DPDP Readiness — What Indian Businesses Must Do Before the May 2027 Deadline

Why DPDP Readiness Is Now an Operational Priority

Most Indian businesses hold far more personal data than they realise. Customer names, phone numbers, and email addresses in a CRM. Vendor contact details in accounting software. Employee bank account numbers, PAN and Aadhaar copies, biometric attendance logs, performance reviews, and medical certificates in HR systems. Visitor details from a website contact form. WhatsApp Business chats with leads. None of this felt "regulated" for most of the last two decades — it was simply how business was done.

That assumption is no longer safe. The Digital Personal Data Protection Act, 2023 received Presidential assent on 11 August 2023, but it remained largely dormant — a law on the books without an operational framework — until the Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025. That notification did three things at once: it activated the Data Protection Board of India as a functioning regulator, it started an eighteen-month clock toward full compliance, and it converted a piece of legislation that businesses could reasonably defer into a live operational obligation with a hard deadline.

As of mid-2026, that clock has been running for roughly seven months. The Data Protection Board is operational, with its headquarters in the National Capital Region. The institutional and administrative provisions of the Rules — Board governance, penalty framework activation, foundational definitions — came into force immediately upon notification. The next major milestone, the rollout of the Consent Manager ecosystem that will let individuals manage their consent across multiple digital services through interoperable platforms, is expected to be operationalised in the middle of 2026 — which is to say, around now. The eighteen-month runway ends on 13 May 2027, by which point consent architecture, privacy notices, data principal rights mechanisms, breach-reporting protocols, and data retention and erasure systems are all expected to be fully operational.

"DPDP readiness" is sometimes treated as a checkbox exercise — update the website's privacy policy, add a cookie banner, and move on. That approach misunderstands what the law requires. The DPDP Act and Rules touch nearly every function in a business: how marketing collects and uses customer data, how HR collects and stores employee data, how IT secures systems and logs access, how procurement contracts with vendors who process data on the business's behalf, and how the business responds when something goes wrong. Genuine readiness means treating personal data as a regulated asset across the organisation — in the same way GST compliance, labour law compliance, or company law compliance are treated — rather than as a one-time documentation project.

The DPDP Act and DPDP Rules — What They Actually Require

To understand what "readiness" means in practice, it helps to understand how the framework is structured. The Digital Personal Data Protection Act, 2023 sets out the legal principles, rights, and obligations — who must do what, and what rights individuals have. The Digital Personal Data Protection Rules, 2025, notified via Gazette notification G.S.R. 846(E), operationalise those principles — they specify the forms, timelines, schedules, and procedures through which the Act's obligations are actually discharged. Reading the Act alone, without the Rules, gives an incomplete picture of what compliance actually involves.

The Key Actors

The framework defines a small number of roles that determine who carries which obligations. The Data Principal is the individual to whom the personal data relates — your customer, your employee, your website visitor. The Data Fiduciary is the entity that determines the purpose and means of processing personal data — in almost every case, this is your business. The Data Processor is any entity that processes personal data on behalf of a Data Fiduciary — your payroll vendor, your cloud hosting provider, your email marketing platform, your IT support contractor. A Consent Manager is a registered intermediary through which a Data Principal can give, manage, review, or withdraw consent across services. And the Data Protection Board of India is the regulator empowered to investigate complaints, conduct inquiries with the powers of a civil court, and impose penalties.

Two Lawful Grounds for Processing

A common misconception is that every instance of collecting or using personal data requires a consent pop-up. That is not how the Act is structured. Section 6 sets out the standard for valid consent — it must be free, specific, informed, unconditional, and unambiguous, given through a clear affirmative action, and it must be as easy to withdraw as it was to give. But Section 7 separately lists categories of "legitimate uses" for which personal data may be processed without consent — including compliance with court orders or legal obligations, responding to medical emergencies, processing by the State for specified public functions, and, importantly for most employers, processing for purposes related to employment. This distinction matters enormously in practice: a business does not need to obtain fresh consent from every employee to run payroll, but it does need a documented basis for every category of data it processes, whether that basis is consent or one of the recognised legitimate uses.

