Everything your business must comply with, in plain English

Notice, consent, security, 72-hour breach reporting and data rights for any business handling personal data. Main duties from 13 May 2027.

Board meetings, AGM by 30 September, AOC-4, MGT-7, ADT-1, DPT-3 and director KYC.

Internal Committee, policy, awareness and an annual report for employers with 10 or more employees.

Monthly and quarterly GST and TDS returns, advance tax and the annual income tax return.

Trademark renewal every 10 years, yearly patent renewal fees and the patent working statement (Form 27) every three financial years.

Every upcoming ROC, GST, TDS and income tax due date in one calendar.

India's data protection law applies to almost every business that collects names, phone numbers or emails online. Here is what it requires, when, and what to do first.

Twenty steps that cover what the DPDP Act and Rules ask of a typical Indian business, in the order most teams tackle them.

Most DPDPA duties switch on together on 13 May 2027. Here is exactly what becomes mandatory and how to be ready in time.

The short answer is almost certainly yes, if you collect anyone's name, phone number or email digitally. Here is how to check.

The DPDP Act fixes maximum penalties for each type of breach. Here is the full schedule and how the Data Protection Board sets the amount.

Consent is the main lawful ground under the DPDP Act, and the rules on it are strict. Here is what a valid notice and opt-in look like.

A personal data breach triggers two reporting duties under the DPDP Act, and usually a third under CERT-In rules. Here is the sequence.

Large or high-risk data processors carry extra duties under the DPDP Act. Here is who qualifies and what changes.

A DPO is mandatory only for Significant Data Fiduciaries, but every business needs a published point of contact for data questions.

The DPDP Act treats everyone under 18 as a child. Edtech, gaming, social and e-commerce businesses face the strictest rules.

If you already comply with the GDPR, you are part of the way there, but not all of it. These are the differences that catch companies out.

Marketing is where most businesses feel the DPDP Act first. Here is what changes for inbound leads, email lists and outbound sales.

Employers can process employee data without consent for employment purposes, but most other DPDP duties still apply.

The DPDP Act gives individuals five rights. Businesses must publish how to use them and answer within 90 days.

The DPDP Act requires deletion once data is no longer needed, with a one-year minimum for logs and fixed periods for some large platforms.

India uses a 'blacklist' approach: transfers are allowed unless the government restricts them, but sector regulators can be stricter.

Indicative costs for getting DPDPA-ready, what drives them, and how they compare with the penalties.

Hospitals, clinics, diagnostic labs, pharmacies, telemedicine and health-tech apps handle patient records, prescriptions, lab reports, insurance details and CCTV. Here is what the DPDP Act means for you and what to fix first.

Edtech apps, schools, colleges, coaching institutes and test-prep platforms handle student profiles, marks, attendance, parents' contacts, video recordings and app usage. Here is what the DPDP Act means for you and what to fix first.

NBFCs, digital lenders, payment aggregators, wealth and insurance-tech platforms handle KYC documents, bank statements, credit scores, transaction data and device data. Here is what the DPDP Act means for you and what to fix first.

Marketplaces, D2C brands, Shopify and WooCommerce stores, quick commerce handle customer accounts, addresses, phone numbers, order history, payment references and marketing lists. Here is what the DPDP Act means for you and what to fix first.

Staffing and recruitment agencies, payroll processors, HR-tech and background verification firms handle CVs, ID proofs, salary data, bank details, background checks and attendance. Here is what the DPDP Act means for you and what to fix first.

Developers, channel partners, brokers, property portals and co-living operators handle buyer enquiries from portals and ads, KYC for bookings, site-visit records and CCTV. Here is what the DPDP Act means for you and what to fix first.

A private limited company has a fixed set of yearly filings, even with zero business. Here they are in one place, with due dates.

Every workplace with 10 or more employees must have an Internal Committee under the POSH Act. Here is what else it requires.

Financial statements and annual return for Private Limited companies, with board and AGM minutes.

Statement of Accounts (Form 8) and Annual Return (Form 11) for LLPs.

Get your business ready for the Digital Personal Data Protection Act before the 13 May 2027 deadline.

KYC for every DIN holder to keep the DIN active and avoid the ₹5,000 reactivation fee.

Monthly books, bank reconciliation, payroll and MIS reports by a dedicated accountant.

ISO/IEC 27001:2022 information security certification, set up so it also covers the DPDP Act's security safeguards.

Internal Committee set-up, POSH policy, awareness training and annual report for employers.

An outsourced Data Protection Officer to run your DPDP Act programme month to month.

Privacy notice, terms of use, refund policy and cookie consent wording for your website or app.

ROC, GST and TDS filings, director KYC and reminders, managed for a fixed monthly fee.