DPDP Compliance in India: What the DPDP Act and DPDP Rules Mean for Your Business, and How to Get Ready Before May 2027

Why DPDP Compliance Is Now a Board-Level Priority

DPDP compliance is no longer a 2027 problem. India’s Digital Personal Data Protection framework switches on in stages: the Consent Manager rules take effect on 13 November 2026, and almost every operational duty, from consent and security to breach reporting, becomes enforceable on 13 May 2027. That leaves most businesses one budget cycle to get ready.

The financial stakes have changed too. The IBM Cost of a Data Breach Report 2026 puts the average cost of a breach in India at a record ₹25.5 crore, up 15.9% in a year. That figure is before a single rupee of DPDP penalty, which can reach ₹250 crore per instance.

Yet most of India Inc is still at the starting line. An EY survey found that more than 83% of organisations had not begun end-to-end implementation across their systems and processes.

Having sat on both sides of the table, in finance and in technology, I see the same mistake repeated. Businesses hand DPDP to the legal team, receive a new privacy policy, and consider the job done. But the largest penalty in the Act is not for a badly worded notice. It is for failing to keep data secure, and that is an IT failure. Policies don’t stop breaches; controls do.

This guide explains what the DPDP Act and DPDP Rules require, what non-compliance costs, and a practical roadmap for getting compliant before May 2027. It is written for two readers: the owner or CFO who must approve the budget, and the IT head who must make it work.

Key Takeaways

• Deadlines: Consent Manager rules from 13 November 2026; full DPDP compliance from 13 May 2027.
• Maximum penalty: up to ₹250 crore per instance for failing to take reasonable security safeguards.
• Breach reporting: inform the Data Protection Board and every affected person without delay, with a detailed report to the Board within 72 hours.
• The real work is IT: encryption, access control, logging, backups and vendor controls carry most of the compliance burden, and the heaviest penalties.
• Your first step: map where personal data lives across your systems, devices and vendors. You cannot protect what you cannot find.

What Is the DPDP Act? The Digital Personal Data Protection Act Explained

The DPDP Act received Presidential assent in August 2023. It sets the principles. The DPDP Rules, 2025, notified by the Ministry of Electronics and Information Technology (MeitY) in November 2025, supply the operating detail: what a notice must contain, which security safeguards are expected, and how fast a breach must be reported.

Who Does the DPDP Act Apply To?

The Act applies to any organisation that processes digital personal data in India. That includes data collected digitally, and data collected on paper and digitised later. It also applies to processing outside India when it relates to offering goods or services to people in India. An Indian SaaS company, a Raipur steel plant with 800 employees and a foreign e-commerce site selling into India are all covered.

There is no turnover or headcount threshold. If your business holds names, phone numbers, email addresses, PAN details, salary records or bank details of identifiable people, the Act applies to you.

What the DPDP Act Does Not Cover

• Personal data processed by an individual for purely personal or domestic purposes.
• Personal data that the individual has made publicly available, or that is made public under a legal obligation.
• Non-digital data that is never digitised.

Unlike Europe’s GDPR, the DPDP Act has no separate category of “sensitive” personal data. A customer’s phone number and an employee’s salary slip carry the same legal protection. This simplifies classification, but it also means no data set can be treated as low-stakes.

How the DPDP Regime Changes the Old Rules

Until now, Indian data protection rested on Section 43A of the IT Act, 2000 and the SPDI Rules, 2011. The table shows what changes.

Note: the SPDI Rules continue to govern consent, notice, rights and security until the DPDP’s substantive provisions commence in May 2027. Until then, businesses have obligations under both regimes, and the transition period is not a compliance vacuum.

Key DPDP Terms Every Business Must Know

The DPDP Act assigns obligations by role, not by industry. So start by asking one question: what role do we play with this data? Most businesses are a Data Fiduciary for their own customer and employee data, and a Data Processor when they handle data for clients.

