India’s Digital Personal Data Protection Act (DPDP Act), 2023 is transforming how organisations collect, use and safeguard personal data. It marks a new era where privacy, security and governance work together to build stronger data management practices.
Yet according to an EY India DPDP Readiness Survey:
- 83% of Indian organisations have not yet begun compliance and
- only 9% claim comprehensive understanding of the Act.
If you are among the majority, the window to act is narrowing.
In this guide, we explain what DPDP Act compliance means, outline the key obligations for data fiduciaries and share practical steps to align your organisation with the law — before enforcement tightens.
What is the DPDP Act?
The Digital Personal Data Protection Act, 2023 governs the processing of personal data in digital form. It aims to protect individuals’ rights while enabling responsible data-driven innovation.
The law applies to all entities operating within India and to foreign organisations offering goods or services to individuals in India. It introduces key definitions that form the foundation of compliance:
- Data Principal: The individual whose personal data is processed.
- Data Fiduciary: The organisation determining the purpose and means of processing.
- Data Processor: The entity processing data on behalf of a fiduciary.
The Act also establishes the Data Protection Board of India (DPBI) to oversee compliance, manage grievances and impose penalties for violations.
Why DPDP Act compliance matters
Data protection is no longer optional in a digital economy. Breaches and unauthorised use quickly undermine trust, disrupt operations and invite regulatory scrutiny.
Complying with the DPDP Act ensures that your organisation:
- Processes data fairly, lawfully, and transparently.
- Strengthens its cybersecurity posture.
- Avoids heavy penalties, which can reach ₹ 250 crore for serious violations.
- Demonstrates accountability to customers, investors, and regulators.
How to achieve DPDP Act compliance: A step-by-step roadmap
Building compliance takes time and structure. Once you are thorough with key DPDPA principles and guidelines, the following steps will help you move from awareness to action.
Step 1: Conduct a gap assessment
Start by evaluating your current privacy and security posture. Review policies, consent mechanisms and data-sharing practices. Identify where personal data resides across your environment, including on-premises and cloud systems.
Step 2: Build a data inventory
A centralised data inventory helps you understand what personal data you hold and why you process it. Track:
- The type of data collected.
- The purpose of collection.
- The third parties it is shared with.
- How long it is retained.
Maintaining a data inventory simplifies audits, risk assessments and breach response.
Step 3: Update privacy notices and consent workflows
Ensure that all digital touchpoints – websites and mobile apps – provide clear, accessible consent requests. Include details on how data will be used, links to privacy notices and a simple process for withdrawing consent or raising grievances.
One obligation most organisations overlook: existing customer data. The DPDP Act requires you to issue a one-time retrospective notice to every Data Principal whose data you collected before the Act came into force. This notice must clearly state what data you hold, why you hold it and how they can exercise their rights. For data-heavy sectors like BFSI, healthcare, e-commerce, this is your most pressing immediate obligation. Delaying it increases your regulatory exposure as enforcement ramps up.
Step 4: Strengthen technical security
Security is at the heart of compliance. Rule 6 of the DPDP Rules 2025 mandates specific technical safeguards, not just a generic “layered defence.” Your controls must include:
- Encryption at rest and in transit mandated under Rule 6
- Data masking and obfuscation for sensitive fields
- Role-based access controls limiting data exposure by function
- Audit log retention for a minimum of one year required for regulatory review
- Continuous monitoring and detection systems to support the 72-hour breach notification window
Document these controls explicitly. Regulators will assess whether your safeguards meet the “reasonable security” standard – and your documentation is your defence.
Step 5: Prepare for breach response
Data breaches can happen despite strong defences. Develop an incident response plan but know exactly what the DPDP Act requires when one occurs.
The DPDP Act triggers a two-stage notification process the moment you become aware of a breach:
- Initial intimation to the DPBI without delay, as soon as the incident is confirmed
- Detailed incident report to the DPBI within 72 hours, covering facts, root cause, impact and remediation steps
- Notice to every affected Data Principal simultaneously, in plain language
Critically, DPDP stacks on top of your CERT-In obligations. Under CERT-In Directions (April 2022), cybersecurity incidents must also be reported within 6 hours of detection. A single breach triggers two separate clocks. Your incident response plan must pre-map both timelines to named owners before a breach occurs and not during one.
Step 6: Train employees
Employees play a vital role in protecting personal data. Conduct regular training to raise awareness about handling sensitive information, recognising phishing and reporting security incidents.
Step 7: Engage with vendors
Third-party vendors often process data on your behalf and under DPDP, you remain liable for what they do with it.
Your vendor contracts must go beyond generic breach-reporting clauses. Specifically:
- Mandate written Data Processing Agreements (DPAs) under Section 7(1)(b) defining scope, purpose and security obligations
- Control sub-processors require vendors to get your approval before engaging any sub-contractor who touches your data
- Embed your breach notification clock into vendor SLAs if your vendor suffers the breach, your 72-hour DPBI window still starts from when they inform you
- Build in audit rights - you must be able to verify that processor practices match your DPDP obligations
Step 8: Monitor compliance continuously
Compliance is ongoing. Use dashboards, metrics and periodic audits to measure progress. Track indicators such as consent-response times, rights requests and incident statistics to stay on course.
