
| Lawful processing — consent or a legitimate use | Act s.4, s.6, s.7 | A processing register that records the purpose and lawful basis of every activity, and flags data found on machines that no activity explains |
| A notice itemising the data and its purpose, in English or an Eighth Schedule language | Act s.5; Rule 3 | Versioned consent and employee notices, with acknowledgement tracking and translations |
| Consent that is free, specific and as easy to withdraw as to give | Act s.6 | A hash-chained consent ledger, a Consent API for your website and apps, and withdrawal cases that drive erasure |
| Reasonable security safeguards | Act s.8(5); Rule 6 | Encryption and access control reviews, data loss prevention, monitoring for unauthorised access, and logs kept for at least a year |
| Processors only under a valid contract | Act s.8(2); Rule 6 | A processor register with contract-clause checklists and review dates |
| Breach notice to the Board and each affected person | Act s.8(6); Rule 7 | Breach clocks, report drafts with required fields, and approved notices in English and Hindi |
| Erase when the purpose ends or consent is withdrawn | Act s.8(7); Rule 8 | Erasure tasks with proof of deletion, retention floors and legal holds |
| A published contact for data protection questions | Act s.8(9); Rule 9 | DPO and privacy team designations, and a public trust centre |
| Access, correction, erasure, grievance and nomination | Act s.11–14; Rule 14 | Rights requests with due dates inside your published period (no more than 90 days for grievances) |
| Children’s data: verifiable parental consent, no tracking | Act s.9; Rule 10 | Child-consent records, register flags and DPIAs for risky processing |
| Significant Data Fiduciaries: DPIA and audit every 12 months | Act s.10; Rule 13 | DPIA workflow and a sealed evidence pack for the auditor |
Scroll to see the full table →
Notice how little of that list is legal drafting. The notice text and the lawful-basis decisions need counsel; almost everything else is finding data, controlling it, watching it and keeping records. That is security operations work, which is why we deliver it from the same security operations centre that runs our managed detection.
Our DPDP compliance services
Six services, usually delivered in this order. You can take the assessment on its own, or have us operate the whole programme alongside your DPO. Every engagement is scoped so that the decisions stay with you and the operational load moves to us.
DPDP readiness & gap assessment
A structured review of your processing against every obligation above, sector by sector, ending in a scored gap list and a dated plan to May 2027 — not a 200-page report.
- Processing activities and lawful basis
- Notices, consent and withdrawal
- Security safeguards against Rule 6
- Breach and rights readiness
Personal data discovery & mapping
We scan laptops, servers, file shares, sent mail and databases for 14 Indian identifiers and build the inventory your processing register is checked against.
- Aadhaar, PAN, GSTIN, passport, voter ID
- Bank account, IFSC, UPI ID, card
- Mobile, email, date of birth, DL
- Risk score 0–100 per file
Consent management
A consent ledger, versioned notices and a Consent API your website, app, branches or CRM can call — plus a self-service portal where people withdraw as easily as they agreed.
- Hash-chained consent records
- Notices in 22 Eighth Schedule languages
- Withdrawal cases that drive erasure
- Historic consent import by CSV
DLP & security safeguards
Data loss prevention on twelve channels, starting in monitor mode so nothing is blocked until you have seen what the policy would do.
- Browser upload, paste and download
- Email, Outlook add-in, USB, print
- Clipboard, sync folders, archives
- Allow, warn, ask the DPO, or block
Breach response & notification
Breach clocks that start when you become aware, report drafts for the Board, CERT-In and your sector regulator, and approved notices to affected people — run with our incident response team.
- CERT-In 6-hour report
- Board and data principals without delay
- Board detailed report at 72 hours
- RBI, SEBI or IRDAI where they apply
Rights, erasure & evidence
Access, correction, erasure and grievance requests tracked to their due dates, erasure with proof, and a sealed evidence pack your auditor or the Board can verify later.
- Person search across files and databases
- Deletion records and legal holds
- 62 DPDP controls, scored
- SHA-256 sealed evidence packs
Breach handling runs with our incident response retainer; leakage controls build on our DLP practice.
The DPDP compliance software we run: PrahiX Data Protection Console
Spreadsheets and policy templates can describe a DPDP programme; they cannot tell you that a KYC export with 1,250 customers is sitting in someone’s Downloads folder, or stop it being uploaded to personal mail. For that we deploy the PrahiX Data Protection Console, the DPDP edition of the PrahiX platform. It runs on the same endpoint agent and on-site log collector used for monitoring and EDR, so there is no second agent to roll out.
