- Home
- For teams
Who it's for
Who TruePrivacy helps with DPDP
DPDP duties sit with the organisation, but the work lands on people. Start with your company's shape or with your own role.
Short answer
The DPDP Act, 2023 places its duties on the Data Fiduciary as an organisation, whatever its size, and core obligations under the DPDP Rules, 2025 begin on 13 May 2027. Each team owns part of the work: legal owns notices and contracts (Rule 3, s.8(2)), security owns safeguards and breach response (Rule 6, Rule 7), product owns consent flows (s.6) and HR owns employee data (s.7(i)). Pick your company size or role below.
By company size
DPDP for Indian startups
A lean DPDP programme for Indian startups before 13 May 2027: data map, notices, consent, processor contracts and breach basics.
For MSMEsDPDP for MSMEs
MSME-friendly DPDP steps: know your data, fix notices, sign contracts with software vendors, handle rights requests and prepare for Rule 7 breaches.
For enterprisesDPDP for enterprises
Enterprise DPDP: discovery across entities and brands, a DPO operating model, Significant Data Fiduciary readiness under Rule 13, and audit evidence.
For GCCsDPDP for GCCs
Global Capability Centres and DPDP: parent instructions, the s.17(1)(d) exemption, employee data under s.7(i), and transfer documentation.
By role
For DPOs under DPDP
Data Protection Officers under DPDP s.10(2)(a): based in India, responsible to the Board of Directors, grievance contact, Rule 13 duties and evidence.
For CISOsFor CISOs implementing DPDP
CISO view of DPDP: Rule 6 security safeguards, Rule 7 breach timelines, shadow SaaS discovery, DSPM, endpoint scanning and vendor risk.
For foundersFor founders preparing for DPDP
Founder-level DPDP decisions: the 13 Nov 2026 and 13 May 2027 dates, who owns privacy, what to budget for, and when to bring in help.
For legalFor legal and compliance teams
For legal teams: Rule 3 notices, processor contracts under s.8(2), documenting legitimate uses, proof of consent under s.6(10) and Board updates.
For productFor product managers
Ship DPDP-ready products: consent UX, withdrawal as easy as giving, purpose registers, children's flows and analytics events as personal data.
For HRFor HR leaders
HR and DPDP: employee and candidate data, the s.7(i) employment legitimate use, payroll and HRMS vendors, employee requests and monitoring caveats.
What changes with company size
A startup or MSME needs a lean programme: know its data, fix notices, sign processor contracts and be ready for a breach. An enterprise adds many entities and brands, a DPO operating model, and readiness in case it is notified as a Significant Data Fiduciary under s.10. A GCC first works out which of its processing the s.17(1)(d) exemption covers.
What changes with role
| Role | Owns | Starts with |
|---|---|---|
| DPO or privacy lead | The programme and its evidence | Rule 9 contact, grievance period, Rule 13 if notified |
| CISO | Security safeguards and breach response | Rule 6 controls, Rule 7 timings |
| Founder | Dates, owner and budget | 13 May 2027 plan |
| Legal | Notices, contracts, legitimate-use records | Rule 3, s.8(2), s.6(10) |
| Product | Consent and children's flows | s.6, s.9, Rule 10 |
| HR | Employee and candidate data | s.7(i), HR vendor contracts |
Does DPDP apply to small companies?
Yes. The duties fall on every Data Fiduciary. Do not assume an exemption; check with counsel whether a specific one covers you.
Who should own DPDP inside a company?
One named owner, with legal, security, product and HR each owning their part. A DPO is mandatory only for Significant Data Fiduciaries (s.10(2)(a)), but every fiduciary publishes a contact under Rule 9.
When do the main duties start?
Core obligations begin on 13 May 2027. Consent Manager registration under Rule 4 starts on 13 November 2026.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin