DPDP Act 2023 · DPDP Rules 2025

DPDP compliance, built into your product. Not filed in a binder.

India's new data protection law applies in full from 13 May 2027. We find the personal data your business holds, fix how you ask for consent, and build the safeguards the law expects, aiming to have you ready before the deadline with evidence that the controls work.

Book a 30-minute scoping call Check your readiness
Fixed-scope, fixed-fee proposals Engineers and privacy specialists, one team Works alongside your legal counsel
Core obligations apply 13 May 2027Consent manager rules in force since 13 Nov 2026 · Live status tracker →
–days
–hrs
–min
–sec
18-month window used
–
Built for teams that hold personal data at scale
  • B2B SaaS
  • Fintech & NBFCs
  • HR & payroll
  • Healthcare
  • E-commerce
  • EdTech
  • Logistics
₹250 crthe biggest possible fine, for weak security
72 hrsto send the regulator a full report after a data breach
1 yearhow long you must keep records of who accessed data
90 daysthe longest period you can publish for responding to a complaint
The life of one record

Every record has a story. DPDP asks where it goes, who holds it, and when it ends.

Follow one record, a customer's mobile number (the red dot in each scene), from the moment you collect it to the day you can prove you deleted it. Each stage is a duty in the Act, and each one is something your systems have to do, not just your policy.

  1. 01 · CollectA notice comes first

    Say what you collect and why, item by item, before you ask.

    s.5 · Rule 3
  2. 02 · ConsentTie it to one purpose

    A clear yes, per purpose, as easy to undo as to give.

    s.6 · s.7
  3. 03 · UseKnow who holds each record

    You or your vendor, flow by flow, under a valid contract.

    s.2 · s.8(2)
  4. 04 · ProtectGuard it well

    Encryption, access control, one year of logs, backups.

    s.8(5) · Rule 6
  5. 7205 · RespondAnswer, and report fast

    Rights requests and grievances on time, and the Board's breach report inside 72 hours.

    s.8(6) · s.11–13 · Rule 7
  6. 06 · EraseLet it go when the purpose ends

    Delete it everywhere it went, including your vendors.

    s.8(7) · Rule 8
  7. 07 · ProveKeep the receipts

    Consent records, logs and drill reports that stand up later.

    s.6(10) · s.8(1)
What the law asks of you

Nine things the law asks. Each one changes how your systems work, not just your policy.

Here is the whole law on one page, in plain words. Tap any card for the full guide.

01

Tell people what you collect

When you ask for consent, show a short notice first: each item you collect and why you need it.

Read the guide → 02

Ask properly, or have a valid reason

A clear yes for each purpose, as easy to take back as to give. Some uses, like employment, need no consent.

Read the guide → 03

Keep it safe

Encryption, access control, a year of access records and backups. Weak security carries the biggest fine.

Read the guide → 04

Report breaches fast

Tell the regulator and every affected person straight away, then send a full report within 72 hours.

Read the guide → 05

Don't keep it forever

Delete data once you no longer need it, unless another law says you must keep it.

Read the guide → 06

Let people see, fix and delete it

Give people an easy way to ask, and respond to complaints within 90 days at most.

Read the guide → 07

Take extra care with children

Anyone under 18 needs a parent's verified consent. No tracking or targeted ads aimed at children.

Read the guide → 08

Your vendors are your responsibility

Anyone who handles data for you needs a proper contract. Their mistakes still count as yours.

Read the guide → 09

Large players do more

If the government names you a Significant Data Fiduciary: a data protection officer in India and yearly audits.

Read the guide →
Try it

What a DPDP-grade consent notice looks like. And the evidence it leaves behind.

Each piece of data with its reason, a real choice for each one, "Reject" as easy as "Accept", the user's own language, and a record of every choice. Flip a switch and save.

  • A clear noticeWhat you collect, why, and how to change your mind or complain.
  • Easy to say no laterTaking consent back is as easy as giving it, and your vendors stop too.
  • Proof of every choiceIf a customer disputes it, you have to prove they agreed. The record is that proof.
yourbrand.example · consent notice v3.2

How we use your personal data

Choose for each purpose. You can change this any time in Settings → Privacy.

Run your accountName, mobile, email · needed to provide the service you asked for
Product analyticsPseudonymous usage events · improve features
Personalised offersPurchase history · recommend plans and add-ons
Share with lending partnerName, mobile, income band · salary-advance eligibility

Questions or grievances: privacy@yourbrand.example · You may complain to the Data Protection Board of India.

// consent ledger · append-only
The clock

Eighteen months, phased. The last phase is the one that bites.

How the DPDP Rules phase in over 18 months– of the window used · – days left
Today
13 Nov 2025Rules notified

The Data Protection Board is established and Rules 1, 2 and 17 to 21 apply. Its members are yet to be appointed.

13 Nov 2026Consent managers

Rule 4 applies: consent managers can register with the Board and start carrying people's consents to businesses.

13 May 2027Core obligations

Notice, consent, security safeguards, breach intimation, retention, rights, grievances, children and cross-border rules.

