DPDP Compliance
Meeting the duties and respecting the rights in the DPDP Act and Rules.
DPDP compliance means following the duties in India's Digital Personal Data Protection Act and Rules, and respecting people's rights over their data. It is an ongoing programme, not a one-time certificate.
Meaning of DPDP Compliance
In practice it means mapping your data, giving clear notices, collecting valid consent, securing data, handling rights requests, reporting breaches, controlling vendors, setting retention and erasing on time, and being able to show records. The main duties apply from 13 May 2027.
Compliance is the state of being able to show that your organisation processes digital personal data lawfully and carries out the duties laid on a Data Fiduciary. The sources are the DPDP Act, 2023 and the DPDP Rules 2025, together with the directions of the Data Protection Board. No licence or registration is needed for most organisations, and no external certificate proves you comply, so the proof is your own records, systems and behaviour.
The core duties are these: process only on a lawful ground, consent or a legitimate use (Sections 4 to 7); give a clear notice (Section 5, Rule 3); keep data accurate (Section 8(3)); protect it with reasonable security safeguards (Section 8(5), Rule 6); report breaches to the Board and to each affected person, with a detailed report within 72 hours (Section 8(6), Rule 7); erase data when the purpose is served unless law requires retention (Section 8(7), Rule 8); publish contact details for questions (Section 8(9), Rule 9); and run grievance redressal (Section 8(10)). You must also support the rights to access, correction, erasure, grievance redress and nomination (Sections 11 to 14) and protect children through verifiable parental consent under Section 9.
Timing matters. The Board and definitions provisions are in force from the notification of the Rules in November 2025. Consent Manager registration is expected around November 2026, and the main Chapter II obligations take effect on 13 May 2027, which gives organisations roughly eighteen months from the Rules. The Act applies to digital data, including digitised records, and to processing outside India connected with offering goods or services to people in India (Section 3). Sector laws continue to apply under Section 38.
Larger or riskier organisations carry more. A Significant Data Fiduciary designated under Section 10 must appoint a Data Protection Officer based in India, an independent auditor and carry out impact assessments, and Rule 13 adds annual audits and algorithmic due diligence. Small businesses are not exempt by default, though Section 17(3) lets the Central Government notify classes such as start-ups for relaxations. A sensible reading is that every organisation needs the basics and proportionate controls.
Examples of DPDP Compliance
A company runs a gap assessment, fixes its notices and consent flows, and signs vendor agreements ahead of the deadline.
A 25-person SaaS start-up spends one week mapping its data, rewrites its sign-up form, adds a deletion option in the dashboard and signs data-processing terms with its cloud and email vendors. It repeats a short review every quarter.
A hospital group appoints a privacy lead, trains 400 staff on role-based access, tests a breach drill that includes the 72-hour report, and reviews which child-health activities fall under the Fourth Schedule exemption.
A marketplace checks whether it crosses the Third Schedule thresholds, builds a 48-hour pre-erasure warning for inactive accounts, and moves marketing consent into a separate and optional screen.
Why DPDP Compliance matters
Non-compliance carries heavy financial exposure after an inquiry by the Board: up to ₹250 crore for failing reasonable security safeguards, ₹200 crore for failing to report a breach or for breaching children's duties, ₹150 crore for Significant Data Fiduciary duties, and ₹50 crore for any other breach. Orders can be appealed to the Appellate Tribunal (TDSAT) within 60 days under Section 29.
The commercial case is wider. Enterprise customers, banks and public bodies increasingly ask vendors about their data protection posture before signing, and an organisation that can show data maps, notices, consent logs and breach drills closes deals faster. Starting early also spreads the cost of redesigning forms, apps and vendor contracts over many months.
How it works in practice
- 1Map your data: list what personal data you collect, where it is stored, who sees it, which vendors receive it and why. This data map underlies every other step.
- 2Fix the front door: rewrite notices to the Rule 3 standard, rebuild consent screens to be specific and unbundled, and add an easy withdrawal route. Check each purpose has a lawful ground.
- 3Secure the data: apply encryption or masking, access control, logging for a year, backups and vendor contracts as Rule 6 describes, and set up an incident response plan that reaches the 72-hour report.
- 4Build rights handling: publish contact details, create request and grievance workflows with owners and deadlines, and test them with sample requests.
- 5Set retention and deletion: assign periods for each data category, apply the Third Schedule rules if you are a large e-commerce, gaming or social media operator, and delete on time.
- 6Prove it: keep records of decisions, consent logs, training, audits and vendor reviews, and brief senior management at least twice a year.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Treating compliance as a one-off policy document. Regulators will look at systems and records, so a policy without practice does not help.
Waiting until May 2027 to begin. Changes to apps, vendor contracts and databases take months, and early gaps are cheaper to fix.
Copying a GDPR programme unchanged. The DPDP Act has no legitimate interest ground, different breach timelines and its own children and Significant Data Fiduciary rules.
Leaving it to the legal team alone. Engineering, marketing, HR and procurement all handle personal data and need clear responsibilities.
Compliance tips
Name an accountable owner with senior backing, and give that person authority to stop a launch that is not ready.
Prioritise by risk: begin with data that is large in volume, about children, or sensitive in practice, such as health and financial records.
Align your programme with existing controls such as ISO 27001 or sector rules from RBI, SEBI or IRDAI, rather than building a separate silo.
Review the programme after every product launch, vendor change and incident.
Common questions about DPDP Compliance
When do the DPDP Act obligations start?
The Board and definition provisions started when the Rules were notified in November 2025. Consent Manager registration is expected around November 2026, and the main obligations on notice, consent, security and breach reporting apply from 13 May 2027.
Does DPDP compliance require a certificate?
No certificate is prescribed for ordinary Data Fiduciaries. You show compliance through records, systems and conduct. Significant Data Fiduciaries must additionally appoint an independent auditor and carry out periodic assessments under Section 10 and Rule 13.
Does a small business have to comply?
Yes, unless it falls within an exemption. The Act has no blanket small-business exclusion, though Section 17(3) lets the Government notify classes such as start-ups for relaxations. Small firms should do the basics: notice, consent, security, rights and breach response.
What is the biggest penalty under the DPDP Act?
The highest maximum is ₹250 crore, for failing to maintain reasonable security safeguards. The Board decides penalties after an inquiry, considering the nature, gravity and duration of the breach, and its decisions can be appealed to the Appellate Tribunal.