DPDP Act 2023 · DPDP Rules 2025

DPDP compliance, built into your product. Not filed in a binder.

We find every piece of personal data you hold, rebuild notice and consent, automate rights requests, and harden security and breach response. You reach 13 May 2027 with evidence the Data Protection Board can read and your customers will sign off.

Book a 30-minute scoping call Check your readiness
Fixed scope, fixed fee Engineers and privacy specialists, one team Works alongside your legal counsel
Core obligations apply 13 May 2027Consent manager rules in force from today, 13 Nov 2026
–days
–hrs
–min
–sec
18-month window used
–
Built for teams that hold personal data at scale
  • B2B SaaS
  • Fintech & NBFCs
  • HR & payroll
  • Healthcare
  • E-commerce
  • EdTech
  • Logistics
₹250 crmaximum penalty for failing to take reasonable security safeguards
72 hrsto file a detailed breach report with the Board after you become aware of it
1 yearminimum retention of logs and related personal data under Rule 6
90 daysouter limit to resolve a data principal's grievance under Rule 14
What the law asks of you

Nine obligations. Each one is a system, not a policy.

The DPDP Rules turn the Act into specific, testable requirements. A policy PDF satisfies none of them. Your product, your data stores and your teams have to change.

01S.5 · Rule 3

Notice that stands alone

Itemised personal data and the specific purpose for each, plus how to withdraw, exercise rights and complain to the Board.

Read the guide → 02S.6, S.7

Consent, or a legitimate use

Free, specific, informed and unambiguous consent per purpose, as easy to withdraw as to give. Or a documented legitimate use.

Read the guide → 03S.8(5) · Rule 6

Reasonable security safeguards

Encryption or masking, access control, monitoring and logging, backups, and safeguards in every processor contract.

Read the guide → 04S.8(6) · Rule 7

Breach intimation

Tell affected people and the Board without delay, then file a detailed report with the Board within 72 hours.

Read the guide → 05S.8(7) · Rule 8

Retention and erasure

Erase once the purpose is served unless the law says keep it. Large platforms erase after three years of inactivity.

Read the guide → 06S.11–14 · Rule 14

Rights and grievances

Access, correction, erasure and nomination, a published contact, and grievances resolved within 90 days at most.

Read the guide → 07S.9 · Rule 10

Children and guardians

Verifiable parental consent for under-18s, and no tracking, behavioural monitoring or targeted ads at children.

Read the guide → 08S.8(1), 8(2)

Processors and vendors

You stay accountable for what your vendors do. Each processor needs a valid contract and a place on your register.

Read the guide → 09S.10 · Rule 13

Significant Data Fiduciaries

If notified: a DPO in India, an independent auditor, an annual DPIA and audit, and algorithmic due diligence.

Read the guide →
Try it

What a DPDP-grade consent notice looks like. And the evidence it leaves behind.

Itemised data, a specific purpose for each, a real choice per purpose, Reject as easy as Accept, a notice in the user's language, and a ledger entry for every decision. Flip a switch and save.

  • Section 5 and Rule 3Itemised notice, specific purposes, how to withdraw and complain.
  • Section 6(4)Withdrawal as easy as giving consent, propagated to processors.
  • Section 6(10)Proof of notice and consent sits with the fiduciary. The ledger is that proof.
yourapp.in · consent notice v3.2

How we use your personal data

Choose for each purpose. You can change this any time in Settings → Privacy.

Run your accountName, mobile, email · needed to provide the service you asked for
Product analyticsPseudonymous usage events · improve features
Personalised offersPurchase history · recommend plans and add-ons
Share with lending partnerName, mobile, income band · salary-advance eligibility

Questions or grievances: privacy@yourapp.in · You may complain to the Data Protection Board of India.

// consent ledger · append-only
The clock

Eighteen months, phased. The last phase is the one that bites.

The DPDP Rules, phased in over 18 months– of the window used · – days left
Today
13 Nov 2025Rules notified

Data Protection Board established; Rules 1, 2 and 17 to 21 in force. Members are yet to be appointed.

13 Nov 2026Consent managers

Rule 4 applies: the framework for registering consent managers with the Board is in force.

13 May 2027Core obligations

Notice, consent, security safeguards, breach intimation, retention, rights, grievances, children and cross-border rules.

What's at stake

Penalties up to ₹250 crore. Per breach.

Pick an obligation to see its ceiling. The Board weighs nature, gravity, duration, repetition and mitigation when it sets the amount. Enterprise buyers are already asking DPDP questions in security reviews.

