DPDP readiness

DPDP obligations start 13 May 2027. Know exactly where you stand.

A guided readiness sprint and workspace built for India’s regulated mid-tier: data mapping, gap analysis by clause, policy templates and breach clocks, reviewed by practitioners.

Take the readiness quiz Book a readiness sprint call

Until DPDP core obligations apply

13 May 2027 (IST)

– days

Source: DPDP Rules commencement (opens in a new tab)

Until Consent Manager registration provisions apply

13 Nov 2026 (IST)

– days

Source (opens in a new tab)

What DPDP asks of you, in plain English

  • Tell people what personal data you collect and why, in a clear notice
  • Get and manage consent, and make withdrawing it as easy as giving it
  • Protect the data with reasonable security safeguards (e.g., encryption, access control, logs)
  • Report breaches to the Data Protection Board and inform affected individuals
  • Honour rights: access, correction, erasure and grievance redressal
  • Erase data once its purpose is served, subject to legal retention
  • Manage processors through proper contracts

The DPDP Act allows penalties of up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore for failing to notify a breach. These are maximums; the Board considers the circumstances of each case. Source: DPDP Act, 2023, Schedule (opens in a new tab)

DPDP Readiness Sprint

Available on request

A fixed-scope engagement over 4–6 weeks:

  • Gap assessment mapped to DPDP clauses
  • Personal-data map and processor register
  • Draft policy pack (notices, consent, retention, breach SOP, processor terms)
  • Remediation roadmap and board readout

Starting from ₹2 lakh + GST Indicative, to be confirmed

Book a sprint call

10-question DPDP readiness quiz

An indicative self-check that takes about 3 minutes. Your answers stay in your browser and are not sent anywhere.

1. Have you mapped where customer and employee personal data is stored, across all systems and vendors?
2. Do your privacy notices clearly state what data you collect, why, and how people can withdraw consent?
3. Can you record, show and honour consent withdrawals across channels?
4. Do you have a written breach-response plan covering the 72-hour Data Protection Board report and notices to affected individuals?
5. Is your CERT-In 6-hour incident-reporting process tested and owned by a named person?
6. Do contracts with your processors (vendors) include DPDP-aligned data-protection terms?
7. Do you have retention schedules, and do you erase personal data when the purpose is served?
8. Do you encrypt personal data and control access to it, keeping processing logs for at least one year?
9. Can you respond to data-principal requests (access, correction, erasure, grievance) within set timelines?
10. Has your board or management received a DPDP readiness update in the last six months?

FAQ

Data Fiduciary or Data Processor: which are we?

Broadly, a Data Fiduciary decides why and how personal data is processed. A Data Processor processes it on the fiduciary’s behalf. Most regulated entities are fiduciaries for their customer data. Confirm your position with counsel.

What is a Consent Manager?

A registered entity that provides a platform for individuals to give, manage, review and withdraw consent. The registration provisions come into force on 13 November 2026.

What is a Significant Data Fiduciary?

A fiduciary the government notifies as significant based on factors such as data volume and risk. These fiduciaries carry additional obligations, including periodic impact assessments and audits.

How fast must a breach be reported?

The DPDP Rules require intimation to the Data Protection Board within 72 hours of becoming aware of a breach (with an initial intimation without delay). CERT-In separately expects specified cyber incidents within 6 hours. Check the exact requirements for your situation with counsel.

Not legal advice. Prahari provides compliance tooling and advisory support. It does not provide legal advice. Please work with your own counsel on legal interpretations.

Want a practitioner to look at your readiness?

Book a 30-minute call. No obligation.

Get your free exposure report Book a 30-minute call