8 MODULES

DPDP Act 2023 · Knowledge Hub · Free course

Learn the DPDP Act
A free course in eight modules

About this course

A free course on India's Digital Personal Data Protection Act, 2023 and the DPDP Rules 2025, written by three of our lead auditors. It starts with what the Act is and ends with a programme you can run, and every claim names the section or rule behind it.

The consent-manager registration provisions take effect on 13 November 2026 and most duties start on 13 May 2027. The highest penalty in the Schedule may extend to ₹250 crore. The course maps every obligation, right and deadline in between.

Who it is for

Founders, DPOs, engineers and lawyers who have to put India's data protection law to work. No legal background needed.

How long it takes

About 6 hours for the 33 core lessons, about 15 hours for all 79. Every lesson stands on its own, so you can stop anywhere.

How each lesson works

Each lesson starts with the answer, shows the mechanism in a figure, works one example through and ends with a short check. Every claim names its section or rule. New lessons are written this way, and the older guides are being brought into the same shape, module by module.

Get Free Consultation DPDP Framework Overview

8Modules

79Lessons, 24 ready

6 hAbout 6 hours for the core path

DPDP Act 2023 + DPDP Rules 2025 · Checked against the Gazette on 22 October 2026

Start with lesson 1.1: What the DPDP Act is, in plain words

The course

Eight modules. Read in order.

Core lessons make the short path, so read those in order. Lessons marked Coming are being written and appear here the day they are published. Or jump in by role, below.

Module 01 · 9 lessons · 5 core · about 1 h 45 min · 5 ready

Start here: what the Act is and what is switched on today.

After this module you can explain in two minutes what the DPDP Act is, who it covers, which data it protects and which parts apply today.

1.1What the DPDP Act is, in plain wordsThe full form, the purpose and the key terms, one line each.Core · 8 min
1.2Is the DPDP Act in force? Every start dateWhich parts apply today and which start on 13 November 2026 and 13 May 2027, each date beside its Gazette line.Core · 24 min
1.3The Act chapter by chapter, in plain EnglishThe nine chapters of the Act, one plain-English summary each.Being written by Saundhi ChauhanCore · Coming
1.4What counts as personal dataThe definition in section 2(t), 25 everyday examples, and why the Act has no sensitive class.Being written by Saundhi ChauhanCore · Coming
1.5Who is who: fiduciary, processor and principalThe data fiduciary, the processor and the person the data is about, and who answers for what.Core · 9 min

4 more lessons in this module (2 ready)

1.6Where DPDP sits among India's privacy lawsThe Act, the IT Act and the sector rules, and how they fit together.10 min
1.7What the Act replaces: the SPDI Rules and section 43AWhat section 44(2) removes from the IT Act, and why the SPDI Rules apply until May 2027.Being written by Saundhi ChauhanComing
1.8Reading the Act and the Rules yourselfThe official copies of the Act and the Rules, and a map of every section and rule with its start date.Being written by Saundhi ChauhanComing
1.9The DPDP Rules 2025, rule by ruleWhat the DPDP Rules 2025 ask of a company, rule by rule, from notices to breaches and erasure.7 min

Module 02 · 12 lessons · 5 core · about 2 h 10 min · 1 ready

Lawful processing: principles, grounds, notice and consent.

After this module you can pick the right ground for every use of personal data, and design a notice and consent flow that meets sections 5 to 7 and Rule 3.

2.1The seven principles behind the ActThe seven principles the government lists, and the section that gives each one force.Being written by Saundhi ChauhanCore · Coming
2.2When you need consent, and the nine uses that do notAll nine section 7 uses with the Act's own illustrations, and the duties that remain.Being written by Parth ChauhanCore · Coming
2.3Consent under the DPDP ActWhat section 6 asks of valid consent, how withdrawal works, and where consent managers under Rule 4 fit.Core · 10 min
2.5Writing a notice that meets Rule 3Every line Rule 3 asks a notice to carry, with a worked notice.Being written by Saundhi ChauhanCore · Coming
2.11Children's data and verifiable parental consentWho is a child under the Act, what verifiable parental consent looks like, and the Fourth Schedule exemptions.Being written by Surendra Pal SinghCore · Coming

