The DPDP Act and Rules: what they ask, and what you must be able to show

When the Data Protection Board, a court or an angry customer asks how you used someone's personal data, you will need to show them. That is the real demand of India's Digital Personal Data Protection Act, 2023. Where consent is your basis, the burden of proving the notice and the consent is on you (s. 6(10)). Where there is a breach, the questions are whether you kept reasonable safeguards (s. 8(5)), and how quickly and effectively you mitigated (s. 33(2)(e)). Most duties start on 13 May 2027, and the largest penalty is up to ₹250 crore.

Below: what the Act and the DPDP Rules, 2025 require, the evidence each requirement should leave behind, where the text is unclear, and a plan for the next seven months. Each legal point carries its section (s.) or rule so you, or your lawyer, can check it. Like the Act (s. 2(y)), we say "she" and "her" for every person.

Short of time? Start here.

• Nonprofits and foundations: Does it apply to you?, Children, The hard parts for NGOs, One programme, followed through.
• Companies: What proof looks like, CERT-In, SPDI and sector rules, Penalties, A plan for May 2027.
• SaaS and vendors: Consent and legitimate uses, If you are the processor, Where the law is unclear.

Two documents, three dates

The Act (No. 22 of 2023) sets the principles, rights, Board and penalties in 44 sections and one Schedule. The Rules (G.S.R. 846(E), notified 13 November 2025) set the mechanics: what a notice must contain, minimum security, how and when to report a breach, how to verify a parent, and when each part switches on.

Sources: commencement notification G.S.R. 843(E). Sections 1(2), 2, 18 to 26, 35, 38 to 43, 44(1) and 44(3) of the Act, and Rules 1, 2 and 17 to 21, from 13 November 2025. Section 6(9), section 27(1)(d) and Rule 4 from 13 November 2026. All other provisions, including section 44(2), and Rules 3, 5 to 16, 22 and 23, from 13 May 2027 (Rule 1).

Until May 2027 the old regime still runs. Section 44(2) deletes section 43A of the IT Act, the basis of the 2011 SPDI Rules, but only in the May 2027 tranche. Until then the SPDI Rules still bind body corporates (see CERT-In, SPDI and sector rules). One change is already live: section 44(3), which rewrote the RTI Act's personal-information exemption in section 8(1)(j), took effect in November 2025. Petitions challenging it are pending before a larger bench of the Supreme Court, which refused to stay it in February 2026 (LiveLaw).

The government has also used its power to remove difficulties (s. 43) once. Its order of 5 October 2026 corrects the wording of s. 9(1) and s. 10(2)(c)(ii); it adds no duties and moves no dates (SCC Online).

The date could move earlier. In January 2026 MeitY reportedly discussed with industry cutting the eighteen months to twelve, at least for Significant Data Fiduciaries, and bringing some provisions forward, including the cross-border rules. Reports differ on the scope (Business Standard). As of 25 October 2026 we have found no amending notification. Plan against 13 May 2027, with slack.

The Board had no Chairperson or Members as of our last check on 25 October 2026 (LiveLaw; details in our Consent Managers guide). Your duties do not wait for the Board.

Does it apply to you?

Almost certainly, if you hold information about people in digital form.

The Act covers processing of digital personal data in India, whether collected digitally or on paper and digitised later (s. 3(a)). Personal data is any data about an individual who can be identified by or in relation to it (s. 2(t)). A phone number counts. So does a photo of a ration card, a GPS trail, or a case note that names nobody but would tell a field officer exactly who it is about.

A paper register in a block office is outside the Act. A photo of that register in a WhatsApp group is inside it, and so is the spreadsheet typed up from it on Friday afternoon. Data like this, digitised from paper, is usually the least protected an organisation holds and the hardest to find.

Size and sector do not exempt you. Section 17(3) lets the government notify certain fiduciaries, "including startups", as exempt from the notice (s. 5), accuracy and erasure duties (s. 8(3), 8(7)), the extra duties of Significant Data Fiduciaries (s. 10) and the access right (s. 11). Section 17(5) lets it exempt any fiduciary or class from any provision for a set period, within five years of commencement. Neither power has been used.

The Act also reaches processing outside India connected with offering goods or services to people in India (s. 3(b)). A Singapore company selling software to Indian schools is covered for that activity.

Fiduciary, processor, or both?

The fiduciary definition includes anyone deciding purpose and means "alone or in conjunction with other persons". Take a CSR foundation that co-designs a programme, specifies what data an implementing NGO collects, and receives beneficiary lists for monitoring. It is very unlikely to be a mere funder. Our view is that both are fiduciaries for that programme. Agree in writing who sends notices, answers requests, reports breaches and erases what.

The fiduciary is responsible for compliance in respect of processing its processors carry out on its behalf, "irrespective of any agreement to the contrary" (s. 8(1)). A vendor's indemnity protects your balance sheet; your duty stays with you. You may engage a processor for activities related to offering goods or services only under a valid contract (s. 8(2)). That contract should cover security (Rule 6(1)(f)), erasure (s. 8(7)(b)) and breach notice back to you.

Consent or a legitimate use

Section 4 offers two grounds: consent, or "certain legitimate uses". Unlike GDPR, there is no "legitimate interests" ground and no "necessary for a contract" ground.

Consent

Consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action", limited to the data needed for the specified purpose (s. 6(1)). Pre-ticked boxes, one "I agree" for several purposes, and consent buried in terms of service all fail that test. So does a service made conditional on agreeing to an unrelated use. Separately, any part of a consent that infringes the Act or another law is invalid to that extent (s. 6(2)).

The request must be in clear, plain language and available in English or any of the 22 languages of the Eighth Schedule. It must name someone who can respond (s. 6(3)). Withdrawal must be as easy as giving consent (s. 6(4)). After it, you and your processors must stop within a reasonable time unless the law requires or allows you to continue (s. 6(6)). Earlier processing stays lawful, and the consequences of withdrawal fall on the person, so you may stop a service that genuinely depends on the data (s. 6(5)).

Where consent is the basis and it is questioned in a proceeding, the fiduciary must prove that it gave a notice and obtained consent in line with the Act and Rules (s. 6(10)). A consent you cannot evidence is, in practice, a consent you do not have.

Legitimate uses

Section 7 lists where you may process without consent:

• 7(a), voluntary provision. She gave you the data for a specified purpose and has not said she objects to its use. An address given for a delivery can be used for the delivery. Using it for an unrelated mailing needs another basis.
• 7(b), State benefits. This is for the State and its instrumentalities providing a prescribed subsidy, benefit, service, certificate, licence or permit. It applies where she has previously consented to State processing for such benefits, or where the data comes from a State database the Central Government has notified. Rule 5 and the Second Schedule standards apply. A private NGO or vendor delivering a scheme does not rely on 7(b) in its own right; it usually acts as the State's processor, or needs its own basis.
• 7(c) to 7(e): the State's legal functions, legal duties to disclose information to the State, and court orders.
• 7(f) to 7(h): medical emergencies, epidemics, and disasters or breakdowns of public order.
• 7(i), employment: employment purposes, protecting the employer from loss or liability, and benefits an employee asks for.

For every activity run without consent, write down the clause and why it applies.

What a valid notice says

A consent request must come with or after a notice (s. 5(1)), available in English or any Eighth Schedule language (s. 5(3)). Rule 3 requires that it:

• stands on its own, understandable without reference to anything else you have published;
• itemises the personal data and gives the specific purpose, with the goods, services or uses it enables;
• links to your website or app and explains how to withdraw consent (as easily as it was given), exercise her rights and complain to the Board.

"We collect your information to improve our services" does not meet this standard. "Your name, mobile number, date of birth and your child's school enrolment number, used to assess your scholarship application and send you updates about it" does.

Section 5(2) covers data you already hold. Where a person consented before the Act commenced, send her a notice as soon as reasonably practicable. It should say what you hold and why, how to withdraw consent and raise a grievance, and how to complain to the Board. You may continue processing until she withdraws. This does not create consent where none was given; data held with no consent needs another basis. For an organisation with years of beneficiary, donor or customer records, this drive is often the largest single piece of work. It runs across SMS, WhatsApp, email, calls and field visits, with every contact logged.

What you owe while you hold data

Security. You must keep "reasonable security safeguards to prevent personal data breach" (s. 8(5)). Rule 6 sets the minimum:

• encryption, masking or tokenisation;
• access control;
• logs, monitoring and review good enough to detect and investigate unauthorised access;
• backups;
• a year of logs and related data;
• security terms in processor contracts;
• the organisational measures to make all of it work.

No certificate makes you compliant. After a breach the Board will ask whether your safeguards were reasonable for what you held, and the evidence has to predate the breach. Gaps are as often organisational as technical. Spreadsheets shared by open link, shared logins and leavers who still have access can undo a well-encrypted database.

