DPDP Act Compliance and Readiness Services in India

The Act applies to any organisation that processes the digital personal data of people in India, whether it operates from India or from abroad. If you sit outside India and offer goods or services to people in India, you are still in scope. In the Act's language you are a data fiduciary, the entity that decides why and how personal data is processed. Processors who handle data on your behalf are covered through the contract you hold with them, which means your vendor agreements become part of your compliance position. There is no revenue or headcount threshold to fall below, so a twenty person SaaS company and a listed bank are both in scope, and what differs is the depth of programme each needs. Purely personal or domestic processing sits outside the Act, as does data the data principal has themselves made publicly available.

A data principal is the individual the personal data belongs to, the term the Act uses where GDPR says data subject. The Act gives them the right to ask what data you hold and who you have shared it with, the right to correction and completion, the right to erasure, the right to nominate someone to exercise their rights if they die or become incapacitated, and the right to a grievance redressal route that actually answers them. Each of those is an operational commitment rather than a policy statement. You need a channel for the request to arrive on, a way to find that person's data across every system that holds it, and a defined turnaround you can evidence. Where a child's data is involved you also need verifiable parental consent. We build the request workflow and the audit trail that shows you honoured it.

The Schedule to the Act sets the penalties the Data Protection Board of India can impose, and they are assessed per contravention rather than as a single annual cap. Failure to take reasonable security safeguards to prevent a personal data breach carries up to 250 crore rupees. Failure to notify the Board and the affected data principals of a breach carries up to 200 crore rupees, as does a breach of the additional obligations that apply to children's data. Failure to meet the extra duties placed on a Significant Data Fiduciary carries up to 150 crore rupees, and any other contravention carries up to 50 crore rupees. The Board weighs the nature and gravity of the breach, whether it was repeated, and what you did to mitigate it, so a documented programme and a working breach process reduce your exposure even when something does go wrong.

Our engagement runs six phases and most organisations complete them in thirteen to twenty three weeks. Data discovery and mapping takes two to three weeks, the gap assessment against the Act and its Rules another two to three, consent and notice design two to four, rights and breach processes two to three, control implementation four to eight, and the readiness review one to two. The range is wide because the two variables that move it are how many systems hold personal data and how much of your security control set already exists. A company with three products, a data warehouse and an offshore support desk spends far longer in discovery than one with a single application. We give you a firm timeline after the gap assessment rather than before it, and phases can overlap where your teams have capacity to run them in parallel.

Only if you are notified as a Significant Data Fiduciary. The government can designate you on the volume and sensitivity of the data you process, the risk to data principals, and the potential impact on the sovereignty and integrity of India and on electoral democracy. If you are designated, you must appoint a Data Protection Officer based in India who reports to your board or governing body, appoint an independent data auditor, and run periodic Data Protection Impact Assessments. Every other data fiduciary still has to publish contact details for someone who can answer data principal questions, which in practice means a named person and a channel somebody monitors. Many organisations appoint the role voluntarily because enterprise customers ask for it during due diligence. We run it as a service through our vDPO offering when you would rather not hire for it.