Section 8 — The Eleven Baseline Duties

Section 8 of the Act sets out the obligations that apply to every Data Fiduciary, regardless of size, sector, or how much personal data is processed. This is the irreducible floor — other provisions, such as Section 9 (children's data) and Section 10 (Significant Data Fiduciaries), add further obligations on top of it, but nothing reduces below it. The most operationally significant of these eleven duties include: implementing appropriate technical and organisational measures to ensure compliance; ensuring the completeness, accuracy, and consistency of personal data where it is likely to be used to make a decision affecting the Data Principal, or where it is likely to be shared with another Data Fiduciary; implementing reasonable security safeguards to prevent personal data breaches; notifying the Board and affected Data Principals in the event of a breach; erasing personal data once the purpose for which it was collected is no longer being served (unless retention is required by law); and ensuring that contracts with Data Processors include provisions requiring those processors to implement adequate security safeguards.

The Compliance Clock — What's In Force, What's Coming

One of the most important things for a business owner to understand is that the DPDP framework did not arrive all at once, and it is not going to be enforced all at once either. The Central Government has adopted a deliberate, phased approach — and where your business sits on that timeline determines how urgently different parts of this guide apply to you.

Where does that leave a business reading this in June 2026? Roughly halfway through the runway, but at a critical inflection point. November 2026 — marking one year since the Rules were notified — is widely expected to be the point at which the initial "soft enforcement" phase ends and regulatory attention shifts from institution-building to active oversight of how businesses are actually implementing the framework. The six-month window before the May 2027 deadline is likely to be the busiest and most expensive period for compliance consultants, auditors, and legal advisors, simply because most businesses will be starting — or scrambling — at the same time. Businesses that begin building their readiness infrastructure now, while there is still meaningful runway, will do so at a fraction of the cost, time pressure, and risk of those that wait.

Consent, Notice, and the Rights of Data Principals

At the heart of the DPDP framework is a simple idea: individuals should know what personal data is being collected about them, why, and should have meaningful control over it. The Rules translate this into specific operational requirements around notices, consent, and a defined set of rights.

The Notice Requirement

Wherever personal data is collected on the basis of consent, the Data Fiduciary must provide a notice — in clear and plain language, independent of any other information — that itemises the personal data being collected, the specific purpose for which it is being processed, the manner in which the Data Principal can exercise their rights, and how to lodge a complaint with the Data Protection Board. This notice cannot be buried inside a lengthy terms-of-service document written in dense legal language; it must be understandable on its own, and increasingly businesses are expected to be able to present it in English and in at least one language listed in the Eighth Schedule to the Constitution.

What Data Principals Can Demand

The Act grants individuals a defined set of enforceable rights: the right to obtain a summary of the personal data being processed and the processing activities undertaken; the right to correction, completion, and updating of their personal data; the right to erasure of personal data that is no longer necessary for the purpose for which it was collected; the right to grievance redressal, in the first instance with the Data Fiduciary itself, and thereafter with the Board; and the right to nominate another individual to exercise these rights on their behalf in the event of death or incapacity. These are not abstract entitlements — under the Rules, a Data Fiduciary must publish the contact details of a designated person responsible for handling such requests, and must respond within prescribed timelines.

Eight Building Blocks of a DPDP-Ready Organisation

Stripped of legal language, DPDP readiness comes down to eight interlocking pieces of infrastructure. Most businesses already have fragments of several of these — a privacy policy here, an IT security checklist there — but rarely have they been built as a coherent system aligned to the Act and Rules. These are the building blocks that, taken together, constitute genuine readiness.

Employee Data — The Blind Spot Most Businesses Have

When businesses think about "data protection," they tend to think first about customer data — CRMs, websites, e-commerce checkouts. Employee data is frequently overlooked, despite being among the most sensitive personal data any organisation holds: government-issued identification (Aadhaar, PAN, passport), bank account details, salary and compensation history, biometric attendance records, health and medical information, performance appraisals, disciplinary records, and background verification reports.