Breaches. A personal data breach is any unauthorised processing, or accidental disclosure, sharing, alteration, destruction or loss of access, that compromises confidentiality, integrity or availability (s. 2(u)). There is no minimum size or harm. On becoming aware of one:

• Tell each affected person without delay, to the best of your knowledge, in plain language, through her account or a channel she registered with you. Say what happened, the likely consequences for her, what you are doing, what she can do and whom to contact (Rule 7(1)).
• Tell the Board without delay: nature, extent, timing, location and likely impact (Rule 7(2)(a)).
• Within 72 hours, send the Board a detailed report covering causes, mitigation, findings about who caused the breach, steps to prevent a repeat, and a report on the notices sent. The Board may allow longer on a written request (Rule 7(2)(b)).

Retention. Erase personal data when consent is withdrawn, or as soon as it is reasonable to assume the purpose is no longer served, whichever is earlier, and make your processors erase it too. This does not apply where another law requires you to keep it (s. 8(7)). The Rules fix the period only for three classes:

• e-commerce entities and social media intermediaries with at least two crore registered users in India;
• online gaming intermediaries with at least fifty lakh.

For them, the period is three years after the person last approached them or exercised her rights, or after the Rules commenced, whichever is later. It does not cover data needed for access to her account or to stored-value tokens, and she must be warned 48 hours before erasure (s. 8(8), Rule 8(1)–(2), Third Schedule). Everyone else sets and justifies its own periods.

There is also a floor. Rule 8(3) requires every fiduciary to keep personal data, traffic data and processing logs for at least one year, for the Seventh Schedule purposes: information the government may call for under section 36 and Rule 23. Rule 23(2) can bar you from telling the person concerned. Rule 6(1)(e) separately asks for a year of logs for security investigations. The right policy is a schedule of what is kept, for how long and why, not "erase everything at once".

Accuracy, contact and grievances.

• Keep data complete, accurate and consistent where it will be used to decide something about the person or shared with another fiduciary (s. 8(3)).
• Publish the business contact details of your DPO, or of a person who can answer questions about your processing. Include them in every reply to a rights request (s. 8(9), Rule 9).
• Run an effective grievance mechanism (s. 8(10)). Publish your response period and keep to it; it can be no more than 90 days (s. 13(2), Rule 14(3)).

A person must use your grievance route before going to the Board (s. 13(3)). A grievance desk that resolves complaints therefore keeps most of them away from the regulator.

What proof looks like

Each duty above should leave a record. Here is the level of detail we would want to hand the Board.

A consent record: one row per person, per purpose, per decision.

A retention rule: one row per data set, owned by the business owner of the data.

A 72-hour breach timeline. This is our working template; rehearse it before you need it.

The law does not prescribe these formats.

One programme, followed through

This illustration is a composite, not a client story. A foundation funds a girls' scholarship run by an NGO in western Rajasthan.

The foundation wrote the eligibility criteria and receives a monthly list of awardees, so both organisations are fiduciaries. They sign a short agreement. The NGO sends notices and records consent. The foundation receives only what it needs for monitoring. Each tells the other about a breach by phone the moment it knows.

Facilitators visit families with a tablet. Applicants are under eighteen, so the notice is addressed to a parent. It is offered in Hindi and read aloud in Marwari. The parent's identity and age are checked against an identity document the family already provided for eligibility, and the facilitator records how the check was done. The parent says yes to the application, yes to SMS updates, and no to photographs. The app stores the record shown in What proof looks like.

Applications move into the NGO's case system. The WhatsApp group the facilitators used to share photos of forms is closed. A rule replaces it: no personal data on WhatsApp, and forms are captured only in the app. The SMS gateway and the hosting company sign processing contracts.

In June 2027 a facilitator emails a district shortlist to the wrong address. That is a breach. The NGO's incident lead cuts access the same morning and checks whether the CERT-In Directions apply to the NGO; if they do, she reports to CERT-In within six hours. She tells the Board that day, messages the 37 affected families by SMS in Hindi, calls the foundation, and files the detailed report on day two.

A year after decisions, rejected applications are erased. The one-year logs stay, as Rule 8(3) requires. The erasure job writes its own record.

CERT-In, SPDI and sector rules

The DPDP Act adds to other laws rather than replacing them; where they genuinely conflict, the DPDP Act prevails (s. 38).

A single incident can start three clocks, each with different recipients and content. Put them into one incident playbook.

