DPDP Act Compliance Services: Consent, Security Safeguards, and Breach Readiness for India
DPDP compliance readiness for companies that handle digital personal data of people in India, wherever they are based. We map your data and test your notices, consent, rights, and breach processes against the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. You then get a risk-ranked DPDP compliance roadmap. Most assessments take 6–12 weeks.
What Is DPDP Compliance?
DPDP compliance means meeting India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. Personal data may be processed only with valid consent or for a legitimate use the Act allows. People must get a clear notice, be able to exercise their rights, and have their data kept secure. Breaches must be reported to the Data Protection Board and to the people affected.
The Act reaches beyond India. It covers digital personal data processed in India, and data processed outside India when it is linked to offering goods or services to people in India. A US software company with Indian users can be in scope. So can a global company with an India delivery centre or a Global Capability Centre that handles customer or staff data.
Accredify Global assesses where you stand against the Act and the Rules. We test your processes on real requests and a realistic breach, then give you a roadmap your privacy lead, counsel, and engineers can act on. Our India page covers the ISO certifications Indian companies use alongside DPDP.
DPDP in 2026: A Phased Start, With May 2027 the Main Deadline
The DPDP Rules were notified on 13 November 2025. The rules that set up the Data Protection Board took effect that day. The Board receives breach reports, hears complaints, and imposes penalties.
Consent Managers come next. The rule on registering Consent Managers applies one year after notification, from 13 November 2026. A Consent Manager must be an Indian company with a net worth of at least ₹2 crore.
Most duties apply from 13 May 2027. Notices, consent, security safeguards, breach reporting, children's data, rights handling, data erasure, and the extra duties of Significant Data Fiduciaries all start 18 months after notification. MeitY has proposed shortening this phase-in. Until an amendment is notified, May 2027 stands, but customers and auditors are already asking Indian suppliers about readiness.
Sources: DPDP Act, 2023 (India Code) · DPDP Rules 2025 (PIB) · EY analysis of the Act and Rules · Proposed timeline change (Mondaq)
DPDP Requirements, and What We Assess
The obligations the Act and Rules set for Data Fiduciaries, and the evidence our assessment looks for.
| Obligation | What the law expects | Evidence we look for |
|---|---|---|
| Notice | A standalone, plain notice listing the data, the purpose, and how to withdraw consent, use rights, and complain to the Board | Notices at every collection point, in clear language |
| Consent and legitimate uses | Free, specific, informed, unambiguous consent, as easy to withdraw as to give, or a legitimate use the Act allows | A basis per purpose, consent records, and a working withdrawal path |
| Security safeguards | Reasonable safeguards, including encryption, masking or tokens, access control, monitoring, backups, and logs kept for a year | Controls in place, tested, and written into processor contracts |
| Breach response | Notice to the Board and to affected people, with a detailed report to the Board within 72 hours | An incident procedure, contact templates, and a drill against the clock |
| Rights and grievances | Access, correction, completion, updating, erasure, nomination, and grievance redress within 90 days | Request logs, identity checks, and response times |
| Children and guardians | Verifiable consent of a parent or lawful guardian before processing a child's data | Age and guardian checks, and use of any exemption |
| Retention and erasure | Erase data once the purpose is served; set periods for large e-commerce, gaming, and social media platforms | A retention schedule and a working erasure process |
| Processors and transfers | Processors only under a valid contract; transfers abroad unless the government restricts a country | Processor contracts and a register of data flows leaving India |
DPDP Deadlines, Penalties, and Who Is in Scope
Tight clocks and penalties of up to ₹250 crore are why DPDP compliance teams test their processes before the Board does.
Clocks your team must meet
| Personal data breach | Tell the Board and affected people without delay; send the Board a detailed report within 72 hours |
|---|---|
| CERT-In cyber incident | A separate 6-hour report under the CERT-In directions, where they apply |
| Grievances | Respond within the period you publish, no longer than 90 days |
| Logs | Keep personal data processing logs for at least one year |
Large e-commerce, gaming, and social media platforms must also erase data after three years of user inactivity, with 48 hours' notice.