One practical point for CFOs: becoming a Data Processor does not move liability off your books. Under the Act, the Data Fiduciary remains responsible for whatever its processors do with the data. Your vendor contracts are therefore part of your risk position.

DPDP Rules 2025: What Changed and When Each Rule Applies

The Three-Phase Rollout

The Rules were notified on 13 November 2025 and published in the Gazette on 14 November 2025, so some sources cite 14 May 2027 as the final date.

The phasing is deliberate. The Government has given businesses 18 months because the heavy work, such as rebuilding consent flows, deploying security controls and renegotiating vendor contracts, takes time. A business that starts in March 2027 will not finish by May.

Latest Development: The DPDP (Removal of Difficulties) Order 2026

MeitY issued the DPDP (Removal of Difficulties) Order, 2026 on 5 October 2026, and it was published in the Gazette on 7 October. It makes two textual clarifications to the Act.

• The first fixes how the Act words the rules on children’s data and the data of persons with disabilities.
• The second changes “audit” to “data audit” in the duties of Significant Data Fiduciaries.

The Order creates no new compliance obligations. What it does signal is that the Government is actively tidying the framework ahead of enforcement, not slowing it down. Businesses that may be designated as SDFs should update their audit plans to reflect the “data audit” wording.

Why Significant Data Fiduciaries Cannot Wait for 2027

In January 2026, MeitY sought industry views on accelerating DPDP implementation, including a proposal to shorten the compliance window from 18 months to 12 months, particularly for large data fiduciaries. Officials said no final decision had been taken. If the proposal is adopted, large enterprises could face substantive duties as early as November 2026. Prudent boards are planning to the earlier date.

Core DPDP Compliance Obligations, Explained

1. Notice and Consent Requirements

Most businesses already ask for consent. The real question is whether that consent would hold up under the DPDP Act. Consent must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and limited to the data needed for the stated purpose. Withdrawing consent must be as easy as giving it.

Under Rule 3, the notice must stand on its own, not be buried in your terms and conditions. It must be in clear, plain language and give an itemised description of the data collected and the specific purpose. It must also include a link to withdraw consent, exercise rights and complain to the Board. The individual can ask for the notice in English or any of the 22 languages in the Eighth Schedule of the Constitution.

For data collected before the Act took effect, you may continue processing, but you must send a fresh notice as soon as reasonably practicable. Individuals can then withdraw consent.

2. Employee Data: What the Employment Carve-Out Does and Doesn’t Cover

Many businesses assume employee data falls outside the purview of the DPDP Act. It doesn’t.

What the Act does is give employers one concession. Under Section 7(i), the employer is not required to seek an employee’s consent to use their data for employment purposes. That covers the everyday work of running a business:

• running payroll
• tracking attendance
• controlling access to offices and systems
• making statutory filings
• protecting confidential business information

So the employer can skip the consent step. However, the responsibility to protect the data, report any breach, and delete it when no longer needed will still be with the employer. Whatever the reason you hold the data, the duties in Section 8 still apply:

• reasonable security safeguards for HR and payroll systems (Section 8(5))
• breach reporting if employee data is compromised (Section 8(6))
• erasure once the purpose is served and no law requires retention (Section 8(7))
• valid contracts with payroll, HRMS and background-verification vendors

A point for HR heads: employees do not have the same data rights as customers

Sections 11 and 12 of the DPDP Act cover these rights.

The wording of these sections is important. It ties the rights to two situations: data processed with the person’s consent, and data the person handed over voluntarily under Section 7(a). It does not mention data processed for employment purposes under Section 7(i).

As a result, an employee does not have the same clear right as a customer to see or erase their data. The right to raise a grievance still applies to everyone.

The courts and the Data Protection Board have not yet ruled on this point. Before you turn down an employee’s request on this basis, check with your legal adviser.

A caution on monitoring employees

The employment carve-out does not allow unlimited monitoring of staff. It covers what is needed to run the employment relationship and protect the business.

