What DPDP compliance actually means
Under the DPDP Act, a Data Fiduciary is accountable for how personal data is collected, used, stored, shared, and erased. Compliance means you can show notices that match processing, consent that is specific to purpose, Data Principal rights that complete on time, reasonable security safeguards, and oversight of processors. The Data Protection Board of India can call for that evidence. A PDF checklist stored in a shared drive is not the same thing.
DPDP Consultancy (dpdpconsultancy.in) treats DPDP compliance as an operating model: advisory to map obligations, software to run consent and rights, and scans to see what your public website actually does. That is how Indian enterprises move from “we are aware of the Act” to “we can demonstrate it”.
Who needs DPDP compliance
If you process digital personal data of individuals in India, you are in scope — whether you are incorporated here or you offer goods or services into India from abroad. Employers, hospitals, banks, marketplaces, SaaS products, and any site that drops analytics or advertising cookies typically have DPDP duties. Limited exemptions exist for specified research, legal, and state functions; most commercial processing does not qualify.
Significant Data Fiduciaries, once designated, add a Data Protection Officer, Data Protection Impact Assessments, annual audits, and algorithmic accountability. Even organisations that are not SDFs still need consent, notice, rights, security, and vendor controls. The difference is intensity, not whether the Act applies.
The six obligation domains
DPDP Consultancy organises DPDP compliance around the duties that create penalty exposure, not around a generic privacy framework imported from the EU.
- Consent and notice — purpose-specific consent, withdrawal that is as easy as giving consent, and notices that state what you collect and why. See consent management.
- Data Principal rights — access, correction, erasure, and grievance handling within the Act’s timelines, with a published grievance officer.
- Minimisation and retention — collect only what the specified purpose needs, and delete it when that purpose ends.
- Security and breach — reasonable safeguards, and the ability to detect and report a personal data breach as required.
- Vendors and processors — contracts, purpose mapping, and downstream action when consent changes or a rights request arrives.
- Governance — policies, training, SDF duties where they apply, and evidence you can hand to the Board.
Penalties and why “later” is expensive
The Act sets penalty ceilings up to ₹250 Crore for failing reasonable security safeguards, with separate caps for consent and notice failures, children’s data, and Data Principal obligation breaches. Those figures are ceilings, not a tariff, but they are why boards now ask for an operational DPDP programme rather than a policy refresh. Remediation of consent, trackers, and rights workflows typically takes months, which is why waiting for a notice from the Board is the slowest path.
A practical DPDP compliance path
Programmes that finish share a sequence. First, establish applicability and a gap picture — what you collect, which vendors touch it, and what your website discloses versus what it loads. DPDP Consultancy’s free Privacy Pitstop scan and 10-question assessment are built for that first pass.
Second, design notices, consent purposes, and rights SLAs against the Act and the 2025 Rules — not against a GDPR template. Third, implement technical controls: a consent platform, DSAR automation, and scanner coverage, which live on the DPDP compliance platform. Fourth, operate: monitor trackers, honour withdrawals, close rights tickets, and refresh vendor maps when processing changes.
Advisory without software leaves you with a roadmap you cannot execute. Software without advisory leaves you with banners that do not match your processing. DPDP Consultancy runs both, including DPDP services for organisations that want managed operations after go-live.
DPDP Rules 2025 and phased enforcement
The Act received assent in 2023. The implementing Rules were notified in November 2025, with duties switching on in phases rather than on a single day. That is not a reason to wait. Consent banners, tracker inventories, rights inboxes, and processor contracts are slow to change, and “we will start when the last phase lands” is how organisations miss the board’s first question: can you show the control today?
A GDPR programme is useful raw material — data maps, processors, security — but it is not DPDP compliance. Lawful bases, children’s data, notice content, and the Data Protection Board’s process are different. Treat the Rules as the operating calendar and the Act as the obligation set, then implement against both.
What “good” evidence looks like
When counsel or a DPO asks whether you are DPDP compliant, the useful answer is a packet: current notices and purpose list, consent logs, scan results for public properties, open and closed rights requests with timestamps, processor register, and security control summaries. DPDP Consultancy’s platform stores those artefacts so they are not rebuilt from email every quarter.
How to start
Scan a public website, complete the readiness questions, then talk to DPDP Consultancy about the domains that actually apply. That is faster than commissioning a 200-page gap report before anyone has seen what your site loads in a browser.