Skip to content
SecuriFii

Data protection law

DPDP Act Compliance for Indian Companies

The DPDP Act is law, its Rules are notified and the Data Protection Board of India exists. What has not yet commenced is the part that asks anything of you. We use the runway to find your personal data, decide who is responsible for it, and build the processes the Act will test — so that compliance is something you can demonstrate rather than something you assert.

Discuss this
Standard
DPDP Act, 2023 · DPDP Rules, 2025
Rules notified
13 Nov 2025
Duties commence
13 May 2027
Maximum penalty
₹250 crore

What the DPDP Act actually requires

The Digital Personal Data Protection Act, 2023 governs the processing of digital personal data. It received assent on 11 August 2023. On 13 November 2025 the Central Government notified the Digital Personal Data Protection Rules, 2025, appointed the dates on which the Act’s sections commence, and established the Data Protection Board of India. Definitions and the Board took effect that day. The Consent Manager provisions follow one year later, on 13 November 2026, and the duties that bind ordinary organisations — notice, consent, security safeguards, breach intimation, data principal rights, children’s data and the additional duties of Significant Data Fiduciaries — commence eighteen months after notification, on 13 May 2027. MeitY consulted in January 2026 on moving the main compliance date from 13 May 2027 to 13 November 2026, but as of 6 October 2026 no notification making that change has been published.

The Act calls the organisation that decides why and how personal data is processed a Data Fiduciary, and the one processing on its behalf a Data Processor. The duties sit with the Data Fiduciary, which remains responsible for what its processors do. The Rules then make those duties concrete: what a notice must contain, which security safeguards are the minimum, how a breach is intimated to the Board and to each affected person, how long personal data and logs must be kept, and how quickly grievances must be answered.

There is no certificate at the end of this. The Act provides for none, and no consultancy, auditor or certification body can issue one. Whether you comply is decided by the Data Protection Board when it inquires into a breach or a complaint. What you can build is evidence: records that show what you hold, why, and how you protect it, kept current enough that producing them is routine rather than an excavation.

What it will ask of you

Each of these is a duty under the Act or the Rules from 13 May 2027, and each is something the Board can ask you to show.

  • Knowing what personal data you hold

    Every notice, consent, retention decision and breach intimation depends on knowing what personal data you process, where it came from, where it flows and who processes it for you. In most organisations that is a discovery exercise before it is a compliance one.

  • Notice and consent that stand on their own

    A notice that is understandable independently of anything else you have published, a request for consent in clear and plain language, and a way to withdraw consent that is comparable in ease to giving it.

  • Security safeguards the Rules name

    Rule 6 sets a minimum: encryption, obfuscation, masking or tokenisation; access control; logging and monitoring that can detect unauthorised access; backups for continued processing; logs kept for a year; and security terms in your processor contracts.

  • Breach intimation on two tracks

    On becoming aware of a personal data breach, tell each affected person without delay and intimate the Board without delay, then send the Board a detailed report within seventy-two hours. There is no risk threshold for telling the people affected.

  • Rights, grievances and children

    Published means for people to exercise their rights, a contact who can answer questions about your processing, grievances answered within a period you publish of no more than ninety days, and verifiable parental consent before processing the data of anyone under eighteen.

Why it is worth starting now

  • The longest task — finding the personal data — cannot be compressed into the final quarter before 13 May 2027.
  • Notice, consent and withdrawal mechanics are product changes with a release cycle, and they cannot be specified until the data is mapped.
  • Penalties under the Schedule reach ₹250 crore for a failure of security safeguards and ₹200 crore for a failure to intimate a breach, per breach found.
  • Rule 6 requires security safeguards in the contract between a Data Fiduciary and its Data Processor, so processors will be asked to show theirs — and the same records answer both.
  • The same records, risk work and breach process carry over to ISO/IEC 27701 and the GDPR.

Not sure this is the standard you need?

Tell us what triggered the question — a customer, an auditor, a contract clause — and we will say which of these applies, including when the answer is none of them.

Ask a practitioner

Where we come in, and where we stop

There is no DPDP certificate for anyone to issue, and we will not imply one. The Data Protection Board of India decides whether a Data Fiduciary has complied. If the Central Government notifies you as a Significant Data Fiduciary, the Act also requires you to appoint an independent data auditor to evaluate your compliance, and the Rules require a Data Protection Impact Assessment and an audit every twelve months with a report of significant observations to the Board. We will prepare you for that audit. We will not be the auditor of a programme we built.