If you are the processor

The Act's duties sit on fiduciaries. If you are a SaaS company, payroll provider, call centre or IT vendor, they will reach you through your customers' contracts and questionnaires before May 2027. Fiduciaries must use processors only under a valid contract (s. 8(2)). They must also ensure their processors' safeguards (s. 8(5), Rule 6(1)(f)), make them erase data (s. 8(7)(b)) and make them stop after a withdrawal (s. 6(6)).

What customers will ask you to sign up to:

• security measures mapped to Rule 6, with evidence;
• breach notice to the customer within hours, with the facts it needs for Rule 7;
• a list of sub-processors with flow-down terms (customers must be able to name everyone who received a person's data, s. 11(1)(b));
• help answering rights requests;
• erasure on instruction and at contract end, with confirmation;
• support for any restrictions on transfers abroad;
• audit or assessment rights, especially from Significant Data Fiduciaries.

Breach timing. The 72 hours run from your customer becoming aware. Whether your knowledge counts as theirs is unsettled, and they stay responsible for what you do (s. 8(1)). Every hour you hold an incident back eats into their window.

Erasure, backups and logs. Erase from live systems promptly. Let backups expire on a documented, short cycle, and never restore an erased record into live use. Keep the logs the Rules and CERT-In require, separately, with access limited. That is our view of a defensible approach: the Rules require backups for continuity (Rule 6(1)(d)) but say nothing about erasing data from them.

Your own data. You are a fiduciary for your employees, leads, website visitors, cookies and product analytics, and any feature where you decide the purpose.

Customer data and AI. As a processor you process on your customer's behalf. Using customer data to train your own models is a purpose you decide. In our view that makes you a fiduciary for it, needing your own basis, and your customer's contract will usually forbid it.

Children. If you sell to schools or serve under-18s, our view is that the ban on tracking, behavioural monitoring and targeted advertising (s. 9(3)) can reach product analytics that track or profile identifiable children, unless the processing falls within a Fourth Schedule exemption such as a school's tracking for its educational activities.

CERT-In applies to you directly if you fall within its Directions. For the full vendor view, with model answers to customer questionnaires, liability terms and a 90-day plan, see DPDP for SaaS startups.

Children and people with guardians

For the Act, a child is anyone under eighteen (s. 2(f)). The Act requires three things:

• the verifiable consent of a parent or lawful guardian before processing a child's data (s. 9(1));
• no processing likely to harm her well-being (s. 9(2));
• no tracking, behavioural monitoring or targeted advertising directed at children (s. 9(3)).

Rule 10 explains "verifiable". You must exercise due diligence that the person consenting as a parent is an identifiable adult. Use identity and age details you already reliably hold, or details she provides voluntarily, such as a government-issued document she shows you, or a virtual token from an authorised entity such as DigiLocker (Rule 10(1)). Our view is that a bare "I am the parent" checkbox, with nothing checked, is unlikely to show due diligence.

The Fourth Schedule lifts the parental-consent and tracking rules only for named classes and purposes (Rule 12):

"We work in education" is not the same as "we are an educational institution processing for its educational activities". Read the exact words before relying on any row. The government may also notify a lower age for a fiduciary whose processing it is satisfied is verifiably safe (s. 9(5)); none has been notified.

For a person with a disability who has a lawful guardian, the guardian consents. You must check that a court, a designated authority or a local level committee appointed the guardian under the relevant law (s. 9(1), Rule 11).

The hard parts for NGOs

The Act was not written with field programmes in mind. Here is how we would approach the questions social-sector teams most often get stuck on.

• Consent when someone depends on you. If refusing means losing food, a scholarship or treatment, consent is a weak basis. Separate what is needed to deliver the service from extras like photos, research and case stories. For the first, our view is that 7(a) fits where she gave the data in order to receive the service and the use is obvious to her; State-scheme partners usually act as the State's processor. Take real, refusable consent for everything else, and make sure nobody loses the service for saying no.
• Low literacy. The Act asks for a clear affirmative action, and for the notice and request to be available in English or an Eighth Schedule language (s. 5(3), 6(3)). It does not ask for a signature. A notice offered in a Scheduled language such as Hindi, played as audio in her own dialect, with a spoken or thumbprint yes captured in an app, makes a strong record. A signed English form she could not read makes a weak one.
• Photos and stories. Treat fundraising use as a separate purpose with its own consent, given after she has seen or heard how it will be used. For children, get verifiable parental consent. A story can identify someone without her name.
• Field phones and WhatsApp. Decide what may never be shared on WhatsApp. Registers on personal phones are both a security gap and an erasure problem.
• Donors and volunteers. Donors and volunteers are Data Principals too. Their records need notices, retention periods and security.
• Verifying parents in the field. DigiLocker tokens are rare in many districts. Use reliable details of the parent's identity and age that you already hold, such as an identity document on file that shows her date of birth (Rule 10(1)(a)), or a document she shows you that gives her identity and date of birth (or age), such as a voter ID or another government-issued document (Rule 10(1)(b)(i)); the Rule's illustrations point to government-issued details for parents new to you. A school record that shows only her name does not establish that she is an adult, and a bare statement of her age is a fallback at best. A community worker's confirmation can support a check but is not one. Record how you checked.
• Funders. If a funder specifies or receives personal data, settle roles early.