Discover
Where is our personal data? Personal data files, client list matching, file shares, sent mail, databases.
Monitor
Is it leaving, and are our controls working? Triage, data movement, control health, agents, Outlook add-in.
Govern
What are the rules, and are they written down? Policies, exceptions, employee notice, offboarding, processing register, retention, consent, processors, DPIA.
Respond
Can we meet each statutory clock? Breaches, rights requests, consent withdrawals, erasure, government requests.
Report
Can we prove it? Control scorecard, evidence pack, DPO digest, integrations, messages, training.
Settings
Who does what, and how do we reach people? Company profile, DPO and privacy team, access log, Consent API, messaging, portal, trust centre.
Built so the compliance tool does not become a second copy of your data
- File contents never leave the machine. The console receives counts, identifier kinds and at most three masked samples, such as XXXXX1234X — never full values, message bodies or clipboard text.
- Three views of the same finding. The DPO and privacy team see full detail, other administrators see it masked, and analysts work with stable pseudonyms; every reveal needs a written reason and is logged.
- A tamper-evident access log. Every view, export and change is written to a hash-chained log before the data is shown. If the log is unavailable, nothing is shown.
- Customer lists stay blind. Values are blinded in your browser before upload, so machines match against hashes, not your client list.
- Signed instructions only. Policy bundles and erasure lists are signed with offline keys and checked on each machine before use.
- Hosted in India. Data is stored in India, which keeps residency simple for regulated sectors.
Identifiers are validated, not just pattern-matched: an Aadhaar number must pass its Verhoeff check digit, a card its Luhn check, and weaker formats such as bank accounts or voter IDs only count near a supporting keyword. That keeps the false-positive rate low enough for a DPO to trust the inventory. Endpoints covered are Windows, Linux and macOS, with a Chromium browser extension and an Outlook add-in for Microsoft 365.
One incident, four clocks: DPDP breach notification and CERT-In
The rule that catches organisations out is not the 72-hour report — it is that several obligations start on the same incident, from slightly different moments, with different content. A ransomware event that touches customer records is a CERT-In incident and a DPDP personal data breach at once, and for a bank, broker or insurer it is a sector-regulator event too. Unlike GDPR, DPDP has no risk threshold: every personal data breach is notifiable.
| Who you tell | Deadline | Clock starts | Source and content |
|---|---|---|---|
| CERT-In | 6 hours | From noticing the incident | CERT-In Directions of April 2022; applies to reportable cyber incidents whether or not personal data is involved |
| Data Protection Board — intimation | Without delay | From becoming aware of the breach | DPDP Rules, Rule 7(2)(a): description, nature, extent, timing and likely impact |
| Affected Data Principals | Without delay | From becoming aware of the breach | Rule 7(1): plain-language notice of what happened, the consequences, mitigation and a contact |
| Data Protection Board — detailed report | 72 hours | From becoming aware, or longer if the Board allows in writing | Rule 7(2)(b): facts, cause, mitigation, the person responsible if known, remedial action and notices sent |
| Sector regulator | Per regulator | As each framework defines it | RBI, SEBI and IRDAI each run their own reporting obligations for regulated entities |
Scroll to see the full table →
Meeting all of these depends on two things that have nothing to do with legal drafting: detecting the breach quickly enough that the clocks are still worth having, and knowing within hours which people’s data was on the affected machines. The first is a SOC problem and the second is a data-discovery problem. We solve both in the same place, so the console opens a breach with its clocks running and a list of affected machines already attached. Our cyber incident reporting guide covers the CERT-In side in detail.
DPDP compliance checklist: twelve steps before May 2027
This is the order we work in, and it is a sensible order for anyone doing it themselves. The first three steps are where most programmes stall, because they are where the real estate turns out to differ from the documented one.
- Name an ownerDesignate a DPO or data protection lead and the privacy team, and publish a contact for data protection questions.
- Map your processingList every processing activity with its purpose, lawful basis, data categories, systems, processors and retention.
- Find the personal dataScan endpoints, shares, mail and databases, and compare what you find with what the register says.
- Fix the noticesRewrite customer and employee notices to itemise data and purposes, with an Eighth Schedule language option.
- Make consent provableRecord consent per purpose against the notice version shown, and make withdrawal as easy as giving it.
- Apply security safeguardsEncryption, access control, monitoring and backups mapped to Rule 6, with logs retained for at least a year.