Ours

  • Finding and mapping the personal data you hold, and where it flows
  • Deciding Data Fiduciary and Data Processor roles per processing activity
  • Notices, consent and withdrawal mechanics, written with your product team
  • Security safeguards and log retention against Rule 6
  • The breach intimation runbook, rehearsed before it is needed
  • Rights and grievance handling, and a DPIA method if you are designated

The Board, and an independent data auditor

  • The Data Protection Board of India — inquiring into breaches and complaints, and deciding penalties
  • For a Significant Data Fiduciary, an independent data auditor carrying out the annual data audit and reporting significant observations to the Board
  • Legal advice on how the Act applies to you, from a lawyer who practises it

How an engagement runs

There is no certification step at the end, because the law has none. The end point is a programme that operates, with the records to show it.

  1. 01Discovery and data mappingWe find the personal data — in product databases, support tools, analytics, logs, spreadsheets and backups — and record what it is, where it came from, where it goes and who processes it for you, including outside India.
  2. 02Roles and gap assessmentFor each processing activity we settle whether you are the Data Fiduciary or a Data Processor, then measure current practice against the Act and the Rules. You get a gap register with an owner and an effort estimate per line.
  3. 03Notice, consent and product changesWe write the notices and consent requests with your product and engineering teams, including withdrawal, and the verifiable parental consent flow if any of your users may be under eighteen.
  4. 04Safeguards and retentionWe map Rule 6’s minimum safeguards to the controls you have, close the gaps, and set retention so that personal data, traffic data and logs are kept for the one-year minimum and erased when the purpose is served.
  5. 05Breach and rights processesA breach runbook that meets both intimation tracks, with templates drafted calmly in advance, and a rights and grievance process with published timelines. Then a tabletop exercise, because a procedure nobody has rehearsed is not yet a procedure.
  6. 06Evidence and upkeepWe assemble the evidence pack and set the review cycle that keeps it current. If you are notified as a Significant Data Fiduciary, we prepare the DPIA and support you through the independent data auditor’s work.

What you get from us

  • A personal data inventory and flow maps, including transfers outside India
  • Fiduciary and processor role determination per processing activity
  • A gap register against the Act and the Rules, with owners and effort
  • Notices, consent and withdrawal text, and the parental consent flow where needed
  • A Rule 6 safeguards mapping and a retention and erasure schedule
  • A breach intimation runbook and templates, tested in a tabletop exercise
  • A rights and grievance process with published timelines

Common questions

Can we get DPDP certified?

No. The Act provides for no certificate, and anyone offering a DPDP certification is offering something the law does not recognise. Compliance is decided by the Data Protection Board of India against the Act. What you can hold is evidence, and that is what we help you build.

When do the DPDP obligations apply?

On 13 May 2027, eighteen months after the Rules were notified on 13 November 2025. The Consent Manager provisions commence on 13 November 2026; that date opens a registration framework and is not a compliance deadline for ordinary Data Fiduciaries. MeitY consulted in January 2026 on moving the main compliance date from 13 May 2027 to 13 November 2026, but as of 6 October 2026 no notification making that change has been published. Commencement dates are set by notification and can be changed by one, so check the Gazette before relying on them.

Does the DPDP Act apply to a small company?

Yes. There is no turnover or headcount threshold, and your own employees’ data is personal data. The heavier tier is the other way round: only an organisation the Central Government notifies as a Significant Data Fiduciary carries the extra duties of a Data Protection Officer, an independent data auditor and an annual DPIA and audit.

Can you be our independent data auditor?

Not for a programme we built. The Act requires a Significant Data Fiduciary to appoint an independent data auditor to evaluate its compliance, and an auditor evaluating its own work is not independent in any useful sense. We prepare you, and you appoint someone else to audit.

Does ISO/IEC 27701 make us DPDP compliant?

No certificate does — compliance with a statute is a legal question decided against the statute. ISO/IEC 27701 produces the records of processing, rights handling and retention decisions the Act asks for, in a form an auditor already recognises, which makes demonstrating compliance far more straightforward.

Ready to scope it?

Send the date you are working to and roughly how large the organisation is. You will get a reply from a practitioner with an honest read on whether the date is reachable.

Start the conversation

Related services

All services

Related insights

All insights