7 more lessons in this module (0 ready)

2.4Five words that make consent valid, testedFree, specific, informed, unconditional and unambiguous: real consent screens, tested.Being written by Saundhi ChauhanComing
2.6Customers who signed up before the Act: the one-time noticeThe section 5(2) notice for people whose consent was given before commencement.Being written by Saundhi ChauhanComing
2.7Proving consent: the records to keepWhat section 6(10) makes you prove, and the records that prove it.Being written by Saundhi ChauhanComing
2.8Consent managers and Rule 4Who can register as a consent manager under Rule 4 and the First Schedule, and what an ordinary company should do before November 2026.Being written by Parth ChauhanComing
2.9Consent manager or consent management platform?A registered consent manager and a consent management platform are different things. How to choose.Being written by Parth ChauhanComing
2.10Cookie consent under the DPDP ActWhat a cookie banner has to do under the Act, read from its text.Being written by Parth ChauhanComing
2.12Persons with disability and lawful guardiansWho counts as a lawful guardian under Rule 11, and how to verify one.Being written by Surendra Pal SinghComing

Module 03 · 11 lessons · 5 core · about 2 h 10 min · 2 ready

The fiduciary's duties: security, retention, processors and people.

After this module you can list what section 8 asks of every data fiduciary, and show the evidence for each duty: safeguards, retention, processor contracts and a named contact.

3.1What every data fiduciary must doSections 4 to 10 in one place: the grounds for processing, the notice, consent and the general duties in section 8.Core · 10 min
3.2Data processors: who counts and what the contract must sayWho counts as a data processor, what the contract must say, and ten everyday examples.Being written by Parth ChauhanCore · Coming
3.4Reasonable security safeguards under Rule 6The Rule 6 safeguards one by one, and the evidence an auditor expects for each.Being written by Parth ChauhanCore · Coming
3.6Retention and erasure: the Third Schedule and the one-year logThe Third Schedule erasure periods, the 48-hour warning and the one-year log.Being written by Saundhi ChauhanCore · Coming
3.7The DPO and the contact person: who needs oneWhen a DPO is required, who else must be named under Rule 9, and what the job is day to day.Being written by Surendra Pal SinghCore · Coming

6 more lessons in this module (1 ready)

3.3A data processing agreement, clause by clauseThe clauses a processor contract needs for the Act, with an open template.Being written by Parth ChauhanComing
3.5Does the Act require penetration testing?What Rule 6 means for vulnerability assessment and penetration testing.Being written by Parth ChauhanComing
3.8A DPO's first 90 daysWhat a new DPO does in the first 90 days, week by week.Being written by Surendra Pal SinghComing
3.9Significant data fiduciaries and their extra dutiesWhat changes once the government notifies you as a significant data fiduciary: a DPO based in India, an independent data auditor, and a DPIA and audit every twelve months under Rule 13.11 min
3.10Running a DPIA under Rule 13When Rule 13 makes a DPIA yearly, and how to run one that holds up.Being written by Surendra Pal SinghComing
3.11A DPDP audit: what an auditor testsWhat an auditor tests, area by area, and the evidence that passes.Being written by Saundhi ChauhanComing

Module 04 · 10 lessons · 5 core · about 1 h 45 min · 3 ready

Rights, breaches and the Board: from a request to a penalty.

After this module you can run a rights and grievance desk and a breach desk, and follow a complaint from the first email to the Board and the appeal.

