From wherever you are, to fully compliant.

Mostly operations. The Act is short and readable; its obligations land on intake forms, field apps, CRMs, vendor contracts and the habits of hundreds of people. Legal advice tells you what the law means. It doesn't change how a field worker enrols a family on a Tuesday afternoon.

That is why we put strategy, design, systems and on-ground work in one programme. The organisations that struggle are usually the ones that bought the interpretation and assumed the implementation would follow.

Not necessarily. Consent is the default, but Section 7 of the Act lists "certain legitimate uses" where you can process data without it, for example when a person has voluntarily given data for a specific purpose and hasn't objected. Leaning on consent for everything creates fatigue and brittle records. Leaning on exemptions without writing down why invites trouble.

The real work is deciding, purpose by purpose, which basis applies, recording the reasoning, and designing notices that match. It's one of the first things we settle in a baseline.

The Rules ask you to take due care that the person consenting is an identifiable adult, using reliable details you already hold or a virtual token such as one issued through DigiLocker. In a village that means designing the check into enrolment itself: an OTP to the guardian's number, a field worker's attestation, an ID reference recorded once.

Some education, health and child-care uses are exempt for specific purposes. Knowing exactly which of your programmes qualify saves a great deal of unnecessary friction.

For personal data processed on consent given before the Act commenced, you must give people a notice as soon as reasonably practicable, and they can withdraw. In practice that is a triage: delete what you can't justify keeping, and re-notify everyone else.

This is usually the largest single piece of work in a programme and the most neglected, because it lives in old registers and spreadsheets rather than in any one system.

The government notifies Significant Data Fiduciaries based on factors such as the volume and sensitivity of data processed and the risk to people's rights. If you are notified, you need a Data Protection Officer based in India, an independent data auditor, and periodic impact assessments and audits.

Large platforms, health and education networks and big employers should plan as if the label may arrive. Building the evidence trail now is far cheaper than reconstructing it later.

No. The Rules arrive in phases: the Data Protection Board from November 2025, Consent Manager registration from 13 November 2026, and most obligations from 13 May 2027. That last date is when obligations begin, not when the work ends. You will launch new programmes, sign new vendors and hire new staff every month. The real test is whether a programme you start next year collects data correctly without us in the room.

We measure our own success by that, and it's why change management sits inside the journey rather than after it.

Yes, and you shouldn't wait. Start by asking for a consultation session with us. We'll look at what you actually hold and pick the few things that matter most for an organisation your size.

Then deploy the Commons Trust software to look after your compliance needs day to day: notices, consent records, requests and evidence, without needing a dedicated privacy team.