They expertly mapped the overlapping controls between SOC 2 and ISO 27001, which saved us from duplicating work.
Jasreet Kaur B.Silicon Physical Design Engineer · Small-BusinessSOC 2 + ISO 27001 · August 2026
7 DPDP COMPLIANCE DOMAINS
DPDP countdown
Most DPDP duties apply from 13 May 2027.
Eighteen months after G.S.R. 843(E) and the DPDP Rules (G.S.R. 846(E)) were published in the Gazette dated 13 November 2025.
Countdown to 13 May 2027
Consent-manager registration rules take effect 13 November 2026
See every DPDP deadlineA comprehensive step-by-step checklist to help your organization achieve and maintain compliance with the Digital Personal Data Protection Act 2023.
Seven domains mapped to the Act and the DPDP Rules 2025 — an end-to-end program costs ₹1.5–2 lakh for a small company, ₹2–4 lakh for an MSME and ₹5–7 lakh for an enterprise (indicative).
7Compliance domains
₹250 CrMax penalty / instance
1,000+Audits delivered
DPDP Act 2023 + DPDP Rules 2025 · Phased obligations to 2027 · Last reviewed October 2026
Direct Answer
What does DPDP compliance require?
DPDP compliance means meeting the obligations the Digital Personal Data Protection Act 2023 places on data fiduciaries: give clear notice, obtain valid consent, honour data-principal rights, apply reasonable security safeguards, report breaches, and govern your processors. This checklist translates the Act and the MeitY DPDP Rules 2025 into seven actionable domains you can work through to reach and maintain compliance.
Key Takeaways
- There is no size threshold — any organization processing the digital personal data of people in India is a data fiduciary and must comply.
- Work seven domains: governance, data inventory and mapping, notice and consent, data-principal rights, security safeguards, breach management, and third-party processors.
- Obligations phase in through 2027 under the DPDP Rules 2025 — Consent Manager registration opens first, on 13 November 2026. Consent notices, security safeguards, breach reporting and SDF duties apply from 13 May 2027.
- Penalty ceilings reach ₹250 crore for inadequate security safeguards. An end-to-end program costs ₹1.5–2 lakh for small companies, ₹2–4 lakh for MSMEs and ₹5–7 lakh for enterprises (indicative).
Statutory Basis
DPDP Obligations Mapped to Checklist Domains
Each checklist domain below traces to a specific obligation in the DPDP Act 2023 or the Rules 2025.
| Checklist domain | Statutory basis | Core requirement |
|---|---|---|
| Governance & leadership | Sections 8, 10 (SDF) | Accountability structure, plus a DPO and independent auditor for Significant Data Fiduciaries |
| Data inventory & mapping | Section 8(1) | Know what personal data you hold, why, and on what lawful basis |
| Notice & consent | Sections 5, 6 and Rule 4 | Clear notice, plus free, specific, informed, unconditional, unambiguous consent and easy withdrawal |
| Data principal rights | Sections 11–14 and Rule 14 | Access, correction, erasure, grievance redressal, and nomination mechanisms |
| Security safeguards | Section 8(5) | Reasonable technical and organizational measures (encryption, access control, logging) |
| Breach management | Rule 7 | Detect, contain, and notify the Board and data principals without delay |
| Third-party management | Section 8(2) | Process personal data through processors only under a valid contract |
The Checklist
Seven Domains to Work Through
Governance & Leadership
- Designate a Data Protection Officer (if SDF)
- Establish data protection governance structure
- Define roles and responsibilities for data protection
- Conduct awareness training for leadership
- Allocate budget for compliance activities
Data Inventory & Mapping
- Create comprehensive data inventory
- Map all personal data processing activities
- Identify lawful basis for each processing activity
- Document data flows (internal and external)
- Identify and classify sensitive personal data
Notice & Consent
- Draft clear and transparent privacy notices
- Implement consent collection mechanisms
- Ensure consent is free, specific, informed, and unambiguous
- Enable easy consent withdrawal
- Consider Consent Manager registration (if applicable)
Data Principal Rights
- Implement access request handling procedures
- Enable correction and erasure mechanisms
- Establish grievance redressal process
- Set up nomination registration system
- Define response timelines and SLAs
Security Safeguards
- Implement encryption for data at rest and in transit
- Deploy access control mechanisms
- Establish security monitoring and logging
- Conduct regular vulnerability assessments
- Implement data backup and recovery procedures
Breach Management
- Develop data breach response plan
- Establish breach detection mechanisms
- Define breach notification procedures to Board
- Create Data Principal notification templates
- Conduct breach response drills
Third-Party Management
- Identify all Data Processors
- Execute Data Processing Agreements
- Conduct due diligence on processors
- Verify cross-border transfer compliance
- Monitor ongoing processor compliance
Roadmap
Suggested Implementation Timeline
Weeks shown for an MSME, 12–14 weeks end to end. A small company finishes in 8–10 weeks, and an enterprise takes more than 16.
