DPDP Compliance Guide 2026
How to comply with the DPDP Act, step by step: the checklist, the roadmap to 13 May 2027, who owns each duty, and the evidence to keep.
This guide assumes you know what the DPDP Act requires. For the law itself, the penalty table and the DPDP Rules 2025 dates, see DPDP Act requirements.
Key Takeaways
- Rules 3 and 5 to 16 of the DPDP Rules 2025, which set out most Data Fiduciary duties, take effect on 13 May 2027. Consent Manager registration opens on 13 November 2026.
- Start with a data inventory and a record of processing: every later duty, from notices to erasure, depends on knowing what personal data you hold and why.
- Each notice must stand on its own and itemize the personal data and purposes (Rule 3), and if consent is questioned you must prove that notice was given and consent obtained (section 6(10)).
- A breach goes to each affected Data Principal and to the Board without delay, with a detailed report to the Board within 72 hours of becoming aware (Rule 7).
- Penalties reach INR 250 crore for failing to take reasonable security safeguards, and the Board weighs the mitigation taken, and how quickly, in setting the amount.
Scope and Roles
Who the Act Covers and Who Carries the Duties
The DPDP Act applies to digital personal data processed in India, and to processing outside India connected with offering goods or services to people in India. A Data Fiduciary decides the purpose and means of processing and carries the duties. A Data Processor processes personal data on its behalf under a contract. A Data Principal is the individual the data relates to, and for a child that includes the parents. Processing needs either consent or one of the legitimate uses in section 7.
The full list of obligations, the commencement dates and the rights are on the DPDP Act requirements page. This guide covers how to implement them.
Penalty Exposure
Penalties reach INR 250 crore per breach. The DPDP Act penalties table sets out every cap, and the DPDP penalty calculator estimates an indicative exposure from an organization's public website.
DPDP Compliance Checklist
The Core Checklist
Work through these in order. The first two items feed every other one, and each later item names the provision it answers to.
Checklist:
- Build an inventory of the personal data you hold, where it sits and who can access it
- Record each processing activity with its purpose, grounds, Data Principals, Data Processors and retention period
- Map each processing activity to consent or to a legitimate use under section 7
- Rewrite each notice so it stands on its own, itemizes the personal data and purposes, and gives the Data Principal the option to read it in English or any language of the Eighth Schedule (section 5(3), Rule 3)
- Capture consent purpose by purpose, keep a record you can produce, and make withdrawal as easy as giving consent (section 6)
- Add verifiable parental consent to every flow a child can reach, and stop tracking and targeted advertising aimed at children (section 9, Rule 10)
- Put the Rule 6 safeguards in place: encryption or masking, access control, logging and monitoring, backups, and one year of logs
- Sign a contract with every Data Processor that binds it to your security safeguards and your erasure instructions (section 8(2) and 8(7)(b), Rule 6(1)(f))
- Publish a contact point and a rights request channel, and answer grievances within your published period of no more than 90 days (Rules 9 and 14)
- Set a retention period per purpose, keep processing records for the one-year minimum in Rule 8(3), and erase personal data once its purpose is served or consent is withdrawn (section 8(7))
- Record where personal data goes outside India, and check each transfer against any restriction the government notifies (section 16, Rule 15)
- Write and rehearse a breach plan that meets the Rule 7 notices and the 72-hour report to the Board
- Check whether you are, or could be notified as, a Significant Data Fiduciary, and plan the DPO, the independent auditor and the annual DPIA if so (section 10, Rule 13)
DPDP Implementation Roadmap
Days 1 to 30: Gap Assessment
Assess every DPDP obligation, control by control, against how the organization processes personal data today. Build the inventory and the record of processing first, because the assessment is only as good as the map it runs on. The outcome is the plan for the three steps that follow, with each gap given an owner and a date.
Checklist:
- Inventory personal data across databases, SaaS apps, file shares and endpoints
- Record each processing activity with its purpose, grounds and retention
- Assess each obligation against current practice and log the gaps
- Give every gap an owner and a target date
Days 31 to 60: Documentation
Write the documents the assessment called for: the privacy policy and procedures, changes to existing policies that touch personal data, consent statements and notices, the clauses every Data Processor contract needs, the retention schedule and the breach plan. Templates for the privacy and business teams keep the next revision consistent.
Checklist:
- Notices and consent statements for each processing purpose
- Privacy policy and procedures, and updates to the policies that touch personal data
- Data Processor contract clauses for security, erasure and breach reporting
- Retention schedule by purpose, and the breach response plan
Days 61 to 90: Implementation
Put the documents to work across technical and organizational measures. That means notice and consent in every collection flow, a ground for each processing activity, the rights request channel and grievance redressal, and retention and erasure. It also covers breach management, impact assessments, Data Processor risk, transfers outside India and, where it applies, the DPO appointment. Large estates take longer than 90 days. The order still holds.
