The DPDP Rules started an eighteen-month clock in November 2025. Most of the work is engineering, not legal.

The DPDP Rules were notified in November 2025 and phase in over three stages. The rules establishing the Data Protection Board took effect on notification. Consent Manager registration under Rule 4 comes into force in November 2026, twelve months on. The substantive obligations, notice, consent, security safeguards, breach reporting, retention, data principal rights and the Significant Data Fiduciary duties, become enforceable in May 2027, eighteen months from notification. There is no indication of a further general grace period. The planning caveat we give every client: May 2027 is the wrong date to work back from, because log retention needs about a year to accumulate meaningful history and data mapping gates four other obligations behind it.

There is no small business exemption from the Act itself. If you process the digital personal data of individuals in India, you are a data fiduciary and the obligations apply. What scales with size is the burden of specific obligations rather than whether they apply: the Significant Data Fiduciary duties, a Data Protection Officer, an annual Data Protection Impact Assessment and an annual independent audit, only attach if the government designates you, and designation turns on the volume and sensitivity of what you process and the risk it presents. Most small businesses will not be designated. All of them still need notice, consent, safeguards, retention discipline, a rights process and breach reporting.

A useful share of Rule 6 and almost none of the rest. ISO 27001 gives you an information security management system, access control, cryptography, logging and incident management, all of which map onto the reasonable security safeguards the Rules require, and the audit discipline transfers directly. What it does not give you is anything about consent, because ISO does not care why you hold data. Notice, purpose-scoped consent, withdrawal, purpose limitation and erasure, data principal rights and the breach notification clock are all outside its scope. In practice, an ISO-certified organisation is perhaps a third of the way through a DPDP programme and the remaining two thirds are the parts that touch applications rather than infrastructure.

Shared logins, consistently, and it is not close. Reception desks, clinic counters, retail tills, warehouse terminals and shop-floor kiosks running on an account several people know the password to. A shared account means a record access cannot be attributed to a person, which defeats the role-based access control Rule 6 asks for, defeats your ability to investigate a breach, and defeats any meaningful audit trail. It is also unglamorous to fix and therefore keeps getting deferred. The second biggest is log retention sitting at default, which is usually well under the one year the Rules require.

Discovery and assessment on a mid-sized estate is typically a matter of weeks. Remediation is where the range opens up, and it depends almost entirely on how much of it is application work rather than configuration. An organisation on Microsoft 365 with a tidy estate and few custom applications can complete most of Rule 6 in configuration alone, using entitlements it already holds, in a few months. An organisation with home-grown applications capturing consent as a boolean is facing development work to make consent purpose-scoped and withdrawable, and that is a roadmap item rather than a configuration change. We give you the sequencing and the dependency chain at assessment so the range narrows to something you can plan against.

The Act sets graded financial penalties by category of breach, adjudicated by the Data Protection Board, and the highest bands run into the hundreds of crores per instance. We deliberately do not publish the exact figures on this page, partly because the number is not the useful part and partly because quoting it tends to produce panic buying rather than a sensible programme. The practical point is that the largest penalties attach to failing to take reasonable security safeguards and to failing to notify a breach, which are the two obligations most directly within your engineering control and the two we would prioritise on that basis alone.

Only if you are designated a Significant Data Fiduciary, in which case the DPO must be based in India and answerable to the board or governing body. Everyone else needs a contact point capable of answering data principal requests, published in the notice, but that is a responsibility rather than a statutory office. Our practical advice regardless of designation is to name an accountable individual internally, because obligations with ninety day clocks and seventy two hour clocks fail quietly when they are everybody responsibility and nobody job.

They overlap and they are not the same. CERT-In directions cover cyber incident reporting on a six hour clock, log retention for one hundred and eighty days within Indian jurisdiction, and time synchronisation to NPL or NIC. DPDP covers personal data breaches specifically, reported to the Data Protection Board immediately with a detailed report inside seventy two hours, with its own one year log retention requirement under Rule 6. An incident can trigger both, on different clocks, to different authorities. The underlying controls largely serve both, which is the good news, but the notification processes are distinct and you need a decision tree that routes an incident correctly rather than a single generic plan.

Yes, subject to restrictions the government may specify by notification for particular countries, which is a materially lighter position than the strict localisation many expected during the drafting. What does not go away is your accountability: you remain the data fiduciary regardless of where processing happens, so your contractual chain with processors has to carry security and accountability obligations through, and you have to be able to answer a rights request or execute an erasure across systems you do not operate. That is the practical constraint people underestimate. Where personal data sits in a SaaS product you cannot query, a ninety day rights request becomes a vendor dependency.

Find the data. Not a policy, not a gap assessment against a checklist, and not a consent banner. Every other obligation is downstream of knowing what personal data you hold, where it lives and why you have it, and every organisation that skips this step ends up redoing the work later with less time available. If you want a sense of where you stand before talking to anyone, our free DPDP readiness check walks the same structure we use in a paid assessment and nothing you enter leaves your browser.

Designation is made by the government, based on the volume and sensitivity of the personal data you process, the risk to the rights of data principals, and factors including the potential impact on the sovereignty and integrity of India, electoral democracy, security of the state and public order. It is not a self-assessment and it is not a threshold you can compute yourself. Our practical advice is to look at the obligations that attach, a Data Protection Officer based in India and answerable to the board, an annual Data Protection Impact Assessment and an annual independent audit, and ask how far you are from being able to do those things. Organisations processing very large volumes of consumer data, or sensitive categories at scale, should build assuming designation is plausible, because retrofitting a DPIA discipline onto a live estate costs considerably more than starting with one.

The Act applies to processing of digital personal data within India, and also to processing outside India where it relates to offering goods or services to data principals within India. So a business with no Indian customers at all is largely outside its scope for that customer data. Two caveats matter in practice. First, your own employees and contractors in India are data principals, so workforce data is in scope regardless of where your customers are, and that alone brings most of the obligations into play. Second, if you process on behalf of a customer who is themselves a data fiduciary under the Act, your contractual chain carries obligations through to you. GCCs and Indian development centres serving overseas parents frequently conclude they are out of scope and then find employee data brings them back in.

Yes. Discovery, assessment, tenant configuration and the workshops that go with them are all delivered remotely, and that is how most of our DPDP engagements run. We are based in Gachibowli, Hyderabad and work with organisations across India, with senior engineers travelling for on-site work where a site genuinely needs hands on it, typically for shared-account remediation at counters, tills and shop floors. Initial enquiries get a reply within 4 business hours.