The good news is that employment is explicitly recognised as a "legitimate use" under Section 7 — a business does not need to obtain fresh consent from each employee simply to run payroll, administer statutory benefits like PF, ESI, and TDS, or carry out core HR administration. This is a meaningful relief, and mirrors the position under comparable frameworks like the EU's GDPR, where employee consent is generally treated as inherently problematic given the power imbalance in an employment relationship.

The relief, however, is narrower than many employers assume. The employment legitimate use covers processing genuinely necessary for the employment relationship and related statutory compliance. It does not automatically extend to using employee photographs in external marketing material, sharing employee contact details with a third-party vendor for purposes unrelated to employment, or deploying biometric or monitoring technology for purposes beyond what was disclosed when it was introduced. For anything outside the defined employment purpose, purpose-specific consent — or another recognised legitimate use — is required.

Retention of HR records is another area where two sets of obligations must be reconciled rather than treated separately. The DPDP Act requires erasure of personal data once the purpose for which it was collected is no longer being served — for example, once an employee exits and the employment relationship ends. But other laws — the Income Tax Act, EPF and ESI regulations, the Companies Act — often impose their own minimum retention periods for payroll records, statutory filings, and related documentation. A DPDP-compliant retention policy does not pick one framework over the other; it identifies, for each category of HR data, the longest applicable retention floor across all relevant laws, and builds deletion or anonymisation workflows that trigger once that floor is reached and the original purpose has lapsed.

The 72-Hour Breach Notification Clock

Few provisions of the Rules carry as much operational consequence as the breach notification timeline. A "personal data breach" is defined broadly — any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction, or loss of access to personal data that compromises confidentiality, integrity, or availability. The threshold for the obligation to apply is low: any unauthorised access or disclosure triggers it, regardless of how many individuals are affected.

Significant Data Fiduciaries — Do You Qualify?

The Act creates a second, heightened tier of obligations for entities designated as Significant Data Fiduciaries (SDFs). This designation is not self-assessed in the way a business might decide it is "small" or "large" for other regulatory purposes — under Section 10(1), the Central Government notifies which Data Fiduciaries or classes of Data Fiduciaries qualify, based on an assessment of factors including the volume and sensitivity of personal data processed, the risk of harm to Data Principals, the potential impact on the sovereignty and integrity of India, the risk to electoral democracy, the security of the State, and public order.

It is worth being deliberate about this: SDF status is not solely a function of company size. A relatively modest fintech, health-tech, or e-commerce platform processing sensitive categories of data — financial information, health records, biometric data — at meaningful scale may attract SDF designation well before a larger but lower-risk traditional business does. Businesses in these sectors should not assume SDF obligations are someone else's problem without an actual assessment.

What Happens When DPDP Readiness Is Tested

The cost of inadequate DPDP readiness rarely announces itself in advance. It surfaces in moments — a complaint, an incident, a routine request — that a prepared organisation handles as a non-event, and an unprepared one experiences as a crisis. The following scenarios are representative of the kinds of situations Indian businesses are increasingly likely to face.

The Marketing List That Wasn't Really Consented

A business has spent years building a customer contact database from billing records, event registration sheets, business card scans at trade shows, and a list purchased from a third-party data broker. Marketing runs regular WhatsApp and email campaigns to this list. A recipient files a complaint with the Data Protection Board, asking on what basis their contact details are being used for marketing they never agreed to. The business is asked to demonstrate that valid, itemised consent was obtained for marketing communications — and discovers it has no records that meet that standard for the vast majority of its list, because the data was never collected with marketing consent in mind, let alone itemised consent logged against this specific purpose.