Checklist:
- Consent captured purpose by purpose, with withdrawal as easy as giving it
- Parental consent checks on every flow a child can reach
- A published rights request channel and grievance period
- Security safeguards, logging and one year of log retention in place
- Erasure running against the retention schedule
- A breach drill run against the Rule 7 clocks
Before 13 May 2027, and Every Year After: Audit
An independent evaluator checks how the implementation fared and whether any gap remains before readiness can be claimed. A Significant Data Fiduciary has to repeat a Data Protection Impact Assessment and an audit once in every 12 months, and have the person who carries them out send the Board a report of the significant observations (Rule 13). Every other Data Fiduciary gains from the same rhythm, because processing changes faster than documents do.
Who Owns Each DPDP Duty
A Common Split Across Teams
The Act makes the Data Fiduciary responsible, not any one team, so the work has to be divided. A common split, with the business owning consent, product building the capture and the privacy office consulted:
| Duty | Leads | Works with |
|---|---|---|
| Data inventory and record of processing | Privacy office | Information security, business owners |
| Notices and consent | Business owner | Product, privacy office, legal |
| Children's data and parental consent | Product | Privacy office, legal |
| Security safeguards and logs | Information security | IT, Data Processors |
| Breach detection and containment | Information security | IT, privacy office |
| Breach notices to Data Principals and the Board | Privacy office | Legal, information security |
| Rights requests and grievances | Privacy office | Business owners, IT |
| Data Processor contracts | Procurement | Legal, privacy office |
| Retention and erasure | Business owner | Privacy office, IT |
| DPIA (Significant Data Fiduciaries) | Data Protection Officer | Privacy office, board of directors |
| Annual data audit (Significant Data Fiduciaries) | Independent data auditor | Data Protection Officer, board of directors |
Planning for Significant Data Fiduciary Duties
What Changes When You Are Notified
Every Data Fiduciary carries the core duties. A Significant Data Fiduciary, notified by the Central Government under section 10, carries more on top of them:
| Duty | Every Data Fiduciary | Significant Data Fiduciary |
|---|---|---|
| Notice, consent, security safeguards, breach intimation, retention, rights | Required | Required |
| Contact for Data Principals' questions | A DPO or a person who can answer | A Data Protection Officer based in India, responsible to the board |
| Independent data auditor | Not required | Required |
| Data Protection Impact Assessment and audit | Not required | Once in every 12 months, with a report to the Board |
| Due diligence on algorithmic software | Not required | Required |
| Personal data the government specifies | Transfer rules under section 16 and Rule 15 | Kept in India with its traffic data |
| Maximum penalty for the added duties | Not applicable | INR 150 crore |
Notices and Consent
Notice Checklist (Rule 3)
A notice has to stand on its own: a link to a long privacy policy does not meet Rule 3. Check each notice against these points before it goes live.
Checklist:
- Understandable on its own, without other documents
- An itemized description of the personal data collected
- The specified purposes, and a specific description of the goods, services or uses the processing enables
- A link to withdraw consent as easily as it was given
- How to exercise rights under the Act
- How to complain to the Data Protection Board
- The option to read it in English or any language of the Eighth Schedule to the Constitution (section 5(3))
- The contact details of the DPO, or of the person authorized to respond on rights (section 6(3))
- For consent collected before the Act commenced, a notice sent as soon as reasonably practicable (section 5(2))
Proving Consent
Where consent is the basis for processing and a question arises in a proceeding, the Data Fiduciary has to prove that notice was given and consent obtained (section 6(10)). That makes the record as important as the consent itself: which notice version the person saw, which purposes they agreed to, when, and when they withdrew.
A Data Principal may also give, manage and withdraw consent through a Consent Manager registered with the Board. Registration under Rule 4 opens on 13 November 2026.
Data Principal Rights Request Workflow
Handling a Request Under Rule 14
Rule 14 requires every Data Fiduciary to publish how a Data Principal makes a request and the identifier it needs to find them, such as a username, customer ID, email address or mobile number. From there, each request runs through the same steps.
Checklist:
- Publish the request channel and the identifier you need (Rule 14(1))
- Verify the requester against those particulars
- For access, provide a summary of the personal data and processing, and every Data Fiduciary and Data Processor it was shared with (section 11)
- Correct, complete or update personal data, and erase it unless the purpose or a law requires keeping it (section 12)
- Record nominees, and act on a nominee's request after the Data Principal's death or incapacity (section 14, Rule 14(4))
- Answer grievances within your published period of no more than 90 days (Rule 14(3))
- Include your contact point in every response (Rule 9)
- Keep a record of each request, the date received and the date answered
Breach Response Workflow
The Rule 7 Clocks
Both clocks start when the Data Fiduciary becomes aware of the breach, so record that time first. Affected Data Principals and the Board are told without delay, and the Board receives a detailed report within 72 hours, or a longer period the Board allows on a written request.