Maximum penalties under the Act
- Up to ₹250 crore for failing to take reasonable security safeguards
- Up to ₹200 crore for failing to notify a personal data breach
- Up to ₹200 crore for breaching duties on children's data
- Up to ₹150 crore for breaching the extra duties of a Significant Data Fiduciary
- Up to ₹50 crore for breaching any other provision of the Act or Rules
The Board sets each penalty by the nature, gravity, and duration of the breach, and by what you did to limit it. Penalties apply per instance, so one weak process repeated across many people can add up. A documented, tested program is the best evidence that you took reasonable steps.
How Our DPDP Readiness Assessment Works
Six stages, from the first call to a roadmap your leadership can sign off. If you also plan ISO certification, our certification process guide shows how the two fit together.
Not sure whether the DPDP Act applies to you, or how much of your GDPR work carries over? A free scoping review answers that first.
Book a free scoping reviewDPDP vs GDPR: What Carries Over and What Doesn't
Companies with a GDPR program have a head start on DPDP compliance, but the two laws differ in ways that matter.
| Topic | GDPR | DPDP Act |
|---|---|---|
| Grounds for processing | Six lawful bases, including legitimate interests | Consent or a listed legitimate use; no general legitimate interests |
| Data covered | All personal data, with special categories | Digital personal data; no separate sensitive category |
| Breach notice | 72 hours to the regulator, for breaches likely to pose risk | Every breach, to the Board and affected people; detailed report within 72 hours |
| Maximum fine | 4% of global turnover or €20 million | Fixed caps per instance, up to ₹250 crore |
| Data protection officer | Required in defined cases | India-based DPO for Significant Data Fiduciaries; a contact person for others |
| Transfers abroad | Adequacy, clauses, or other safeguards | Allowed unless the government restricts a country |
| Children | Parental consent below 13 to 16, by country | Verifiable guardian consent below 18 |
Standards help too. ISO 27001 is a recognized way to show the reasonable security safeguards the Act requires. ISO/IEC 27701 adds privacy roles, records, and processes that map well to DPDP and GDPR. Our GDPR compliance services and DPDP work share one data map, so you do not document the same systems twice. US customers often ask for a SOC 2 report alongside it.
Significant Data Fiduciaries: The Extra Duties
The government can name a company a Significant Data Fiduciary based on the volume and sensitivity of its data and the risk to people. These companies carry more duties.
What a Significant Data Fiduciary must do
- Appoint a Data Protection Officer based in India, reporting to the board
- Appoint an independent data auditor
- Run a Data Protection Impact Assessment and an audit every year
- Check that algorithms and software do not put people's rights at risk
- Keep in India any data the government specifies
How we help you prepare
- A readiness review against the extra duties
- Impact assessment templates built on your data map
- Evidence packs your DPO and auditor can rely on
- AI and algorithm risk checks linked to our AI governance work
We assess readiness. We do not act as your Data Protection Officer or your appointed data auditor.
DPDP Compliance Cost and Timeline
We do not publish a price list for DPDP compliance. The cost depends on how much personal data you process and where it goes. A free scoping review gives you a tailored proposal.
What shapes the scope
- Processing activities — how many purposes and data sets
- Systems and vendors — apps, clouds, and processors handling the data
- Children's data — whether guardian consent applies
- Entities and countries — group companies, GCCs, and data flows
- Reuse — GDPR records or ISO 27001 and ISO 27701 evidence already in place
How long it takes
| Assessment and roadmap | 6–12 weeks, depending on scope |
|---|---|
| Closing gaps | Set by your roadmap; plan to finish before May 2027 |
| Ongoing review | Yearly, or when the Rules or Board guidance change |
How to Choose DPDP Compliance Services
Questions worth asking any DPDP compliance provider, and how Accredify Global answers them.
| Question to ask | Accredify Global's answer |
|---|---|
| Can you certify us for DPDP? | No one can. There is no DPDP certificate; we assess readiness and report. |
| Do you test processes or only read policies? | We test them, using real requests and a realistic breach drill. |
| Can you reuse our GDPR work? | Yes. We start from your GDPR records and assess only the differences. |
| Do you act as our DPO or data auditor? | No. We assess readiness; your appointed people hold those roles. |
| Do you give legal advice? | No. Legal interpretation stays with your counsel. |
| How is it priced? | A tailored proposal after a free scoping review. |
What You Receive From a DPDP Assessment
Personal data flows across systems, vendors, and countries.
