The deadline is fixed. The implementation window is shrinking. Is your organisation ready for India’s Digital Personal Data Protection (DPDP) regime?
As of 24 August 2026, 262 days remain until 13 May 2027, when the principal operational provisions of India’s Digital Personal Data Protection Act, 2023 and the corresponding provisions of the DPDP Rules, 2025 are scheduled to come into force.
For organisations that collect, use, store, share, or otherwise process digital personal data, this is no longer a future compliance conversation. It is a business-readiness priority.
The Government of India notified the Digital Personal Data Protection Rules, 2025 on 13 November 2025. The Rules adopt a phased commencement structure, with several substantive provisions taking effect 18 months after notification—making 13 May 2027 a critical date for organisations preparing for operational compliance.
What Is the DPDP Act?
The Digital Personal Data Protection Act, 2023 establishes India’s framework for processing digital personal data while recognising individuals’ rights over their personal data and the legitimate need of organisations to process data for lawful purposes.
The framework places greater emphasis on accountability, transparency, security, consent, and responsible data management.
For organisations, compliance is not simply about publishing a new privacy policy. It requires understanding how personal data moves throughout the business—from collection and consent to access, processing, sharing, retention, and deletion.
Why 262 Days May Not Be Enough
At first glance, 262 days may seem like a comfortable preparation period. In practice, enterprise-wide privacy compliance can involve multiple departments, systems, vendors, applications, databases, and business processes.
A typical organisation may need to answer questions such as:
- What personal data do we hold?
- Where does that data reside?
- Why are we processing it?
- Who has access to it?
- Which third parties or vendors receive it?
- How long do we retain it?
- Can individuals exercise their rights effectively?
- Can we demonstrate compliance when required?
Finding the answers can take considerably longer than drafting policies.
Key Areas Organisations Should Focus On
1. Data Discovery and Classification
You cannot protect or govern data that you cannot identify.
Organisations should begin by creating a clear picture of the personal data they collect and process across applications, databases, cloud environments, employee systems, customer platforms, and third-party services.
Data should be classified according to its nature, purpose, sensitivity, location, ownership, and processing activity.
A well-maintained data inventory can become the foundation for broader DPDP compliance efforts.
2. Privacy Notices and Consent Management
The DPDP Rules require notices to be presented in clear and understandable language. The notice must provide information including an itemised description of the personal data being processed and the specified purpose or purposes of processing. The Rules also provide mechanisms for Data Principals to withdraw consent and exercise their rights.
This means organisations should review existing:
- Privacy notices
- Consent mechanisms
- Cookie and tracking practices
- Mobile and web forms
- Marketing opt-ins
- Consent withdrawal processes
Consent should not become a one-time checkbox exercise. Organisations need processes that can demonstrate what consent was obtained, for what purpose, and how it can be withdrawn where applicable.
3. Data Principal Rights and DSR Management
Individuals—referred to as Data Principals under the DPDP framework—have rights relating to their personal data.
Organisations should therefore establish a structured process for receiving, verifying, tracking, responding to, and closing Data Principal requests.
This requires more than an email inbox. Businesses should define ownership, escalation procedures, response workflows, verification controls, and evidence trails.
4. Security Safeguards and Breach Readiness
Security is a central component of privacy compliance.
The DPDP Rules describe reasonable security safeguards including measures such as encryption, access controls, monitoring for unauthorised access, backups, logging, and appropriate security provisions in contracts with Data Processors.
The Rules also establish breach notification requirements. When a Data Fiduciary becomes aware of a personal data breach, affected Data Principals must be informed promptly, while information relating to the breach must also be communicated to the Data Protection Board within the prescribed framework.
Organisations should therefore test their incident-response processes before a breach occurs—not after.
5. Vendor and Data Processor Governance
Personal data rarely stays within one organisation.
It may be processed by cloud providers, payroll platforms, CRM systems, marketing partners, IT service providers, analytics platforms, customer-support providers, and other vendors.
This creates an important question:
Can your organisation demonstrate that third parties handling personal data are governed appropriately?
DPDP readiness should therefore include vendor identification, contractual reviews, security assessments, data-flow mapping, access controls, and ongoing monitoring.
6. Retention and Data Deletion
Privacy compliance is also about knowing when not to keep data.
Organisations should review whether personal data is being retained for legitimate and documented purposes or simply because systems have historically stored it.
The DPDP Rules include specific provisions around periods after which certain categories of personal data may need to be erased when the specified purpose is no longer being served, subject to applicable legal requirements. MMeitY
A practical retention and deletion framework can help organisations reduce unnecessary data exposure while improving governance.
DPDP Compliance Is a Cross-Functional Programme
One of the biggest mistakes organisations can make is treating DPDP compliance as the responsibility of the legal or IT department alone.
Effective readiness requires collaboration between:
Leadership + Legal + Privacy + IT + Cybersecurity + HR + Procurement + Business Teams + Vendors
Each function sees personal data differently.
IT understands where data resides.
Security understands how it is protected.
Legal understands regulatory obligations.
HR manages employee information.
Procurement manages third-party relationships.
Business teams understand why data is collected and used.
DPDP compliance brings these perspectives together into one governance framework.
A Practical DPDP Readiness Roadmap
With the 13 May 2027 milestone approaching, organisations can structure their preparation around six stages:
1. Discover
Identify personal data, systems, applications, processes, and third parties.
2. Map
Document where data comes from, where it goes, why it is processed, and who can access it.
3. Assess
Identify gaps across privacy governance, consent, security, retention, vendors, rights management, and risk.
4. Govern
Develop policies, procedures, accountability structures, contracts, and privacy controls.
5. Implement
Deploy the necessary technical and organisational measures across business processes and technology environments.
6. Demonstrate
Maintain documentation, records, evidence, assessments, and monitoring mechanisms that demonstrate ongoing compliance.
The Right Time to Start Is Now
The DPDP framework is not merely another documentation exercise. It represents a shift towards more structured accountability for how organisations collect, use, protect, retain, and govern digital personal data.
The official Rules were notified in November 2025, and the phased commencement provides organisations with an implementation window. MMeitY+1
But preparation requires time.
Data discovery takes time.
System remediation takes time.
Vendor reviews take time.
Policy implementation takes time.
Employee awareness takes time.
Testing and evidence collection take time.
262 days may sound sufficient. Enterprise-wide compliance projects know otherwise.
Organisations that begin now can approach the deadline with a structured programme rather than a last-minute compliance scramble.
Build Your DPDP-Ready Future
DPDP readiness can be approached as an opportunity to strengthen not only regulatory compliance, but also data governance, cybersecurity, operational efficiency, customer trust, and responsible data use.
The key question is no longer:
“When does the deadline arrive?”
It is:
“How prepared will our organisation be when it does?”
Start your DPDP readiness journey today.