- Control data leavingPut DLP on the channels that matter, in monitor mode first, then enforce one policy at a time.
- Rehearse a breachRun a tabletop that hits the CERT-In 6-hour, Board and 72-hour clocks on one scenario, with drafts ready.
- Open the rights channelSet a published response period, an escalation point, identity checks and a way to find one person’s data.
- Set retention and erasureDefine retention per data class, respect legal minimums and holds, and erase with proof when the purpose ends.
- Paper your processorsPut every vendor that handles personal data under a contract with the right clauses, and review it.
- Collect the evidenceKeep a scored control list and a sealed evidence pack you could hand the Board tomorrow.
Want this scored against your own estate? That is exactly what the readiness assessment produces.
How a DPDP engagement runs
Discovery workshop
We map your sector, regulators, systems and the machines to cover, and agree what is in scope. This is where the gap assessment starts.
Monitor-mode pilot
The console runs on a pilot group with every policy in monitor mode. You get a first personal-data inventory and a baseline compliance score without blocking anyone.
Full coverage, then enforce
All machines, file shares, mail and databases are brought in, and policies move from monitor to enforce one at a time as their impact is understood.
Readiness review
A control-scorecard review with your DPO and the first sealed evidence pack — the record you would show the Board.
DPDP compliance by sector
The Act is sector-neutral, but the work is not. Who else you report to, how long you must keep records, and where personal data accumulates all change by industry.
Banks, NBFCs and fintech
KYC files are usually the largest store of Aadhaar and PAN data, and retention collides with PMLA record-keeping duties. Breach handling has to satisfy RBI alongside the Board — see RBI cyber security compliance.
Stock brokers and market intermediaries
Client data spreads through back-office exports and dealer machines, and SEBI’s cyber framework sets its own logging and reporting expectations — see SEBI CSCRF compliance.
Insurance
Proposal forms and claims carry health and financial details that raise a file’s risk even where they are not identifiers in themselves. IRDAI reporting runs in parallel — see IRDAI cyber security compliance.
Hospitals and healthcare
Patient records, scanned ID documents and lab reports on shared workstations make discovery and access control the first priorities — read our note on protecting patient data under DPDP.
Schools, colleges and edtech
Most students are children under the Act, so verifiable parental consent and the ban on tracking and targeted advertising at children apply from May 2027.
Startups, e-commerce and manufacturing
Startups need consent built into the product early; large e-commerce platforms face inactivity erasure with 48 hours’ notice; manufacturers mostly hold employee and dealer data, which still needs safeguards and retention limits.
DPDP vs GDPR: what changes if you already comply with GDPR
Indian companies with European customers often assume their GDPR programme covers DPDP. It is a strong head start, but five differences mean the programme needs re-mapping rather than re-use.
| Point | GDPR | DPDP Act |
|---|---|---|
| Lawful basis | Six bases, including legitimate interests | Consent, or a defined list of legitimate uses (s.7) — no general legitimate-interests basis |
| Sensitive data | Special categories with extra conditions | No separate category; risk is handled through safeguards and SDF designation |
| Breach notification | Unless unlikely to result in a risk to people; 72 hours to the authority | Every personal data breach; Board and people without delay, detailed report in 72 hours |
| Penalties | Up to 4% of worldwide turnover or €20m | Fixed caps per instance, up to ₹250 crore |
| Data Protection Officer | Required on defined criteria | Required only for Significant Data Fiduciaries; others publish a contact |
Scroll to see the full table →
What we will not tell you
The DPDP market is young and some of what is being sold does not hold up. Three things worth knowing before you choose any provider, including us.
- There is no DPDP certification for companies.Neither the Act nor the Rules creates one. A “DPDP certified” badge is the issuing firm’s attestation, not a regulatory status, and it does not move your accountability. Ask what evidence sits behind it.
- Software does not make you compliant on its own.Tools find, control and record. Purposes, notices, lawful-basis decisions and breach filings are yours, and the notice text needs your counsel. We are a security operator, not a law firm, and we work alongside your lawyers rather than instead of them.
- A policy pack without discovery is a guess.A register written from interviews alone tends to miss data, because personal data accumulates where nobody decided to put it. Discovery first, paperwork second.
DPDP compliance, answered
What is DPDP compliance?
DPDP compliance means meeting the obligations of India’s Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. For a business acting as a Data Fiduciary, that is: a lawful basis for every use of personal data, a clear notice, consent that can be withdrawn as easily as it was given, reasonable security safeguards, breach notification to the Data Protection Board and to affected people, honouring access, correction and erasure requests, erasing data once its purpose is over, and keeping the records that prove all of it.
