The DPDP Compliance Ecosystem

It's India's law governing how organisations collect, use, store, and protect the personal data of individuals, giving those individuals enforceable rights over their own data.

Partially. The Data Protection Board is established and operating, and the core definitions are legally live. Full operational obligations — consent, notices, breach reporting, security, retention — become mandatory on 13 May 2027.

They share the same underlying idea — consent-based processing with individual rights — but DPDP is structurally simpler, has a blacklist (not allow-list) approach to cross-border transfer, and carries different penalty mechanics. Organisations that built GDPR programmes have a head start, not a finished solution.

The Data Protection Board of India (DPBI), a dedicated adjudicatory body that handles complaints, investigates breaches, and imposes penalties.

Yes. The Act applies to processing activity, not just new collection — data already in your systems is still subject to the same notice, consent, security, and retention obligations going forward.

Yes — there's no size or revenue exemption. What changes with size is the degree of obligation: most MSMEs aren't Significant Data Fiduciaries, so the heaviest requirements (DPIA, mandatory local DPO, annual audit) may not apply, but the core obligations do.

Yes. DPDP applies to processing of personal data of individuals in India, regardless of where your servers or vendors are located, and it also extends to processing outside India if it's connected to offering goods or services to individuals in India.

Any data that can identify an individual, directly or indirectly — names, phone numbers, email addresses, ID numbers, biometric data, location data, and similar identifiers, whether digital or digitised.

Both. Employee records — payroll data, ID copies, performance data — fall inside the same obligations as customer data, though the Act does carve out certain employment-related processing exemptions that still need to be applied carefully.

An SDF is a Data Fiduciary the government notifies based on data volume, sensitivity, and the risk their processing poses to individuals or India's sovereignty. Thresholds are set by government notification rather than a fixed number every business can self-check against — if your data volumes or sensitivity are growing fast (health, financial, biometric data at scale), it's worth an assessment rather than an assumption.

A clear statement of what personal data you're collecting, why, and what you'll do with it — in plain, understandable language, not buried in dense legal text, and available in the individual's chosen language among those specified under the Rules.

No. Consent must be a clear affirmative act — freely given, specific, informed, and unambiguous. Pre-ticked boxes, bundled consent, and consent-by-default don't meet the standard.

Yes, and withdrawal has to be as easy as giving consent in the first place. Once withdrawn, you generally have to stop processing that data for the purposes tied to that consent.

The right to access what data you hold, the right to correction and updating, the right to erasure once the purpose is served, the right to grievance redressal, and the right to nominate someone to exercise these rights on their behalf.

A Consent Manager is a separate, registered intermediary that lets individuals manage consent across multiple organisations from one place. Most businesses won't register as one — you'll simply need to be able to interoperate with Consent Managers once that layer goes live from November 2026.

The Rules don't prescribe one fixed checklist — they expect safeguards proportionate to the volume and sensitivity of data you hold, and typically include encryption, access controls, monitoring, and backup and recovery measures. This is the layer where your existing cybersecurity practice does the heavy lifting.

You're required to notify both the Data Protection Board and the affected individuals, without undue delay, and to take remedial action. The Rules also require a minimum one-year retention of personal data, traffic data, and processing logs to support any investigation.

Only as long as necessary for the purpose it was collected for, or as required by other law — after that, it must be erased. Certain categories under Schedule 3 of the Rules carry a longer three-year retention expectation for specific sectors.

Not necessarily immediately, but you can't keep it indefinitely "just in case." You need a defined retention schedule tied to purpose, with a documented trigger for deletion once that purpose lapses.

Generally yes — India's Rules use a blacklist model, meaning cross-border transfer is allowed by default except to countries the government specifically restricts. Worth checking your vendor's hosting geography against that list as it's published, rather than assuming.

The Rules require verifiable parental consent before processing data of anyone under 18, and place additional restrictions on tracking, behavioural monitoring, and targeted advertising directed at minors.

Civil penalties imposed by the Data Protection Board, running up to ₹250 crore for the most serious failures — such as inadequate security safeguards leading to a breach. Penalties apply per violation, so a single incident touching multiple obligations can produce cumulative exposure well beyond that headline figure.

Three things, in order: know what personal data you actually hold and where it lives (a data inventory), appoint someone with clear ownership of DPDP compliance, and get a gap assessment against the Act's core obligations before you start fixing anything. Starting with a tool purchase before you know your gaps usually means paying for the wrong thing.

For most MSMEs, a realistic range is 3 to 9 months depending on how much personal data you handle and how mature your existing security practices are — organisations that already run solid cybersecurity fundamentals (like yours) generally move through this faster than those starting from zero.