What's at stake

Penalties up to ₹250 crore. Per breach.

Pick a mistake to see the maximum fine. The regulator looks at how serious it was, how long it lasted and what you did to fix it. Larger customers are starting to ask about DPDP before they sign.

Maximum penalty
₹250 crore

Weak security: no encryption, loose access, no records of who saw what, no backups.

How the Board sets penalties →
Built for SaaS and digital businesses

If you sell software, you wear two hats at once.

For your own users and staff, you decide why data is used, so the law calls you a Data Fiduciary and the duties are yours. For the data your customers put into your product, you usually just handle it for them, as their Data Processor. The two need different contracts and different processes.

We sort out which hat you wear for each kind of data first. That decides who shows the notice, who answers requests and who reports a breach.

DPDP for SaaS companies →
Who does what with personal datas.2 definitions
Data Principalthe personData Fiduciarydecides why and howData Processorworks on instructionsConsent manageroptional go-betweenconsent or legitimate useunder a contractcomplaintsbreach reportsData Protection Board
  • Data Principal gives data, by consent or under a legitimate use, and can complain to the Board.
  • Data Fiduciary decides why and how the data is used. It carries the duties and reports breaches.
  • Data Processor handles data for the fiduciary under a contract, on its instructions only.
  • Consent manager is an optional, Board-registered go-between that carries people's consents.
One company can hold different roles for different data flows. A SaaS vendor is usually a fiduciary for its own users and a processor for its customers' data.
Services

From first assessment to running privacy ops

Start where you are. Each engagement usually has a fixed scope and fixed fee, agreed after a free scoping session.

How to choose a DPDP consultant · What DPDP compliance costs · Consultant vs software vs law firm · Law firms and partners: work with us

Readiness Assessment

Typically 3 to 4 weeks

  • Find all the personal data you hold, wherever it sits
  • Work out where you are responsible and where a customer is
  • Check what the law needs against what you have today
  • Rank the gaps by risk and effort
  • A plan your leadership can sign off
You get: a prioritised plan for your CTO, CFO and counsel to agree.
Scope an assessment

Implementation Programme

Typically 10 to 16 weeks

  • Clear notices and consent you can prove
  • A simple way for people to see, fix or delete their data
  • Automatic deletion when data is no longer needed
  • Stronger security and a year of tamper-evident access records
  • A breach plan, ready-made notices and a practice drill
  • Vendor contracts, policies and staff training
You get: DPDP controls running in production, plus an evidence pack.
Plan my implementation

Managed Privacy Office

Monthly retainer

  • A named privacy contact and complaints desk
  • Customer data requests tracked against your deadlines
  • A privacy check on new features and vendors
  • Regular checks that everything still works
  • Help on call if a breach happens
  • Answers to customer questionnaires, and updates when the rules change
You get: a privacy function without hiring one.
Talk about a retainer

Beyond DPDP: AI governance, AI red teaming, data localisation, API security and ransomware readiness →

How we work

Typically sixteen weeks from “where is our data?” to evidence you can hand over.

Weeks 1–3

Discover

We find every place personal data lives: systems, tools, spreadsheets and vendors.

  • Data map
  • Role map
Weeks 3–5

Decide

We agree why you use each piece of data, how long to keep it, and what needs to change.

  • Gap report
  • Target design
Weeks 5–14

Build

Our engineers make the changes with your team: consent, requests, deletion, security and contracts.

  • Controls in production
Weeks 14–16

Prove

We test it, run a practice breach against the 72-hour clock, and hand over the proof.

  • Evidence pack
  • Drill report
What you walk away with

An evidence pack. Not a slide deck.

When the regulator, an auditor or a big customer asks, you send one link that shows what you do and the evidence that it works.

See a sample evidence pack
DPDP evidence packReady for review
  • Data mapWhat you hold, where, why and for how long
  • Consent recordsEvery notice shown and every choice made, with dates
  • Security checklistEach safeguard, who owns it, and proof it works
  • Breach plan and drill reportWho does what, ready-made notices, practice timings
  • Request logEvery customer request and how fast it was closed
  • Vendor list and contractsEvery vendor, what data they touch, on what terms
Case study · Commerce SaaS

Making a 1,000+ customer commerce SaaS DPDP-ready

A multi-tenant commerce platform serving 1,000+ businesses and their shoppers: fiduciary for sellers, processor for shoppers. See all 29 controls mapped to the Act and the Rules, with the current status of each.

See the control board →
1,000+businesses whose stores these controls cover
19 / 29mapped controls live in production (13 Nov 2026)
2 minbetween copies to a warm standby in Mumbai
25+tables a deleted account is purged from
Guides

The DPDP Act, explained simply. With the detail when you need it.