Some employers have added broad surveillance clauses to employment contracts and labelled them as employment purposes. Legal commentators have questioned whether such clauses are valid under the DPDP Act.

The safer approach is to monitor only for a clear security reason. Write that reason down. Limit monitoring to company devices and systems. Tell employees what you monitor and why.

3. Purpose Limitation, Retention and Erasure

Personal data may be kept only as long as its purpose requires, unless a law demands longer retention. Your GST, Companies Act and labour-law retention periods still apply. Once the purpose ends, the data must be erased, and your processors must erase their copies too.

Two specific rules apply:

• Minimum retention of logs (Rule 8(3)): fiduciaries must keep personal data, associated traffic data and processing logs for at least one year, for purposes such as investigation and regulatory requests.
• Inactivity erasure (Rule 8 and the Third Schedule): large e-commerce platforms, online gaming intermediaries and social media intermediaries must erase data of users inactive for three years, after giving 48 hours’ notice. Most SMEs fall below these thresholds, but the principle of defined retention applies to everyone.

For IT teams, this is a data-engineering task. Erasure must reach production databases, backups, email archives, shared drives and vendor systems.

4. Reasonable Security Safeguards (Rule 6)

This is where DPDP becomes an IT programme, and where the heaviest penalty sits. Section 8(5) requires every fiduciary to take reasonable security safeguards to prevent personal data breaches. Rule 6 sets out the minimum.

Note the word “reasonable”. The Board will judge your safeguards against your size, the volume and nature of data you hold, and what a prudent organisation would do. An unencrypted laptop containing 50,000 customer records is unlikely to be judged reasonable in 2027.

5. Personal Data Breach Notification

If a personal data breach occurs, the fiduciary must:

• Inform each affected person without delay. Explain what happened, the likely consequences, what you are doing, the safety steps they can take, and who to contact.
• Inform the Data Protection Board without delay with an initial description of the breach.
• Send the Board a detailed report within 72 hours. Cover the facts and causes, mitigation, the person responsible where known, remedial measures, and the notices given to individuals.

Two points surprise most boards. First, DPDP has no materiality threshold: unlike GDPR, every personal data breach must be reported, not only those likely to cause harm. Second, CERT-In’s existing six-hour cyber incident reporting rule continues alongside DPDP. A single incident can therefore trigger two reporting clocks.

You cannot report in 72 hours what you cannot detect. The 72-hour rule is in practice a test of your monitoring, logging and incident response.

6. Children’s Data and Verifiable Parental Consent

Under the DPDP Act, a child is anyone under 18. Processing a child’s data requires the verifiable consent of a parent or lawful guardian. Rule 10 expects the fiduciary to confirm that the person consenting is an identifiable adult, for example through reliable identity details or a virtual token such as DigiLocker. Tracking, behavioural monitoring and targeted advertising aimed at children are prohibited.

Certain classes, such as clinical establishments, educational institutions and childcare providers, have limited exemptions for specific purposes. Schools, edtech platforms, hospitals and consumer brands with young audiences should treat this as a priority. The penalty for breaching children’s data obligations is up to ₹200 crore.

7. Data Principal Rights and 90-Day Grievance Redressal

Individuals have the right to:

• access a summary of their data and how it is processed
• correct, complete, update or erase their data
• have a grievance addressed
• nominate someone to act for them on death or incapacity

You must publish how these rights can be exercised and respond to grievances within 90 days (Rule 14). Where the Act requires it, you must also publish the contact details of a Data Protection Officer or a person who can answer questions about data processing. For most SMEs, the practical need is a simple request intake, an identity check, and a tracker that proves you met the deadline.

8. Vendor and Processor Accountability

You can outsource processing, but not accountability. Every processor must work under a valid contract, and the fiduciary remains liable for the processor’s failures. That covers your cloud host, payroll provider, CRM, email platform, courier partner and IT support vendor.

The IBM 2026 report found supply-chain compromise was the initial attack vector in 15% of Indian breaches. Re-papering vendor contracts with security, breach-notification and erasure clauses is one of the fastest risk reductions available.