What is the full form of DPDP?
DPDP stands for Digital Personal Data Protection. The law is the Digital Personal Data Protection Act, 2023, often shortened to the DPDP Act or DPDPA, and its operating detail is in the Digital Personal Data Protection Rules, 2025.
When does the DPDP Act apply? What is the implementation date?
The DPDP Rules were notified in November 2025 with an 18-month phase-in. The Data Protection Board provisions applied immediately, Consent Manager registration follows in November 2026, and the substantive obligations on Data Fiduciaries — notice, consent, security safeguards, breach notification, data principal rights, retention and penalties — apply from May 2027. MeitY floated a shorter 12-month window for some obligations in January 2026, but as of October 2026 no amendment has been notified.
What is the penalty under the DPDP Act?
Penalties are set by the Schedule to the Act and are per instance, up to: ₹250 crore for failing to take reasonable security safeguards to prevent a breach; ₹200 crore for failing to notify a breach; ₹200 crore for breaching the obligations on children’s data; ₹150 crore for a Significant Data Fiduciary’s additional obligations; and ₹50 crore for any other breach. The Data Protection Board decides the amount, taking into account factors such as the nature, gravity and duration of the breach and the steps taken to mitigate it.
What is the DPDP breach notification timeline?
Under Rule 7 you must tell the Data Protection Board and each affected Data Principal without delay once you become aware of a personal data breach, then send the Board a detailed report within 72 hours, or a longer period if the Board allows it on written request. Separately, CERT-In’s 2022 Directions require reportable cyber incidents to be reported within 6 hours of noticing them. Both clocks can run on the same incident, so plan for both.
Is there a DPDP certification for companies?
No. Neither the Act nor the Rules creates a certification scheme for organisations. A certificate sold as “DPDP certified” is an attestation by the firm that reviewed you, which can be useful evidence, but it is not a regulatory status and it does not shift your accountability. What the law does expect is that you can show the Board what you did — which is why we focus on evidence rather than certificates.
Do we need to appoint a Data Protection Officer?
Only a Significant Data Fiduciary must appoint a Data Protection Officer based in India. Every other Data Fiduciary must publish the business contact of a person who can answer questions about its processing of personal data. In practice most mid-sized companies designate someone anyway, because the role needs an owner; we support that person with the tooling and the operational work.
Does the DPDP Act cover employee data?
Yes. Employee personal data is digital personal data like any other. The Act lets an employer process it without fresh consent for employment purposes, as a legitimate use under section 7, but security safeguards, breach notification, retention limits and data principal rights still apply. HR spreadsheets on laptops and file shares commonly turn up in a first discovery scan.
How is DPDP different from GDPR?
The two overlap but are not interchangeable. DPDP relies on consent or a defined list of legitimate uses rather than GDPR’s six lawful bases, including legitimate interests; it does not create a separate class of sensitive personal data; every personal data breach is notifiable, with no risk threshold; and penalties are fixed rupee caps rather than a percentage of turnover. A GDPR programme is a strong starting point, but it needs re-mapping rather than re-use.
What does DPDP compliance cost in India?
It depends on how many machines, file shares, mailboxes and databases hold personal data, which sector regulators apply, and how much of the programme you want operated for you. We do not publish a rate card, because a figure quoted before anyone has seen your estate is a guess. A readiness assessment gives you a scoped number, and the pilot that follows produces your first personal-data inventory and baseline compliance score before you commit to a full rollout.
Is software enough to be DPDP compliant?
No. Software can find personal data, enforce policy, run the statutory clocks and produce evidence, but someone has to decide purposes, approve notices, authorise breach reports and answer to the Board. The console supports a compliance programme; it is not legal advice and it does not replace your counsel. That split — tooling and operations from us, decisions and accountability with you — is how we scope every engagement.
For the wider picture of Indian regulation, see our guide to cybersecurity compliance in India and our compliance services, including ISO 27001 and PCI DSS. If you need a part-time security lead to own the programme, our virtual CISO service covers that.
Start before the clock does
Book a DPDP readiness assessment
Tell us your sector, your regulators and roughly how many machines and systems hold customer or employee data. We will come back with a scoped assessment, a pilot plan and a dated route to May 2027 — and if you are further along than you think, we will say so.
P J Networks Pvt Ltd · Mayapuri, New Delhi · +91 98183 61787