The Vendor Laptop That Went Missing

An outsourced payroll provider's employee loses a laptop containing unencrypted payroll exports for a client's entire 80-person workforce — names, bank account details, salary figures, PAN numbers. The contract between the client business and the payroll vendor predates the DPDP Rules and contains no provisions requiring the vendor to implement security safeguards. Under Section 8(1), the client — not the vendor — remains primarily responsible for compliance. The client has no incident response plan, no one designated to assess whether this constitutes a reportable breach, and no familiarity with the 72-hour reporting requirement. By the time the client's leadership understands what has happened and what is required, days have passed.

The Former Employee Who Asked a Reasonable Question

A former employee, several months after leaving, emails HR asking what personal data the company still holds about them, how it has been used since their departure, and requests that certain records — particularly performance review data unrelated to any ongoing statutory obligation — be deleted. No one in the organisation is designated to handle this kind of request. It is forwarded between HR, IT, and legal, with no defined timeline, and eventually goes unanswered for several weeks. The former employee, increasingly frustrated, raises the matter with the Data Protection Board — which now has an independent basis to make enquiries of the organisation, well beyond the scope of the original request.

What Non-Compliance Actually Costs

The Schedule to the DPDP Act sets out the maximum monetary penalties the Data Protection Board can impose for specific categories of non-compliance. These figures are ceilings, not fixed amounts — the Board considers factors including the nature and gravity of the breach, the number of individuals affected, the Data Fiduciary's history of compliance, and the remediation measures taken when determining the actual penalty in any given case. Even so, the ceilings establish the scale of exposure a business is operating against.

For context, the European Union's General Data Protection Regulation caps penalties at the higher of €20 million or 4% of global annual turnover. The DPDP Act's ₹250 crore ceiling — roughly comparable in absolute terms — represents one of the highest absolute penalty ceilings in any major data protection framework globally, without the turnover-based cap that, for very large multinational organisations, can sometimes exceed a fixed ceiling. For a typical Indian small or mid-sized business, however, the practical point is simpler: these are not parking-fine numbers, and a single security incident can plausibly engage more than one of these provisions at once.

How LexWin Approaches DPDP Readiness

At LexWin, DPDP readiness is approached as a structured legal and operational engagement — not a one-off privacy policy update. Because the Act and Rules touch HR, marketing, IT, procurement, and customer-facing functions simultaneously, the work is necessarily cross-functional, but it follows a consistent, sequential process.

Who Needs This — and When

DPDP readiness is not a one-size-fits-all exercise, and the priority areas differ depending on the nature of your business. The table below is a starting point for thinking about where your organisation should focus first.

DPDP Readiness Checklist — 10 Questions to Ask Right Now

Before commissioning a full readiness programme, run this quick diagnostic against your current practices. If you answer "no" or "unsure" to more than three of these, your business carries meaningful and growing regulatory exposure as the May 2027 deadline approaches.

• Can you produce, for any given customer or employee, a record of what personal data you hold about them and why?
• Do your website, app, and onboarding forms capture itemised, purpose-specific consent — rather than a single bundled "I agree" checkbox covering multiple unrelated purposes?
• Does every contract with a vendor that processes personal data on your behalf — payroll, cloud hosting, IT support, marketing platforms — include DPDP-compliant security safeguard provisions?
• Do you have a documented, tested incident response plan capable of producing a detailed breach report to the Data Protection Board within 72 hours of becoming aware of a breach?
• Is there a designated person or team responsible for handling data principal requests for access, correction, or erasure, with defined response timelines?
• Have you assessed whether your business could be designated a Significant Data Fiduciary, based on the volume or sensitivity of the personal data you process?
• Do your HR policies, offer letters, and employment contracts address how employee personal data is collected, used, retained, and protected?
• Do you have a retention and erasure schedule that reconciles DPDP's purpose-based erasure requirement with retention floors set by other laws — the Income Tax Act, EPF and ESI regulations, the Companies Act?
• Are your access logs and monitoring systems capable of retaining processing records for at least one year, as required under the Rules?
• Has anyone in your organisation actually read the DPDP Rules, 2025 — or is your understanding still based on the 2023 Act alone?