Significant Data Fiduciaries: The Additional Duties

Designations are expected to focus on large technology platforms, banks, insurers and similar high-volume processors. Most SMEs will not be SDFs. Many, however, will be vendors to SDFs, and SDFs will push their audit and security expectations down their supply chains through contracts. Being demonstrably compliant is fast becoming a condition of winning enterprise business.

DPDP Act Penalties: What Non-Compliance Really Costs

Read the top two rows together. A single ransomware incident can expose a business to ₹250 crore for weak security and ₹200 crore for a late or missing breach report. Both are failures of IT controls, not of legal drafting.

How the Board Decides the Penalty

Under Section 33, the Board weighs:

• the nature, gravity and duration of the breach
• the type and nature of personal data affected
• whether the breach is repeated
• any gain made or loss avoided by the business
• the steps taken to mitigate the effects, and how promptly
• whether the penalty is proportionate and effective
• the likely impact of the penalty on the business

This is where preparation pays. A business that can show encryption, logs, a tested response plan and prompt notification is arguing mitigation from a position of strength. A business that discovers the breach from a customer’s complaint is not.

The Hidden Cost: What a Breach Costs Before Any Penalty

For a CFO, the statutory penalty is only the visible part of the exposure. According to IBM’s 2026 India data, the average Indian breach now costs ₹25.5 crore and compromises 39,500 records. Financial services average ₹40.9 crore per breach. IBM also lists non-compliance with regulations among the top three factors that raise breach costs in India.

Add operational downtime, customer churn, lost tenders, higher cyber-insurance premiums and management time, and the business case changes shape. Compliance spending is not a cost centre. It is insurance against a loss that is now quantifiable.

Why DPDP Compliance Is 70% an IT Problem

Policies don’t stop breaches; controls do. A privacy notice cannot detect an intruder, a consent form cannot encrypt a laptop, and a policy document cannot produce a 72-hour breach report. The Board will not ask whether you had a policy. It will ask what happened, how you found out, and what you had in place to prevent it.

Where Personal Data Actually Lives in an Indian SME

Ask most SME owners where their customer data is, and they will say “in Tally” or “in the ERP”. The honest answer is: everywhere.

• Accounting and ERP systems: Tally, Busy, Marg and ERP databases holding customer, vendor and employee records.
• Email inboxes: invoices, KYC documents, salary slips and CVs sitting in years of attachments.
• Shared drives and desktops: Excel exports of customer lists, dealer databases and payroll sheets.
• Staff laptops and phones: local copies, downloads and WhatsApp media folders.
• USB drives and old backups: forgotten copies that are never encrypted and never erased.
• Vendor systems: payroll providers, CRMs, courier partners and cloud hosts.

Each of these locations is in scope. DPDP compliance therefore starts with data discovery, finding and classifying personal data across systems, and not with drafting.

Shadow IT and GenAI: The Compliance Gap No One Is Mapping

The fastest-growing blind spot is data that leaves your controlled systems through tools IT never approved. An accounts executive forwards a customer list to a personal Gmail to work from home. A sales team runs dealer communication through personal WhatsApp groups. An HR executive pastes a salary sheet into a public AI chatbot to “tidy up the formatting”.

In each case, personal data is now being processed outside your control. There is no processor contract, no log, no access control, and no way to erase it. If that data is exposed, it is still your breach.

The numbers confirm the risk. IBM’s 2026 report found that shadow AI, meaning AI tools used without IT oversight, adds an average of ₹1.79 crore to the cost of a breach in India. The same report found that 26% of malicious breaches in India were AI-generated.