Requests you will have to answer

Publish how to make a request and what identifier you need, such as an enrolment ID, mobile number or application number (Rule 14(1)). Then make sure someone can answer. Saying which vendors hold one person's data depends on a current map of systems and data flows.

Individuals have duties too (s. 15). The penalty for breaching them is up to ₹10,000. The Board can warn, or impose costs on, anyone filing a false or frivolous complaint (s. 28(12)).

Large fiduciaries, Consent Managers and data sent abroad

Significant Data Fiduciaries. The government can notify a fiduciary or class as significant. It weighs the volume and sensitivity of data, risk to people's rights, sovereignty, electoral democracy, security and public order (s. 10(1)). An SDF must:

• appoint an India-based DPO answerable to its board;
• appoint an independent data auditor (s. 10(2));
• run a Data Protection Impact Assessment and an audit every twelve months, with the assessor reporting significant observations to the Board (Rule 13(1)–(2));
• check that its algorithmic software does not put rights at risk (Rule 13(3));
• keep specified data, and the traffic data about its flow, in India (Rule 13(4)).

None has been notified. Large financial, health, telecom and platform businesses should build the DPIA and audit habit now.

Consent Managers. From 13 November 2026, an India-incorporated company with net worth of at least ₹2 crore can apply to register. It must meet the Board's standards, be independently certified, avoid conflicts with fiduciaries, and keep consent records for at least seven years (Rule 4, First Schedule). Most organisations will connect to Consent Managers rather than become one; see Consent Managers under DPDP.

Transfers abroad. Data may go abroad unless the government restricts a country (s. 16(1)). You must also meet any requirements it sets about making data available to a foreign State (Rule 15). Stricter sector rules still apply (s. 16(2)).

The Board and penalties

The Board is meant to work as a digital office (s. 28(1), Rule 20). It acts on:

• breach intimations;
• complaints from people who have first used your grievance route;
• references from government or the courts (s. 27(1)).

It has civil-court powers to summon people and inspect documents (s. 28(7)) and must finish an inquiry within six months, extendable three months at a time (Rule 19(9)). It may send a complaint to mediation (s. 31). Civil courts cannot hear matters within its remit (s. 39). Appeals go to TDSAT within sixty days (s. 29).

A penalty follows only if an inquiry finds the breach "significant", and only after a hearing (s. 33(1)).

The government can raise these by notification, to at most twice the original amounts (s. 42).

Section 33(2) sets the actual figure. The Board must weigh:

• the nature, gravity and duration of the breach;
• the type of data;
• repetition;
• any gain made or loss avoided;
• whether you mitigated, and how quickly and effectively;
• proportionality;
• the penalty's likely impact on you.

For the board briefing:

• Voluntary undertakings (s. 32). At any stage, the Board may accept your undertaking to take or stop an action. That bars further proceedings on those matters unless you break it. An undertaking is far easier to offer when your records show you can keep it.
• Blocking (s. 37). After penalties in two or more instances, the government can, on the Board's advice, block public access to the platform a fiduciary uses to serve people in India.
• No compensation. Penalties go to the Consolidated Fund of India (s. 34). When section 43A of the IT Act goes in May 2027, its route to compensation for negligent handling of sensitive data goes with it. The regulatory penalties that replace it are far larger, and orders will be public.

Where the law is unclear

These are our positions until the Board or the courts decide otherwise. Each has a reason, so you can disagree with us on the merits.

Is there a "sensitive data" category? No, the Act dropped it. We still tier controls for health, children's, financial, caste and religion, biometric and precise location data. Why: the type of data affects both the penalty (s. 33(2)(b)) and SDF designation (s. 10(1)(a)). Would change if: the Act is amended to add a sensitive category, or the Board treats some data as presumptively high-risk. Confidence: high.

