- Home
- Guides
Guides
DPDP compliance guides
Practical guides to the DPDP Act, 2023 and the DPDP Rules, 2025 for Indian Data Fiduciaries. Each one opens with a short answer, then gives steps, a checklist and the evidence to keep.
Short answer
These guides turn the DPDP Act, 2023 and the DPDP Rules, 2025 (G.S.R. 846(E)) into tasks you can assign. Consent Manager registration under Rule 4 starts on 13 November 2026, and core obligations begin on 13 May 2027 (Rule 1). Start with the May 2027 checklist, then read the guides that match your biggest gaps.
Before 13 May 2027
DPDP checklist for 13 May 2027
A phased DPDP checklist for Indian companies: tasks, owners and evidence to have ready before core obligations begin on 13 May 2027.
GuideRun a DPDP readiness assessment
How to run a DPDP readiness assessment across systems, vendors, consents and rights operations, with plain ratings backed by evidence.
GuideRecord-keeping under DPDP
The records Indian Data Fiduciaries should keep to show DPDP accountability: consent, notices, requests, breaches, processors, logs and SDF evidence.
GuideBoard reporting on DPDP
What to report to your company board on DPDP readiness, incidents and SDF exposure, and how it differs from the Data Protection Board of India.
Consent and notices
Drafting a DPDP privacy notice
Draft a DPDP privacy notice for Indian apps and websites: Rule 3 contents, a layered structure, Eighth Schedule languages and the s.5(2) notice.
Section 6DPDP consent notices that hold up
Design the notice shown at the moment of consent under DPDP s.5, s.6 and Rule 3, and keep a record that proves what each person saw and chose.
Section 9Verifiable parental consent for DPDP
Implement verifiable parental consent for children's data under DPDP s.9 and Rule 10, with Rule 11 guardians and Rule 12 exemptions in view.
Rule 4Consent Manager vs consent management platform
A registered DPDP Consent Manager (Rule 4) and a consent management platform are different things: legal status, registration and when you need which.
Requests and incidents
Handle Data Principal requests well inside 90 days
Run Data Principal requests from intake to closure, well inside the 90-day cap that Rule 14(3) sets on your published grievance response period.
Rule 772-hour DPDP breach playbook (Rule 7)
Hour-by-hour Rule 7 playbook: tell affected Data Principals and the Board without delay, then give the Board a detailed report within 72 hours.
SDFs and DPOs
How to appoint a DPDP Data Protection Officer
Appointing a Data Protection Officer under DPDP s.10(2)(a): when an SDF needs one, the India and reporting-line rules, and the steps to follow.
Section 10SDF self-assessment for Indian companies
Assess your exposure to SDF duties under DPDP s.10 and Rule 13: the factors the government weighs, a gap check, and DPO and auditor readiness.
Vendors and transfers
Processor contracts under DPDP
Clause checklist for contracts with Data Processors under DPDP s.8(2) and Rule 6: security, breach notice, erasure, sub-processors and audit.
GuideVendor due diligence under DPDP
Assess SaaS and IT vendors for DPDP: processing role, location, sub-processors, security and breach commitments, risk tiers and reassessment.
Section 16Cross-border transfer checklist (DPDP)
Checklist before personal data leaves India under DPDP s.16 and Rule 15: inventory destinations, record reasons, check vendors and log decisions.
Special topics
Employee data under DPDP
Handle employee and candidate data under DPDP: s.7(i) employment use versus consent, notices, requests, monitoring limits and retention.
GuideCCTV and biometrics under DPDP
Workplace CCTV and biometric attendance under DPDP: when they are personal data, notice and signage, purpose limits, vendor access and retention.
GuideAI systems processing personal data (DPDP)
Using personal data to train or run AI under DPDP: purpose limits, training vs inference, notices, AI vendors as processors and Rule 13 for SDFs.
CompareDPDP vs GDPR
Compare India's DPDP Act with the EU GDPR: scope, grounds, children, breach, transfers, SDFs and penalties, and what not to copy across.
CompareDPDP vs IT Act and SPDI Rules
How the DPDP Act relates to section 43A of the IT Act and the SPDI Rules, 2011, why the SPDI regime continues for now, and what to rewrite first.
Where to start
Start with the May 2027 checklist and a readiness assessment. Together they show which of the other guides you need first. Every guide cites the section of the Act or the rule it relies on, so your legal team can check it against the text.
The Data Protection Board of India has no members yet, and the Consent Manager application form is not published. See the DPDP timeline for the fixed dates, and check with counsel before you rely on a guide for a decision about your organisation.
When do DPDP obligations start?
Core obligations begin on 13 May 2027, when Rules 3, 5 to 16, 22 and 23 come into force. Rule 4 on Consent Manager registration starts on 13 November 2026 (Rule 1).
Which guide should I read first?
The May 2027 checklist, then the readiness assessment guide. Together they show where your gaps are and which guides cover them.
Are these guides legal advice?
No. They are educational information based on the Act and the Rules as published. Check with counsel for decisions about your organisation.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin