Get DPDP-ready before the deadline.
India’s Digital Personal Data Protection law changes how every business handles customer and employee data. Understand what it asks of you, and fix the technology behind it.
around 13 May 2027
India’s data protection law. It sets rules for how any organisation collects, uses, stores and shares the personal data of people in India.
Any business that handles personal data of individuals in India: customers, employees, leads and users. This includes small businesses and companies outside India that serve people in India.
The detailed Rules were notified in November 2025. Most duties start about 18 months later, so the time to map your data and fix your systems is now.
What happens, and when
The Rules start in stages. Dates are approximate: confirm them in the official notification.
- Aug 2023The Act becomes law
The Digital Personal Data Protection Act, 2023 receives the President’s assent.
- Nov 2025The Rules are notified
The DPDP Rules, 2025 are notified on 13 November and published on 14 November. Some enabling provisions start at once.
- Around Nov 2026Consent managers
The rules for registering consent managers start about 12 months after publication.
- Around May 2027Main duties apply
Notice, consent, security safeguards, breach reporting, children’s data and data principal rights start about 18 months after publication.
Penalties can be very large
The Act sets maximum fines, set by the Data Protection Board according to the case.
Failing to keep reasonable security safeguards to prevent a personal data breach.
Failing to notify the Data Protection Board and affected people of a breach, or breaching duties on children’s data.
Failing to meet the additional duties of a Significant Data Fiduciary.
Eight duties, in plain words
Each one is also a technology task: forms, systems, security and records.
Tell people, in plain language, what data you collect, why, and how to withdraw consent or complain.
Technology AdvisoryAsk for consent that is free, specific, informed and clear, and make it as easy to withdraw as to give.
Custom Business ApplicationsUse personal data only for the purpose you stated, and keep it only as long as that purpose needs.
Enterprise Data IntegrationProtect data with safeguards such as encryption, access control, logging and backups, so a breach is prevented or contained.
Security ConsultingTell the Data Protection Board and affected people about a breach, and send a detailed report to the Board within 72 hours.
Security MonitoringGet verifiable parental consent for anyone under 18, and avoid tracking or targeted advertising aimed at children.
Custom Business ApplicationsLet people see a summary of their data, correct it, have it erased, nominate someone, and complain to you first.
Workflow DigitizationKeep traffic data and processing logs for at least one year, then erase data you no longer need.
Backup & Disaster RecoveryWhere do you stand today?
Ten quick yes or no statements. You get a simple rating and the gaps to close first, and you can send the result to a consultant if you want help.
- Nothing is stored unless you send it to us
- Based on the technical duties in the Act and Rules
- A self-check, not a legal audit
Tick what is true for your business today. Be honest: this is just for you.
A clear path from today to ready
We handle the technology and operations side, working with your legal adviser.
- 01Map your data
Find where personal data enters, where it lives and who can reach it: website forms, CRM, email, spreadsheets, apps and vendors.
- 02Check the gaps
Compare what you do today with what the Act and Rules ask for, and rank the gaps by risk.
- 03Fix notices and consent
Update forms, notices and consent records so each choice is clear, recorded and easy to withdraw.
- 04Strengthen security
Add access control, multi-factor login, encryption, backups and logging where the review shows gaps.
- 05Plan for a breach
Write a response plan, test it, and set up the monitoring and logs you would need to report one.
- 06Train and keep it running
Brief your team, set up ways to handle people’s requests, and review regularly as the Rules settle.
Bedre is a technology company, not a law firm. We do not give legal advice or certify compliance. Your legal adviser confirms what the law requires of your business.
Common DPDP questions
Short answers to what businesses ask first.
Yes. The Act applies to any organisation that handles personal data of people in India, whatever its size. Some duties are heavier for large or high-risk organisations, called Significant Data Fiduciaries.
It can. The Act covers processing outside India when it relates to offering goods or services to people in India.
Any data about an identifiable person: name, phone number, email, address, account details, location and similar. It covers digital data, and paper records that are later digitised.
Most duties for businesses start about 18 months after the Rules were published in November 2025, which is around May 2027. Confirm the exact dates with your legal adviser.
The organisation that decides why and how personal data is processed. That is usually you, the business. Vendors that process data for you are called data processors.
Generally yes, except to countries the government restricts. Check the current notifications and your sector rules, which can be stricter.
We help with the technical and operational side: data mapping, forms and consent flows, security controls, logging, backups and breach readiness. We are not a law firm, so we do not give legal advice or certify compliance. Your legal adviser confirms what the law requires.
This page is general information, not legal advice. It summarises public commentary on the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. Read the official text and take legal advice before you rely on any detail or date.
Start your DPDP readiness today.
A consultant replies with questions and a proposed next step. No sales script.