27/09/2026
Your business probably has more personal data than you realise.
Names. Phone numbers. Emails. Employee records. Customer histories. Website data. CRM records. WhatsApp conversations. Lead databases.
India’s Digital Personal Data Protection (DPDP) framework changes the question from:
“Are we protecting the data?”
to:
Why are we collecting it?
What are we using it for?
Have we provided the required notice?
Is consent valid where required?
Who has access?
Which vendors process it?
How long are we keeping it?
What happens when someone exercises their rights?
What happens when there is a breach?
This is where DPDP becomes an operational challenge, not simply a legal one.
The DPDP Act, 2023 establishes obligations around personal data processing, consent, notice, security, breach management, individual rights and accountability.
The DPDP Rules, 2025 provide the operational framework for these requirements. (MeitY)
And there’s an important point many businesses are missing:
There isn’t one single DPDP deadline.
India has adopted a phased implementation:
📅 13 November 2025
Initial provisions came into force.
📅 13 November 2026
The next set of provisions becomes effective.
📅 13 May 2027
The major 18-month phase comes into effect, covering much of the substantive operational framework. (MeitY)
So don’t look at 13 May 2027 and think:
“We have plenty of time.”
You don’t.
Preparation means:
→ Mapping personal data
→ Identifying where it is stored
→ Understanding data flows
→ Reviewing consent and privacy notices
→ Reviewing vendors and processors
→ Establishing retention and deletion processes
→ Strengthening security
→ Preparing breach-response procedures
→ Handling data-principal requests
→ Training employees
And this touches marketing, sales, HR, finance, IT, CRM, customer support, websites, applications, cloud platforms and vendors.
That’s why DPDP shouldn’t be treated as:
“Let’s update our privacy policy.”
A privacy policy is only one piece of the puzzle.
The real question is:
Can your organisation demonstrate what personal data it has, why it has it, where it goes, who can access it, how it is protected and when it should be deleted?
For many Indian businesses, answering that will require changes to processes, systems, people and technology.
The compliance clock is already running.
13 November 2026 is the next major milestone.
And 13 May 2027 is not the date to start preparing.
It’s the date by which much of the preparation needs to be operational.
Audit your data.
Map the gaps.
Fix the processes.
Build the controls.
Because DPDP readiness isn’t a document.
It’s a business capability.
Think your business is DPDP-ready? Let’s find out before the deadlines arrive.
DM me and let’s get on a call to identify your biggest gaps.