The answer is not to ban AI. It is to govern it:

• an acceptable-use policy that says which tools may handle which data
• Data Loss Prevention (DLP) rules that block uploads of personal data to unapproved websites and personal storage
• Unified Endpoint Management (UEM) to control which applications run on company devices
• web filtering at the firewall for unapproved AI and file-sharing services
• approved, enterprise-grade AI tools covered by proper processor terms

The Attack Vectors DPDP Penalises

IBM’s 2026 India data shows the most common ways breaches begin:

• Phishing, including voice and SMS phishing: 19% of breaches. The defences are email security, MFA and staff awareness.
• Drive-by compromise: 16%. The defences are endpoint protection, patching and web filtering.
• Supply-chain compromise: 15%. The defences are vendor security clauses, access limits and monitoring.

Every one of these is a gap in IT controls. When the Board asks whether your safeguards were “reasonable”, it will be asking, in effect, whether you had these defences in place.

The India Inc Readiness Gap

The surveys show how far most organisations still have to go:

• About 71% of organisations have only a limited understanding of the DPDP Act and Rules (EY).
• Only 48% have started a gap assessment, the most common first step (EY).
• Nearly 80% have not updated their privacy policies or governance frameworks for DPDP (EY).
• More than 83% have not begun end-to-end implementation across systems and processes (EY).
• 75% of enterprises lack a dedicated privacy budget (IDfy and MIT Sloan Management Review India).

These surveys are weighted towards larger enterprises. In my experience, readiness among SMEs is lower still, because most have no dedicated security or compliance function at all.

Three Illustrative SME Breach Scenarios

These are illustrative scenarios, not real cases.

Scenario 1: The stolen laptop. An accounts executive’s laptop is stolen from a car. It holds an unencrypted Tally backup with 30,000 customer records, including phone numbers and bank details.

• DPDP exposure: Section 8(5) security safeguards (up to ₹250 crore) and Section 8(6) breach notification to the Board and all 30,000 customers.
• What would have prevented it: full-disk encryption, managed through UEM, with remote wipe. With the data encrypted, the theft becomes a hardware loss rather than a data breach.

Scenario 2: Ransomware with no way back. Ransomware encrypts the file server holding payroll and dealer records. The backups were on a NAS on the same network, so they are encrypted too.

• DPDP exposure: security safeguards, breach notification, and Rule 6’s requirement to maintain continuity through backups.
• What would have prevented it: endpoint detection, network segmentation at the firewall, and offsite or cloud backups isolated from production and tested regularly.

Scenario 3: The helpful chatbot. An HR executive pastes a salary sheet with 400 employees’ names, PANs and bank details into a free AI chatbot to reformat it.

• DPDP exposure: unauthorised processing outside any processor contract, security safeguards, and possible breach reporting. The employment carve-out does not cover this.
• What would have prevented it: DLP policies that detect PAN and bank-account patterns and block uploads to unapproved sites, plus an approved enterprise AI tool.

The DPDP Compliance Stack

Think of DPDP compliance as three layers. Governance and process matter, but technology carries most of the weight and most of the penalty exposure.

• Governance (about 15%): policies, notices, roles, board oversight.
• Process (about 15%): rights workflows, vendor contracts, retention schedules, training.
• Technology (about 70%): data discovery, encryption, access control, DLP, endpoint security, monitoring, logging, backup and recovery.

The percentages are an illustrative view of where effort and cost fall in a typical SME programme, not survey data.