Phase 1
Assessment & Planning
Weeks 1-3
Gap analysis, data mapping, governance setup
Phase 2
Policy & Documentation
Weeks 4-6
Privacy notices, consent forms, procedures
Phase 3
Technical Implementation
Weeks 7-12
Security controls, consent systems, rights portals
Phase 4
Monitor & Maintain
Ongoing
Audits, training, continuous improvement
Proof
In their words.
Quotes verbatim from G2. Company names added where the client confirmed them.
Instead of simply providing generic templates or checklists, their team took the time to understand our environment and requirements.
Anand .Market Risk Analyst · Mid-MarketCompliance readiness · September 2026
The team’s willingness to work with us and ease of communication.
sam v.CEO · Small-BusinessSOC 2 Type I + ISO 27001 · August 2026
They delivered the project with speed, accuracy, and cost-effectiveness.
Maneet P.Mid-MarketSOC 2 · August 2026
My only regret is that we didn’t engage them sooner in our compliance journey, which would have saved us even more time.
Mahesh Raju C. · XonarSmall-BusinessSOC 2 · GRC · August 2026
They were always responsive and willing to go the extra mile whenever we had questions or needed guidance.
Chandan J. · DsiderSmall-BusinessSOC 2 Type I · August 2026
Managing the auditor relationship on our behalf was especially valuable — it took a lot of pressure off our internal team.
Achyut B.Senior Software Engineer · Small-BusinessSOC 2 + ISO 27001 · September 2026
Their focus on ensuring that we were genuinely audit-ready rather than simply completing documentation.
Ravi V.Founder & CEO · Mid-MarketSOC 2 Type II · August 2026
The guidance was not generic or simply based on a standard checklist — they suggested practical approaches that made sense for our business.
Verified UserInternational Trade and Development · Small-BusinessSOC 2 + ISO 27001 · September 2026
What I like best is the hands-on support and clear guidance throughout the SOC 1 and SOC 2 process.
Sai Sudha S. · ExcersSmall-BusinessSOC 1 + SOC 2 · September 2026
Frequently Asked Questions
Common questions on who must comply, timelines, first steps, cost, and penalties.
Who needs to comply with the DPDP Act?
Any data fiduciary that processes the digital personal data of individuals in India — whether the processing happens in India or abroad in connection with offering goods or services to people in India. There is no turnover or headcount threshold, so startups and large enterprises alike are in scope.
When does the DPDP Act take effect?
The Act received presidential assent in August 2023, and the DPDP Rules 2025 phase the operative obligations over a runway extending into 2026–27. Consent Manager registration opens first, on 13 November 2026. Consent notices, security safeguards, breach reporting and Significant Data Fiduciary duties apply from 13 May 2027. The work takes 8–10 weeks for a small company, 12–14 weeks for an MSME and more than 16 weeks for an enterprise, so start well before May 2027.
What are the first steps to become DPDP compliant?
Start with a gap assessment and a data inventory: map every processing activity and its lawful basis. From there, draft privacy notices and consent flows, implement reasonable security safeguards, build data-principal rights and grievance mechanisms, and put a breach response playbook in place. Significant Data Fiduciaries must additionally appoint a DPO and an independent auditor.
How much does DPDP compliance cost in India?
An end-to-end DPDP program — gap assessment, data mapping, policies, consent flows, breach playbooks, and training — costs ₹1.5–2 lakh for a small company, ₹2–4 lakh for an MSME and ₹5–7 lakh for an enterprise (indicative). The final figure depends on your data footprint, the number of processing activities, and whether Significant Data Fiduciary obligations apply.
What happens if we miss a DPDP obligation?
The Data Protection Board can impose monetary penalties of up to ₹250 crore for failing to maintain reasonable security safeguards, up to ₹200 crore for breach-notification and children’s-data violations, and lower slabs for other defaults. These are ceilings, not a sum per breach, and a single incident touching several obligations can engage more than one entry.
Continue your DPDP research
- DPDP Act compliance hub — the full guide to the Act, Rules 2025, and phased deadlines.
- DPDP compliance consulting in India — gap assessment, data mapping, and end-to-end implementation.
- DPDP penalty calculator — quantify the cost of non-compliance.
- Tranquility Cybersecurity credentials & proof.
Keep Exploring
Related Reading
Privacy
DPDP Knowledge Hub
Rules 2025, penalties, SDF obligations and 14 deep-dive guides.
Read morePrivacy
DPDP Rules 2025
The rules under the DPDP Act, each with its start date and what it asks of a company.
Read morePrivacy
DPDP Implementation Roadmap
Phased roadmap from gap assessment to full compliance.
Read morePrivacy
DPDP Consent Management
Lawful consent collection, withdrawal and record-keeping under the DPDP Act.
Read moreService
DPDP Consulting in India
DPDP Act readiness ahead of the 2027 deadline.
Read moreTrust
Proof & Track Record
Every number we publish — explained, sourced and verifiable.
Read more