Maximum penalty
₹250 crore

Section 8(5) and Rule 6: encryption or masking, access control, logging and monitoring, backups, one-year log retention and processor contracts.

How the Board sets penalties →
Built for SaaS and digital businesses

If you sell software, you wear two hats at once.

For your own sign-ups, leads, admins and staff, you are a Data Fiduciary. For the records your customers load into your product, you are usually their Data Processor. Each hat brings different duties, contracts and workflows.

We map every data flow to the right role first. Everything else follows from that map: who gives notice, who answers a rights request, who notifies whom after a breach.

DPDP for SaaS companies →
Who is who under the DPDP Acts.2 definitions
Data Principalthe individual Data Fiduciarydecides purpose and meansaccountable under the Act Data Processoracts on its behalf Consent Manager (optional) Data Protection Board consent or legitimate use under a contract complaints, breaches
One company can hold different roles for different data flows. A SaaS vendor is usually a fiduciary for its own users and a processor for its customers' data.
Services

From first assessment to running privacy ops

Start where you are. Each engagement has a fixed scope and fixed fee, agreed after a free scoping session.

Readiness Assessment

3 to 4 weeks

  • Data discovery across databases, object stores, logs and SaaS tools
  • Fiduciary and processor role map, purpose by purpose
  • Gap assessment against every section and Rule that applies
  • Risk register ranked by penalty exposure and effort
  • Board-ready summary and a costed roadmap
You get: a prioritised plan your CTO, CFO and counsel agree on.
Scope an assessment

Implementation Programme

10 to 16 weeks

  • Itemised notices and a consent ledger, versioned per purpose
  • Rights request portal with identity checks and automated fulfilment
  • Retention schedules and an erasure orchestrator across systems
  • Encryption, masking, tokenisation and one-year immutable logs
  • Breach runbook, notice templates and a live tabletop drill
  • Processor contracts, vendor register, policies and staff training
You get: compliance running in production, plus an evidence pack.
Plan my implementation

Managed Privacy Office

Monthly retainer

  • Designated privacy contact and grievance desk support
  • Rights requests handled within agreed service levels
  • Privacy review for every new feature and vendor
  • Quarterly control testing and an annual DPIA
  • Breach on-call with Board and customer notice drafting
  • Customer questionnaires and regulatory updates
You get: a privacy function without hiring one.
Talk about a retainer
How we work

Sixteen weeks from “where is our data?” to evidence you can hand over.

Weeks 1–3

Discover

Automated scans and interviews build a live data map: every store, field, flow, vendor and purpose, tagged by sensitivity.

  • Data map
  • Role map
Weeks 3–5

Decide

Lawful basis per purpose, retention periods with their legal source, and a target architecture your engineers sign off.

  • Gap report
  • Target design
Weeks 5–14

Build

Our engineers work inside your squads: consent ledger, rights automation, erasure, masking, logging, contracts and training.

  • Controls in production
Weeks 14–16

Prove

Control testing, a breach tabletop against the 72-hour clock, the evidence pack, and a handover your team can run.

  • Evidence pack
  • Drill report
What you walk away with

An evidence pack. Not a slide deck.

When the Board, an auditor or an enterprise customer asks, you send one link. Every control points to the system that runs it and the record that proves it.

See a sample evidence pack
DPDP evidence packReady for review
  • Record of processingStores, fields, purposes, roles, lawful basis, retention
  • Notice and consent registerEvery notice version and consent event, timestamped
  • Security safeguards matrixRule 6 control by control, with owners and test results
  • Breach runbook and drill reportDecision tree, templates, timings from the last tabletop
  • Rights request logRequests, identity checks, actions and closure times
  • Processor register and contractsEvery vendor, what it touches, where, on what terms
Reference case study

A payroll SaaS with 1,420 customers, DPDP-ready in 16 weeks

An HR and payroll platform holding salary, PAN, bank and attendance data for 3.4 lakh employees. It was a processor for its customers and a fiduciary for its own app, and its delete button didn't reach half its systems.

Read the full case study →
47data stores mapped, 19 of them previously untracked
31 hrsmedian rights-request closure, down from 19 days
6 hrsto a Board-ready breach report in the second drill
83%of customers accepted the new DPA in-app within 45 days
Guides

The DPDP Act, explained by the people who implement it.