Each purpose, its basis, and the notice behind it, with gaps flagged.
How rights requests, grievances, and the breach drill performed.
Security controls and logs measured against the Rules.
Actions in priority order, with owners and dates.
A plain summary for your board and customers.
Frequently Asked Questions About DPDP Compliance
Straight answers on scope, deadlines, breaches, penalties, cost, and timeline.
What is the DPDP Act?
The Digital Personal Data Protection Act, 2023 is India's data protection law. It governs how digital personal data of people in India is collected, used, shared and stored. The DPDP Rules, 2025, notified on 13 November 2025, set out how the Act works in practice.
When does the DPDP Act fully apply?
In phases. The rules setting up the Data Protection Board applied from 13 November 2025. Consent Manager rules apply from 13 November 2026. Most duties, including notice, consent, security safeguards, breach reporting and rights, apply from 13 May 2027. MeitY has proposed shortening this, but no amendment has been notified yet.
Does the DPDP Act apply to companies outside India?
Yes, in some cases. It applies to digital personal data processed in India. It also applies to processing outside India when it is linked to offering goods or services to people in India. A US company with Indian customers or users is usually in scope.
Is there a DPDP certification?
No. There is no official DPDP certificate. Compliance is shown through notices, consent records, contracts, safeguards and working processes. If customers want a certificate for privacy management, ISO/IEC 27701 is the internationally recognized option.
Who enforces the DPDP Act?
The Data Protection Board of India. It receives breach reports, hears complaints from Data Principals, runs inquiries and imposes penalties. The rules that set up the Board have applied since 13 November 2025.
What are the penalties under the DPDP Act?
Penalties are fixed caps per instance. They reach up to 250 crore rupees for failing to take reasonable security safeguards, and up to 200 crore rupees each for failing to report a breach or breaching duties on children's data. Other breaches carry up to 150 crore or 50 crore rupees.
How fast must a personal data breach be reported under DPDP?
The Rules require notice to the Board and to each affected person without delay. A detailed report must reach the Board within 72 hours of becoming aware of the breach, unless the Board allows longer. A separate 6-hour CERT-In report may also apply to cyber incidents.
What security safeguards do the DPDP Rules require?
Reasonable safeguards, including encryption, obfuscation, masking or virtual tokens, access control, monitoring for unauthorized access, backups, and logs kept for at least one year. Processor contracts must include the same safeguards.
Do we need a Data Protection Officer under DPDP?
Only Significant Data Fiduciaries must appoint a Data Protection Officer, who must be based in India. Other Data Fiduciaries must publish the contact details of a person who can answer questions about their processing.
What is a Significant Data Fiduciary?
A Data Fiduciary the government names based on the volume and sensitivity of data, risk to people, and wider factors such as security of the state. It must appoint an India-based DPO and an independent data auditor, run a yearly impact assessment and audit, and check its algorithms for risk to people's rights.
Can personal data be transferred outside India under DPDP?
Yes. Transfers are allowed unless the Central Government restricts transfers to a particular country. Sector rules, such as those from financial regulators, can still require data to stay in India.
How is DPDP different from GDPR?
DPDP has only consent and listed legitimate uses as grounds, with no general legitimate interests. It covers digital personal data, has no separate sensitive category, requires notice of every breach, and sets fixed penalty caps rather than a share of turnover.
Can ISO 27001 or ISO 27701 help with DPDP?
Yes. ISO 27001 is a recognized way to show the reasonable security safeguards the Act requires, and ISO 27701 adds privacy roles, records and processes. Neither replaces the Act, but both give independent evidence that customers recognize.
How long and how much does a DPDP compliance assessment take?
Most assessments take 6 to 12 weeks, depending on how many systems, entities and processors are in scope. There is no list price. A free scoping review gives you a tailored proposal.
Do you give legal advice on DPDP?
No. We assess and report on your privacy controls and processes. Legal interpretation stays with your counsel, and we work alongside them.
Know Where You Stand on DPDP Before May 2027
Tell us about your Indian personal data, systems, and vendors. We'll confirm how the DPDP Act applies, show what your GDPR or ISO work already covers, and send a tailored proposal.
Book your free scoping review →Last reviewed by the Accredify Global compliance team.