All 24 guides →
PlanDPDP compliance checklistEverything your business needs to do before May 2027, team by team.Read guide → FoundationsDPDP Rules 2025, rule by ruleWhat the 2025 Rules say and when each part starts, in one place.Read guide → ObligationsBreach notification and the 72-hour reportWho to tell after a data breach, how fast, and what to say.Read guide → RolesData fiduciary vs data processorAre you responsible for the data, or handling it for someone else?Read guide → FoundationsDPDP vs GDPRAlready did GDPR? What carries over and what is new for India.Read guide → PlanDPDP Act penaltiesThe maximum fines, how they are decided, and how to lower your risk.Read guide →
Readiness check

Where do you stand today?

Twelve questions, about two minutes. Your answers stay in your browser; only your overall score is sent, and only if you submit the form below.

We know every place we store personal data, including logs, analytics and support tools.

For each kind of data, we know whether we decide how it is used or just handle it for a customer.

Our privacy notice lists each piece of data we collect and why.

We keep a record of each consent, and people can take it back as easily as they gave it.

Sensitive numbers like Aadhaar, PAN and bank details are hidden or encrypted everywhere, even in logs.

We keep records of who accessed data for at least a year, and nobody can edit them.

We have a tested breach plan that gets a full report to the regulator within 72 hours.

We know how long to keep each kind of data, and deleting it really removes it everywhere.

People can easily ask to see, fix or delete their data, and we track every request.

Our website shows a privacy contact, and we respond to complaints within 90 days.

Every vendor that handles personal data for us has a proper contract.

We know if any of our users are under 18, and if so we get a parent's verified consent.

Questions we hear

Frequently asked

When exactly do the DPDP obligations apply?

Most of the law applies from 13 May 2027. A few parts, like setting up the regulator, already apply. Getting ready usually takes four to six months, so the time to start is now. See what is in force today.

We're a B2B SaaS. Doesn't our customer carry the risk?

Only partly. For your own users and staff, the duties are yours. For data your customers put into your product, they are responsible, but they will usually pass duties to you through contracts: breach timelines, deletion, vendor controls.

Are you a law firm?

No. We are engineers and privacy specialists who build what the law requires into your systems. When you need a legal opinion, we work alongside your lawyers.

Do we need consent for everything now?

No. Some uses don't need consent, such as data used for employment, or data someone gives you voluntarily for a specific purpose and has not objected to. We help you work out where consent is really needed. Consent, explained.

What does “reasonable security safeguards” mean in practice?

Encryption, tight access control, records of who accessed data kept for a year, backups, and the same standards for your vendors. We set these up and test them.

How much engineering time will this take from our team?

Our engineers aim to do most of the work. Your team typically gives about one engineer's time for reviews, plus quick decisions from product owners.

What does an engagement cost?

Usually a fixed fee, based on how many systems hold personal data and how much of the work you want us to do. We aim to send a written proposal within three working days of a free call. See what drives the cost.

Who you'll work with

An engineer who has built platforms at national scale. Leading our engagements.

Deepak Mittal
Practice lead

Deepak Mittal

DPDP implementation lead and founder, Mirav Labs

  • Built Paytm's early technology team and platform, at 99.99% uptime
  • Built Credence at Oorja, reaching 120M+ customers; ACL (now Sinch) acquired the business
  • Runs D2 Commerce OS, a commerce platform used by 1,000+ businesses
Read Deepak's profileLinkedIn
Why our pages look like this

An Indian law about people, drawn the way India has long drawn people. Warli and Gond, and why we chose them.

Most privacy sites show locks and shields. DPDP is not about locks. It is about people, and proving what happened to their data. So we drew it in two Indian art traditions that are about exactly that.

Warli: every person is drawn

Warli painters of Maharashtra's Palghar region paint village life on mud walls in white rice paste: the harvest, the wedding, the dance. A circle and two triangles make a person, and everyone who was there is on the wall.

DPDP asks the same of your systems. Know every person whose data you hold, and keep a record of what happened to it.

Gond: no shape left empty

Gond artists of Madhya Pradesh fill every shape with dots, dashes and fine lines. Nothing is left blank.

In our drawings each dot is a piece of someone's personal data, and the line that ties them together is the programme that keeps every one of them accounted for.

Deepak Mittal

Deepak: from rows back to people

Deepak Mittal has spent twenty-five years building platforms that hold other people's data, from telecom softswitches to Paytm's early technology platform to messaging systems that reached 120 million people.

At that scale a person becomes a row in a table. DPDP turns each row back into a person with rights. That is the idea behind every drawing here, and behind how we build.

Read Deepak's profile →

How to read our drawings

  • A personthe Data Principal
  • The red dottheir record, followed everywhere
  • A hutyour business, the fiduciary
  • Figures at a huta vendor working for you
  • The pavilionthe Data Protection Board
  • Tally marksthe evidence you keep
  • Gond dots and dasheseach one a piece of someone's data

The drawings on this site are our own, inspired by Warli and Gond art. They are not Warli or Gond paintings, which are made by artists from those communities.

Start here

Book a 30-minute scoping call

Tell us a little about your product and data. On the call we walk through your likely gaps against the Rules and the order to tackle them. Then we send you a proposal, usually at a fixed fee.

  • No preparation neededA rough idea of your stack and vendors is enough.
  • NDA on requestBefore you share any architecture details.
Book a scoping call