All 20 guides →
PlanDPDP compliance checklistEvery obligation mapped to its section and Rule, by team, with what applies now and what applies from May 2027.Read guide → FoundationsDPDP Rules 2025, rule by ruleAll 23 Rules and seven Schedules in one table, with commencement dates and what each one means.Read guide → ObligationsBreach notification and the 72-hour reportWho you tell, when, and what goes in the Board's detailed report under Rule 7.Read guide → RolesData fiduciary vs data processorHow to tell which you are for each data flow, and what each role must do.Read guide → FoundationsDPDP vs GDPRWhat carries over from a GDPR programme and what you'll have to build fresh for India.Read guide → PlanDPDP Act penaltiesThe Schedule's five bands, how the Board sets an amount, and what reduces exposure.Read guide →
Readiness check

Where do you stand today?

Twelve questions, about two minutes. Answers stay in your browser unless you choose to send them with the form below.

We have an up-to-date inventory of every system that stores personal data, including logs, analytics and support tools.S.8 · accountability

For each data flow, we know whether we act as Data Fiduciary or Data Processor.S.2(i), 2(k) · roles

Our privacy notice is standalone and lists each item of personal data with its specific purpose.S.5 · Rule 3

We record consent per purpose, with the notice version shown, and users can withdraw as easily as they gave it.S.6 · consent

Identifiers like Aadhaar, PAN and bank details are encrypted, masked or tokenised everywhere, including logs and search indexes.Rule 6(1)(a)

Access and application logs are retained for at least one year and protected from tampering.Rule 6(1)(e)

We have a tested breach runbook that gets a detailed report to the Board within 72 hours.S.8(6) · Rule 7

Every category of data has a retention period, and erasure reaches every system, including backups and third parties.S.8(7) · Rule 8

Users can request access, correction and erasure through a published channel, and we track every request to closure.S.11–13 · Rule 14

A named privacy contact is published on our website and app, and grievances are resolved within 90 days.S.8(9), 8(10) · Rule 9

Every vendor that touches personal data is on a register and under a contract with DPDP-aligned terms.S.8(2) · processors

We know whether we process children's data, and if we do, we obtain verifiable parental consent.S.9 · Rule 10

Questions we hear

Frequently asked

When exactly do the DPDP obligations apply?

The DPDP Rules were notified on 13 November 2025. Data Protection Board provisions applied immediately, and consent managers can register from 13 November 2026. The core obligations on notice, consent, security safeguards, breach intimation, retention, rights and grievances apply from 13 May 2027. Most organisations need four to six months to implement them properly, so the time to start is now. See the full timeline.

We're a B2B SaaS. Doesn't our customer carry the risk?

Only partly. You are a Data Fiduciary for your own users, leads, staff and any purpose you decide on yourself, such as analytics, cross-sell or partner referrals. For customer data you are typically a processor. The fiduciary stays accountable to the Board, so your customers will push those obligations to you by contract: breach notice timelines, deletion on exit, sub-processor controls and audit rights.

Are you a law firm?

No. We are an implementation team: engineers, security specialists and privacy practitioners. We turn the Act and Rules into systems, controls and evidence. Where you need a formal legal opinion, we work alongside your counsel and give them the facts about your data flows they need.

Do we need consent for everything now?

No. Section 7 allows certain legitimate uses without consent: data a person provided voluntarily for a specified purpose, employment purposes, legal obligations and medical emergencies among them. We document the right basis for each purpose so you ask for consent only where you need it. Consent and legitimate uses explained.

What does “reasonable security safeguards” mean in practice?

Rule 6 sets a minimum: encryption, obfuscation, masking or virtual tokens; access control; visibility through logs and monitoring; backups for continuity; one-year retention of logs; and the same safeguards in processor contracts. We implement and test these controls, so the evidence comes from your systems, not a questionnaire.

How much engineering time will this take from our team?

Our engineers do most of the build inside your codebase, alongside your squads. In a typical implementation programme your team gives one engineer-equivalent for reviews, plus product owners for decisions on notice and retention. We agree the exact split during scoping.

What does an engagement cost?

Every engagement has a fixed fee based on how many systems hold personal data, how many products and purposes you run, and how much of the build you want us to own. You get a written proposal within three working days of the scoping call.

Start here

Book a 30-minute scoping call

Tell us a little about your product and data. On the call we walk through your likely gaps against the Rules and the order to tackle them. Then you get a fixed-fee proposal.

  • No preparation neededA rough idea of your stack and vendors is enough.
  • NDA on requestBefore you share any architecture details.
Book a scoping call