What does "without delay" mean for breach notices? Hours, measured in the same working day for the Board's first intimation. Why: the 72-hour detailed report presupposes an earlier notice, and CERT-In's six hours sets the national expectation for speed. Would change if: the Board publishes guidance or rules on a case. Confidence: medium.

How wide is legitimate use 7(a)? Narrow. We use it only where the purpose is obvious to her at the moment she hands over the data. Why: the clause turns on a "specified purpose" and on her not having objected. It gives no room to repurpose data. Would change if: the Board reads 7(a) broadly in an early case. Confidence: medium.

Should employers rely on employee consent? Rarely. Why: consent from someone whose job depends on you is hard to call "free", and section 7(i) exists for genuine employment purposes. Take consent only for real extras, such as photos on the website. Would change if: the Board or a court reads 7(i) narrowly. Confidence: medium.

How much age assurance is enough? Proportionate to risk. Confirm adults are adults without collecting more than needed (the Fourth Schedule allows processing for exactly that). Verify parents properly where you knowingly serve children. Would change if: the government notifies age-assurance standards. Confidence: medium.

Can data held with no recorded consent continue to be used? Only on another basis. Why: section 5(2) protects consent given before commencement; it says nothing about data collected without one. Would change if: a notification under s. 17(5) or the Board's practice allows a transition. Confidence: high.

Is WhatsApp acceptable for breach notices? Yes, if she registered that number with you, and if you keep proof of delivery. Why: Rule 7(1) allows "any mode of communication registered by her". Would change if: the Board expects a specific channel. Confidence: medium.

Are processors directly exposed to the Board? Mostly through their customers. Why: the duties are written for fiduciaries. A processor that decides its own purposes becomes a fiduciary for them. Would change if: the Board penalises a processor directly under the "any other provision" item. Confidence: medium.

Must a notice be offered in every Scheduled language? We offer English plus the Scheduled languages the people we serve actually use, and play audio in their dialect where needed. Why: sections 5(3) and 6(3) give "the option to access" the notice in English or any Eighth Schedule language, which can be read as requiring a choice of any of the 22. Would change if: rules or the Board settle the reading. Confidence: medium.

What basis covers CCTV of visitors? Unclear. Section 7(i) covers employees, not visitors, and there is no implied consent. We use a clear notice at the entrance, treat entry as consent only where entering is a real choice, and keep footage briefly. Would change if: guidance or a case addresses it. Confidence: low.

When is a breach "significant" enough for a penalty? The Act does not say (s. 33(1)). We expect the Board to look at scale, sensitivity, harm and how the organisation responded, the same factors it uses to set the amount. Would change if: the first orders set a pattern. Confidence: low.

A plan for May 2027

The work falls into ten workstreams, and most of them run in parallel:

1. An accountable owner with authority across teams, and a line to the board or trustees.
2. A data map of every system, form, spreadsheet, WhatsApp group, vendor and partner, including digitised paper and HR data.
3. A legal basis for each purpose: consent, or a named clause of section 7.
4. Notices that meet Rule 3 in the languages your people use, and the section 5(2) notice drive for data you already hold.
5. Rule 6 security controls, with evidence, starting with access gaps.
6. One incident playbook covering CERT-In, the DPDP Rules and any sector regulator, rehearsed at least once.
7. Rights and grievance handling, with a tracker.
8. Contracts with processors and partners.
9. Children's data and how you verify parents.
10. A retention schedule, and erasure jobs that run on it.

Our dated calendar, with a minimum version for small organisations, person-week estimates for large ones, a route for SaaS vendors and compressed plans for teams starting in January or March, is in DPDP compliance deadline: 13 May 2027.

Five questions for your board each quarter:

1. Who owns DPDP here, and what did they report?
2. How much of our personal data is mapped, with a basis and a retention period?
3. How many requests and grievances came in, and were any late?
4. When did we last rehearse a breach, and what broke?
5. Which vendors and partners still lack contracts that meet the Act?

This work touches programmes, fundraising, HR, IT, legal and the field. Give it an owner with authority over all of them. Then judge progress by the records the organisation produces each week, not by the documents it has written.

How we wrote this guide. We worked from the text of the Digital Personal Data Protection Act, 2023 (No. 22 of 2023), the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), as corrected by G.S.R. 892(E)) and the commencement notification G.S.R. 843(E), as published in the Gazette of India. Events after November 2025 come from the linked public reports, last checked 25 October 2026. Statements marked "our view" or "our position" are our judgement, not the law. Each version is checked line by line against the Act and Rules before publication. This guide explains the law; it is not legal advice for your situation.