To comply with the DPDP Act, a business must map its personal data, have a lawful ground (consent or a legitimate use) for each purpose, give a clear notice, collect consent through an unticked opt-in, secure the data, report breaches to the Data Protection Board within 72 hours, delete data when no longer needed, answer rights requests within 90 days, and bind vendors by contract. Most of these apply from 13 May 2027.
- Deadline
- 13 May 2027
- Breach report to Board
- Within 72 hours
- Rights requests
- Within 90 days
- Log retention
- At least 1 year
1. Know your data
- List every source of personal data: website and app forms, WhatsApp, calls, CRM, email lists, HR and payroll, CCTV, vendors and partners.
- For each, record what data, why, where it is stored, who can access it, which vendors receive it, and how long you keep it (a 'record of processing').
- Identify children's data (anyone under 18) and data of persons with disabilities.
2. Lawful ground, notice and consent
- Choose the ground for each purpose: consent, or a legitimate use under Section 7 (for example employment, legal obligation, or data voluntarily given for a specific purpose).
- Write a standalone notice (Rule 3) in clear language: the itemised data, the specific purpose, the goods or services it enables, and links to withdraw consent, exercise rights and complain to the Board.
- Offer the notice in English or any of the 22 languages in the Eighth Schedule of the Constitution if the person asks.
- Replace pre-ticked boxes and bundled consent with a separate, unticked opt-in for each purpose that is not essential to the service (marketing is the usual one).
- Make withdrawal as easy as giving consent, for example an unsubscribe link or a 'withdraw consent' button.
- Keep consent records: who, when, which notice version, which purposes.
3. Security and vendors
- Apply Rule 6 safeguards: encryption, masking or tokenisation; access control; logging and monitoring; backups; and a way to detect and investigate unauthorised access.
- Keep logs and the related personal data for at least one year, unless a law requires longer.
- Sign a data processing agreement with every processor (CRM, email tool, cloud host, payroll) requiring equivalent safeguards and breach reporting to you.
4. Breaches
- Write a breach response plan with named owners.
- Prepare templates: the intimation to affected individuals, the immediate intimation to the Board, and the detailed report within 72 hours (Rule 7).
5. Retention, rights and governance
- Set a retention period for each purpose and delete data once the purpose is served or consent is withdrawn.
- Publish the contact details of a DPO or a person who can answer data questions on your website and in your responses (Rule 9).
- Set up a channel for access, correction, erasure, nomination and grievance requests, and answer within 90 days at most (Rule 14).
- For children's data, put verifiable parental consent in place (Rule 10) and stop tracking or targeted ads aimed at children.
- Train staff who handle personal data, and review the programme every year.
If you may be notified as a Significant Data Fiduciary, add an India-based DPO, an annual data protection impact assessment and an independent audit.
Frequently asked questions
What is the first step to DPDP compliance?
Data mapping: list what personal data you collect, from where, why, where it is stored, who receives it and how long you keep it. Every other step depends on it.
Do I need a privacy policy under the DPDP Act?
The Act asks for a notice at or before collection (Section 5 and Rule 3), not just a privacy policy. Most businesses keep both: a short notice at each form, and a full privacy policy for detail.
Can I use one consent for everything?
No. Consent must be specific to a purpose. Essential processing for the service you asked for can sit under one notice, but optional purposes such as marketing need a separate opt-in.
How long does DPDP compliance take?
For a small or mid-sized business, typically 6 to 12 weeks for the core work (mapping, notices, consent, contracts, breach plan), then ongoing upkeep.
More DPDP Act guides
- DPDP Act (DPDPA), 2023: complete guide
- DPDPA 2027 compliance: deadline and roadmap
- Does the DPDP Act apply to my business?
- DPDP Act penalties
- Consent and privacy notice under DPDP
- Data breach reporting under DPDP (72 hours)
- Significant Data Fiduciary (SDF)
- Data Protection Officer (DPO) under DPDP
- Children's data and parental consent
- DPDP Act vs GDPR
- DPDP and marketing (email, WhatsApp, calls)
- Employee and HR data under DPDP
- Data Principal rights and requests
- Data retention and erasure under DPDP
- Cross-border data transfer under DPDP
- DPDP compliance cost in India
See all deadlines on the compliance calendar, or browse the compliance hub.
This guide is general information based on the law as of 25 October 2026, not legal advice. Rules and dates can change by notification; speak to a professional about your situation.