DPDP full obligations from 13 May 2027: a six-step readiness plan

With main DPDP obligations applying from 13 May 2027, a practical six-step plan to get your organisation ready.

The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 introduce India's first comprehensive data protection regime. The Rules phase in obligations over time, with Consent Manager provisions from November 2026 and the main obligations for organisations applying from 13 May 2027. For most businesses, that leaves about six months to prepare — enough time if the work starts now.

1. Map the personal data you hold

List the personal data your organisation collects about customers, candidates, employees, vendors and visitors: what is collected, why, where it is stored, who can access it and how long it is kept. Include spreadsheets, HR and payroll systems, CRM tools, CCTV and biometric attendance systems, and data shared with vendors.

2. Confirm the lawful basis for each use

Personal data can be processed on the basis of consent or for certain legitimate uses defined in the law, which include specified employment-related purposes. Record the basis for each processing activity. Avoid relying on consent where another basis is more appropriate, and make consent genuinely free, specific and easy to withdraw where you do use it.

3. Update notices

People should receive a clear notice explaining what data is collected, the purpose, and how they can exercise their rights or raise a complaint. Review website forms, job applications, employee onboarding and customer onboarding.

4. Prepare for rights requests

Individuals can request access to a summary of their data, correction or erasure, and can nominate another person to act for them. Decide who receives requests, how identity is verified, how systems are searched and how quickly responses are sent.

5. Strengthen security and breach response

Organisations must take reasonable security safeguards to prevent personal data breaches. Review access controls, encryption, logging and backups. Prepare a breach response plan that covers notifying affected individuals and the Data Protection Board — including a detailed report within the timeline set in the Rules — and rehearse it.

6. Review vendor and processor contracts

Payroll, cloud, recruitment and IT vendors often process personal data for you. Contracts should cover purpose, security, breach notification and deletion or return of data at the end of the service.

Why start now

Penalties for failing to take reasonable security safeguards can reach ₹250 crore. Customers, employees and clients also expect evidence of good data practices — a six-month plan turns a deadline into a trust advantage.

General information, not legal advice. Organisations should confirm their obligations under the Act and Rules with counsel.