India’s DPDP Act: a practical readiness guide for businesses

When do the Act and Rules take effect?

The 13 November 2025 commencement notification brings different sections of the Act into force on different dates. The Rules notification has its own phased schedule.

The notifications specify the exact provisions and dates by reference to publication. Verify the operative date, amendments and any corrigenda with current official sources and legal counsel; not every obligation starts on the same day.

Who and what may be covered?

The Act addresses digital personal data processed in India and, in certain circumstances, processing outside India connected with offering goods or services to people in India. It contains conditions and exemptions. A data fiduciary determines the purpose and means of processing; a data processor processes data on its behalf. Individuals whose data is processed are called data principals.

Whether a particular company, activity or dataset is covered depends on the facts, the statutory text, exemptions and commencement. Avoid assuming that using a security tool or holding a SOC 2 report automatically establishes DPDP compliance.

A practical DPDP readiness checklist

These are preparation steps to discuss with counsel, not a complete statement of legal duties:

1. Map personal data. Identify where digital personal data is collected, why it is used, which teams and vendors access it, where it is stored and when it is deleted.
2. Assess roles and grounds. Identify the entity deciding why and how data is processed, processors acting on its behalf, and the applicable grounds for each activity.
3. Review notices and consent flows. Examine what people are told, how any consent is obtained and recorded, and how withdrawals are handled when applicable.
4. Prepare rights and grievance workflows. Identify owners, intake channels and procedures for requests, correction, erasure and grievances as applicable.
5. Review security and breach response. Assess access controls, vendor arrangements, incident escalation and the ability to identify affected records. Check the applicable notification requirements as they come into force.
6. Review retention and special cases. Examine retention purposes, deletion workflows, children’s data and whether additional obligations could apply to a designated significant data fiduciary.
7. Assign owners and track changes. Record decisions, remediation, evidence and dates; monitor government notifications and update the plan with legal advice.

Example: a customer-support workflow

A SaaS company receives support tickets containing customer contact details and screenshots. Its team can document which data is collected, the support purpose, access permissions, the ticketing vendor, retention period and escalation contact. It can then check its notices, contracts, deletion process and incident plan against the legal requirements that apply to that processing.

This inventory can also help with a security program such as SOC 2, but the two assessments have different purposes. See our evidence checklist for examples of security records.

Government sources and updates

• Digital Personal Data Protection Act, 2023
• Act commencement notification
• MeitY: Rules, corrigendum and notifications

Educational overview as of November 2026, not legal advice. The law, notifications and their application may change; seek advice for your organization’s circumstances.