DPDP compliance is mandatory for Indian businesses by 13 May 2027.

If your organization collects personal data such as names, phone numbers, email addresses, customer details, or employee records in digital form, the Digital Personal Data Protection Act (DPDPA) applies to you. Penalties for non-compliance range up to ₹250 crore. The DPDP Rules, 2025, were notified in November 2025 with an 18-month phased compliance schedule but preparation should start now!

What Is the DPDP Act 2023?

The DPDP Act, 2023, provides a consent-based framework for collection, processing, storage and sharing of digital personal data of individuals by organizations in India. As one of the country’s most important data protection laws, it’s changing how businesses of all sizes handle and protect personal information. The Act also applies to organizations outside India that offer goods or services to individuals in India.

The DPDP Rules 2025 were notified on 13 November 2025 by the Ministry of Electronics and Information Technology (MeitY), marking a pivotal moment in India’s data privacy journey. (Source: MeitY Gazette notification).

Key Terms Under the DPDP Act, 2023

The DPDP Rules, 2025 were notified by MeitY in November 2025, creating a framework to protect personal data with an 18-month phased schedule for compliance. The Data Protection Board is already operational, Consent Manager provisions begin on 13 November 2026, and the remaining obligations become enforceable on 13 May 2027.

This gives businesses a preparation window, but it does not mean organizations should wait until the DPDPA compliance deadline of May 2027 to act.

Deploying data mapping, consent management, access controls, retention policies, vendor agreements, and incident response processes takes time, especially for organizations with large or legacy application environments. 2026 is a preparation and implementation year for most businesses.

Who Does DPDPA Apply To?

If your business collects any of the following, DPDPA compliance for businesses in India likely applies to you:

• Customer names and phone numbers
• Email addresses
• Employee records
• Aadhaar or PAN (where legally permitted)
• Health or financial information
• Location or device data linked to an individual

Business Type Coverage

 

Strengthened Rights for Data Principals

The DPDP Rules give individuals (“Data Principals”) greater control over how their personal data is collected, used, and managed. Every organization must provide simple, accessible ways for people to exercise these rights:

• Access to their personal data
• Correction or erasure of personal data
• Grievance submission, with resolution within 90 days
• Withdrawal of consent at any time
• Nomination of one or more individuals to exercise their rights

The Rules also introduce stricter data breach reporting requirements. If an organization becomes aware of a personal data breach, it must promptly notify the affected individuals and the Data Protection Board of India followed by a detailed report within 72 hours. This makes incident preparedness a core part of DPDPA compliance.

What Are the Penalties Under the DPDPA?

The DPDP Act penalties matrix shows that penalties increase depending on how serious the violation is. The biggest fine, up to ₹250 crore, is for failing to implement reasonable security safeguards. These are maximum limits; the Data Protection Board decides the actual amount after an inquiry. This makes it clear that regulators want organizations to take responsibility for protecting data.

The 5 Operational Pillars of DPDPA Compliance

• Know Your Data: Create a list that shows all customer, employee, vendor and partner data. Find out where this data resides and who has access to it.
• Protect Your Data: Use access control, encryption, endpoint protection, backups and constant monitoring to cut down breach risk. A layered cybersecurity approach will help organizations secure data on endpoints.
• Be Transparent: Every place where data is gathered must plainly state why that data is collected and how it will be used. Consent notices must be available in English and regional languages, as applicable.
• Manage the Data Lifecycle: Do not keep data for an endless time. Set data retention and deletion policies that meet your business requirements.
• Be Ready for Breaches: Maintain a documented breach response plan with clear roles, escalation steps, and communication procedures. Test it regularly to meet the 72-hour notification requirement.

Action Checklist: What to Do Before May 2027

Immediate (Now):

• Track how personal data moves across business units and vendors.
• Review consent practices, including children’s data and bundled offers.
• Put parental consent mechanisms in place where required.
• Review data transfers against applicable regulatory requirements.
• Evaluate cybersecurity controls across devices, networks, applications, and cloud environments.

Before November 2026:

• Decide whether to manage consent internally or use a Consent Manager.
• Ensure consent is free, clear, specific, and unconditional.
• Provide an easy way to withdraw consent.
• Maintain records of consent, notices, and processing purposes.
• Review third-party contracts and data security measures

Before May 2027:

• Conduct Data Protection Impact Assessments (DPIAs) where required (applies to Significant Data Fiduciaries).
• Arrange for independent data audits where applicable (applies to Significant Data Fiduciaries).
• Train employees on data protection responsibilities.
• Test grievance processes to support resolution within 90 days.
• Finalize breach response procedures, keeping the 72-hour notification requirement in mind.

Preparing Your Organization for DPDPA Compliance

DPDPA readiness starts with understanding what personal data you collect, store, and transmit and how it flows across systems, teams, and third-party vendors. Every part of the DPDPA, from customer communication to breach response, is interconnected.

The clock is ticking, but there’s still time. Businesses that start today build the right foundation of controls and processes, rather than scrambling as the deadline approaches.

DPDPA compliance is ultimately about embedding better data management and protection practices into everyday business operations.