DPDP Compliance Checklist: A 10-Step Roadmap to May 2027

1. Appoint an owner. Name one accountable executive and a small cross-functional group from IT, HR, finance and legal. DPDP fails when it belongs to everyone.
2. Map your data. Build an inventory of what personal data you hold, where it sits, who can access it, which vendors receive it, and why you hold it. Use discovery tools rather than surveys alone, because people do not know what is on their laptops.
3. Run a gap assessment. Compare current practice against each obligation in the Act and Rules, and rank the gaps by penalty exposure and effort. Start with security and breach response, where the penalties are largest.
4. Redesign notices and consent. Rewrite notices to Rule 3’s standard, separate consent by purpose, build a withdrawal mechanism, and send fresh notices for legacy data. Document which processing relies on legitimate uses such as employment.
5. Implement the Rule 6 security safeguards. Encryption, access control with MFA, endpoint protection, DLP, centralised logging with one-year retention, and isolated, tested backups. This is the largest workstream and the one to fund first.
6. Build and test a 72-hour breach plan. Define who decides, who notifies the Board, who tells customers, and who handles CERT-In’s six-hour report. Run a tabletop exercise before May 2027, not after the first incident.
7. Define retention and erasure. Set retention periods by data type, aligned with tax, company and labour law, and make sure erasure reaches backups, archives and vendors.
8. Re-paper vendor and processor contracts. Add security standards, breach-notification timelines, audit rights, sub-processor controls and erasure on exit.
9. Set up a rights and grievance workflow. Provide a simple intake channel, identity verification and a tracker that evidences responses within 90 days.
10. Train staff and audit continuously. Run phishing simulations and DPDP awareness sessions, review access quarterly, and test your controls at least once a year. Keep the evidence, because the Board will ask for it.

A Phased Plan for the Next Seven Months

What to Look For in a DPDP Compliance Solution

The market is filling with tools that claim to make you “DPDP compliant in a week”. Be sceptical. A consent banner does not encrypt a database, and a policy generator does not detect a breach. Evaluate any DPDP compliance solution, or combination of solutions, against these questions:

For most SMEs, the practical answer is a combination: a legal partner for notices and contracts, a consent tool if you collect data at scale online, and a technology partner who can deploy and run the security, monitoring and recovery controls that make up most of the work.

How HRM Technologies Helps You Get DPDP-Ready

If DPDP compliance is 70% an IT problem, it needs an IT partner. For 25 years, HRM Technologies has helped Indian businesses, from steel plants and transport companies to tax practices, run secure, reliable IT. DPDP turns much of that work from good practice into a legal obligation.

Mapping DPDP Requirements to HRM Services

How an Engagement Works

• Consultation and DPDP IT readiness assessment. We map where personal data sits across your servers, endpoints, email, cloud and vendors, and assess your current controls.
• Gap mapping against DPDP. We match each finding to the relevant DPDP obligation and penalty tier, so the CFO sees a prioritised, costed plan rather than a technical wish-list.
• Implementation. We deploy the controls: encryption, DLP, endpoint security, firewall, backup and secure hosting, with minimal disruption to operations.
• Monitoring and ongoing support. We provide proactive monitoring, 24/7 support, regular reviews and the documentation you need to demonstrate compliance to the Board.

Why HRM Technologies

• 25 years in business, serving 2,700+ SME customers across India.
• 85% repeat customers, a measure of trust earned over decades, not campaigns.
• 300+ person-years of combined technical experience.
• Multi-OEM partnerships across cloud, security and backup, so recommendations fit your needs rather than one vendor’s catalogue.

As one client, Samkit Jain, Director at a tyre showroom, put it: “They have solved our data protection issues in quick time.”

A Note on Scope

DPDP compliance needs both legal and technical expertise. HRM Technologies delivers the technology controls and the evidence they generate. Privacy notices, consent wording and contract terms should be prepared with your legal counsel, and we work alongside them to make sure what the documents promise is what your systems deliver.

Conclusion: Start Now, Not in April 2027

The deadlines are already set:

• 13 November 2026: the Consent Manager rules come into force.
• 13 May 2027: every business must be fully compliant with the DPDP Act.

You have about seven months. Starting now gives you time to do this properly.

Here is why it matters:

• A data breach in India costs a business ₹25.5 crore on average.
• The DPDP Act can add a penalty of up to ₹250 crore for weak security.

Getting compliant costs far less than either of these.

You can take three steps this quarter:

• Name one person to own DPDP compliance.
• Map your data. Find out what personal data you hold and where it is stored.
• Check your security controls against the safeguards listed in Rule 6.

Your privacy policy and consent forms matter, and your legal team should get them right. But if something goes wrong, the Data Protection Board will look at what your systems actually did, not just what your documents said.