Checklist:
- Contain the breach and record the time you became aware of it
- Tell each affected Data Principal, through their account or registered channel: the nature, extent and timing, the likely consequences, the mitigation, the steps they can take and a contact
- Tell the Board without delay: the nature, extent, timing, location and likely impact
- Within 72 hours, send the Board the updated details, the facts and reasons, the mitigation, any findings on who caused it, the remedial measures and a report on the notices to Data Principals
- Log every step in the breach register
- Fix the cause and review the safeguards it got past
DPDP Compliance Evidence
What to Keep for an Inquiry by the Board
The Board decides on evidence, and the burden of proving notice and consent sits with the Data Fiduciary. Keep these ready to produce:
Checklist:
- Every version of every notice, with the dates it was live
- Consent records per purpose, including withdrawals
- The record of processing: purpose, grounds, Data Principals, Data Processors and retention for each activity
- Signed Data Processor contracts with security and erasure clauses
- The security safeguards in place, and at least one year of logs (Rules 6 and 8)
- The breach register, each notice to Data Principals and each report to the Board
- Rights requests and grievances, with the dates received and answered
- Retention schedules and erasure records, including, if you are in a Third Schedule class, the notice Rule 8(2) requires at least 48 hours before erasure
- For a Significant Data Fiduciary, the DPIA and audit reports and what was sent to the Board
Common DPDP Compliance Mistakes
Where Programs Go Wrong
Treating the privacy policy as the notice. Rule 3 asks for a notice that stands on its own and itemizes the personal data and purposes for each request for consent.
Bundling purposes into one consent. Consent covers only the personal data each specified purpose needs (section 6(1)), so a single tick across several purposes is hard to defend.
Forgetting the processors. The Data Fiduciary stays responsible for processing done on its behalf (section 8(1)), and has to make its processors erase personal data too (section 8(7)).
Deleting the logs with the data. Rule 8(3) requires the personal data, its traffic data and the logs of each processing to be kept for at least one year from the date of processing, even after the purpose is served, and erased after that unless another law requires longer.
Starting the breach clock late. The 72 hours run from becoming aware of the breach, so record the moment of awareness when it happens.
Waiting for 13 May 2027. The inventory, the notices and the processor contracts take months, and the 18 months the Rules allow end on that date.
Key Terms
- Data Fiduciary
- A Data Fiduciary under India's DPDP Act is any person or entity that alone or in conjunction with others determines the purpose and means of processing digital personal data, analogous to a data controller under the GDPR.
- Data Protection Board
- A Data Protection Board is a regulatory body established to oversee and enforce data protection laws, such as the Data Protection Board of India under the DPDP Act or the European Data Protection Board under the GDPR.
- Significant Data Fiduciary
- A Significant Data Fiduciary is a designation under India's DPDP Act for Data Fiduciaries that process large volumes of personal data, carrying additional obligations including appointing a DPO and conducting impact assessments.
Tools That Help
Frequently Asked Questions
When does DPDP Act compliance become mandatory?
Rules 3 and 5 to 16 of the DPDP Rules 2025, which cover notice, security, breach intimation, retention, children's data, Significant Data Fiduciaries and rights, come into force on 13 May 2027, 18 months after the Rules were notified on 13 November 2025. Rule 4 on Consent Managers comes into force on 13 November 2026, and the rules on the Data Protection Board have applied since 13 November 2025.
Does the DPDP Act apply to companies outside India?
Yes. The DPDP Act applies to processing of digital personal data outside India where it is connected with offering goods or services to Data Principals in India. A global organization that collects personal data from people in India in that way has to comply.
What is the first step in DPDP Act compliance?
A data inventory and a record of processing. Every later duty depends on knowing what personal data you hold, where it sits, why you process it and on what ground, from the notice you show to the erasure you schedule.
How long does a Data Fiduciary have to answer a grievance?
No more than 90 days. Rule 14(3) requires every Data Fiduciary to publish its response period for grievances, within 90 days, and to put measures in place to meet it.
How can IQWorks help with DPDP Act compliance?
DiscoverIQ finds personal data across databases, SaaS apps, file shares and endpoints. ComplyIQ keeps the RoPA, drafts notices and translates them into the 22 scheduled Indian languages, runs the Data Principal request queue and the breach register with its 72-hour countdown, and scores your posture against DPDP controls. ConsentIQ captures consent purpose by purpose with a digitally signed record, and checks parents through DigiLocker.
Related Solutions
Notices, consent, children's data, rights requests and breaches for the DPDP Act, on one inventory.
Every personal data breach in one register, with the Board's 72-hour window tracked.