Your DPDP compliance timeline: what happens when
The DPDP Rules 2025 were officially notified on 13 November 2025. MeitY has set three enforcement dates. Use this window – do not wait for enforcement notices to start.
| Phase | Date | What activates | Your action now |
| Phase 1 | 14 Nov 2025 (now) | DPBI established; penalty framework active; administrative provisions in force | Begin gap assessment and data mapping |
| Phase 2 | 14 Nov 2026 | Consent Manager registration opens; SDF obligations for certain categories may accelerate | Finalise consent architecture; issue legacy data notices |
| Phase 3 | 14 May 2027 | All substantive obligations enforceable — consent, breach notification, rights, security safeguards, vendor controls | Full compliance operational; audit-ready documentation in place |
Common challenges in DPDP Act compliance
Every organisation faces hurdles on the path to compliance. Awareness of these challenges helps you plan better.
- Fragmented data systems: Data stored across multiple platforms makes it difficult to maintain visibility
- Limited consent tracking: Older tools may not capture or record granular consent data
- Third-party risk: Vendors may not follow equivalent data-protection standards – and your liability does not transfer with the contract
- Legacy data backlog: Existing customer databases require retrospective notices before Phase 3 enforcement begins
- Cultural adoption: Moving from compliance awareness to accountability requires leadership support and cross-functional ownership
The cost of non-compliance
The DPDP Act prescribes significant penalties under the DPDP Act for failing to meet obligations.
- ₹ 250 crore – failure to maintain adequate security safeguards.
- ₹ 200 crore – failure to report breaches or mishandling children’s data.
- ₹ 150 crore – non-compliance by Significant Data Fiduciaries.
- ₹ 50 crore – other general violations.
Penalties are calculated per incident, meaning multiple lapses multiply financial exposure. Beyond monetary penalties, the real impact often lies in loss of customer confidence, reputational harm and prolonged investigations.
How CyberNX helps you achieve DPDP Act compliance
We help organisations navigate India’s Digital Personal Data Protection Act consulting requirements, ensuring compliance while optimising business operations and mitigating risks associated with personal data processing.
Our DPDPA framework includes:
- DPDP readiness assessments: Evaluate data-protection maturity and identify gaps.
- Data discovery and classification: Locate and categorise personal data across environments.
- Policy design and consent management: Build compliant, user-friendly consent workflows – including legacy data notice programmes
- Security implementation: Deploy Rule 6-aligned monitoring, control and incident response frameworks
- Vendor governance: Review and remediate third-party DPAs to close processor liability gaps
- Staff training: Build awareness and accountability throughout your workforce.
Why businesses choose us for DPDP Act compliance
1. DPDPA specialised expertise
Our team includes certified privacy professionals with specialised knowledge of India’s DPDPA and its implementation requirements – ensuring accurate, up-to-date guidance as rules evolve.
2. Industry-specific approach
We develop tailored compliance strategies for BFSI, healthcare, e-commerce and IT/ITES – addressing the unique data processing challenges each sector faces under the Act.
3. Regulatory insights
Our strong understanding of the Data Protection Board of India’s approach helps clients navigate requirements effectively – including SDF designation criteria and MeitY notifications as they are issued.
4. Integrated compliance framework
We create a harmonised approach that aligns DPDPA compliance with GDPR, CCPA and other regulatory requirements – so your data protection programme works across jurisdictions, not just one at a time.
Conclusion
DPDP Act compliance is a strategic step toward responsible data management. The Act sets clear expectations and the enforcement timeline is now confirmed. Phase 3 obligations activate in May 2027, but the build window is 2026.
Start with a gap assessment, map your legacy data exposure and get your breach response plan tested against both the 72-hour DPBI clock and the 6-hour CERT-In obligation. Every step you take now reduces the cost and complexity of compliance later.
Partner with us to evaluate your DPDPA readiness. With our DPDA Act Consulting services, you can build a compliance programme that strengthens trust and resilience across your organisation. Ready to start? Talk to our team today.
DPDP Act compliance FAQs
Does the DPDP Act apply to offline data?
No. It applies only to digital personal data – or data collected offline that is later digitised. Purely offline, never-digitised data falls outside the Act’s scope.
What is a Significant Data Fiduciary?
A Significant Data Fiduciary (SDF) is an entity designated by the Indian government based on volume of data processed, sensitivity, risk to Data Principals and national security implications. SDFs face enhanced obligations: a mandatory India-based DPO, regular DPIAs, independent audits and algorithmic accountability. The formal SDF notification list has not yet been published – monitor MeitY announcements closely.
Is consent the only legal basis for processing data?
Primarily yes. The Act relies on consent for most processing, with limited exceptions for legal obligations, emergencies and certain state functions. Unlike GDPR, the DPDP Act does not recognise “legitimate interests” as a standalone basis – so any processing that currently relies on that basis for Indian users needs to be re-evaluated.
How can small businesses ensure compliance cost-effectively?
Focus on foundational measures such as transparent consent, clear privacy notices, and essential security controls. Affordable automation tools can simplify these processes.