4.1The rights people have under the ActThe rights in sections 11 to 14, and the duties section 15 puts on the person: access, correction, erasure, grievance and nomination.Core · 9 min
4.3Grievance redressal and the 90-day limitSection 13 and Rule 14: who has to answer a grievance, and the 90-day ceiling.Being written by Surendra Pal SinghCore · Coming
4.4Personal data breaches: who you tell and whenWho you tell after a personal data breach and when: each affected person without delay, and the Board without delay and again within 72 hours, under Rule 7.Core · 9 min
4.7The Data Protection Board of IndiaWhat the Board is, what it can and cannot do yet, and how a complaint reaches it.Being written by Surendra Pal SinghCore · Coming
4.8Penalties and how enforcement worksHow the Board sets a penalty under section 33 and the Schedule, where the ceilings may extend to ₹250 crore, and where the money goes under section 34.Core · 10 min

5 more lessons in this module (0 ready)

4.2Answering a rights request in practiceHow a request desk handles access, correction, erasure and nomination.Being written by Surendra Pal SinghComing
4.5Fifteen incidents: reportable or not?Fifteen incidents, and whether each one is a reportable personal data breach.Being written by Surendra Pal SinghComing
4.6One incident, two clocks: DPDP and CERT-InOne timeline for a breach that must go to the Board and to CERT-In.Being written by Surendra Pal SinghComing
4.9How the Board sets a penalty: section 33(2)The section 33(2) factors the Board must weigh before it sets a penalty.Being written by Surendra Pal SinghComing
4.10Ending a case: undertakings, mediation and appealsVoluntary undertakings, mediation and the appeal to TDSAT.Being written by Surendra Pal SinghComing

Module 05 · 10 lessons · 3 core · about 1 h 50 min · 2 ready

Exemptions, borders and special cases.

After this module you can tell when part of the Act switches off, when personal data may leave India, and how to answer a government request.

5.1Exemptions in section 17, and the duties that surviveWhat each section 17 exemption switches off, and the duties that survive it.Being written by Saundhi ChauhanCore · Coming
5.2Processing foreign customers' data from IndiaWhat section 17(1)(d) exempts for Indian teams processing foreign customers' data, and what still applies.Being written by Parth ChauhanCore · Coming
5.5Sending personal data outside IndiaWhen personal data may leave India under section 16 and Rule 15, and what a notified restriction would change.Core · 9 min

7 more lessons in this module (1 ready)

5.3Research, archiving and statistics under Rule 16What Rule 16 and the Second Schedule permit for research, archiving and statistics.Being written by Saundhi ChauhanComing
5.4Startups and section 17(3)What section 17(3) could exempt, what has been notified, and what applies today.Being written by Parth ChauhanComing
5.6Data localisation across Indian lawsWhich Indian laws keep data in the country and which do not.Being written by Parth ChauhanComing
5.7When the government asks for dataSection 36, Rule 23 and the Seventh Schedule, with a request-handling checklist.Being written by Surendra Pal SinghComing
5.8RTI requests after section 44(3)What section 44(3), in force since 13 November 2025, changed in the RTI Act.Being written by Surendra Pal SinghComing
5.9AI, training data and the ActTraining data, scraped data and automated decisions under the Act.Being written by Parth ChauhanComing
5.10The hard casesThe cases where the Act pulls two ways: consent and legitimate uses, children's data, transfers abroad and clashes with other laws.15 min

Module 06 · 9 lessons · 2 core · about 2 h · 2 ready

Your sector, and your own staff.

After this module you can apply the Act to the way your sector collects and uses personal data, including the data you hold about your own staff.

6.1How the Act lands, sector by sectorHow the Act lands in fintech, healthcare, SaaS, e-commerce, HR tech and edtech, sector by sector.Core · 15 min
6.2Your own staff: employee and HR dataHiring to exit: what section 7(i) allows and what still needs consent.Being written by Surendra Pal SinghCore · Coming

7 more lessons in this module (1 ready)

6.3SaaS and IT services: fiduciary or processor?When a SaaS company is the fiduciary, when it is the processor, and what changes.Being written by Parth ChauhanComing
6.4Banks, NBFCs and insurers: DPDP alongside RBIWhere RBI's rules and the Act ask for the same thing, and where they differ.24 min
6.5Digital lenders and NBFCsWhere the Act meets RBI's digital lending rules.Being written by Parth ChauhanComing
6.6Hospitals, clinics and health appsConsent, medical emergencies and children in hospitals, clinics and health apps.Being written by Surendra Pal SinghComing
6.7Schools, coaching centres and edtechChildren, parents and consent in schools, coaching centres and edtech apps.Being written by Surendra Pal SinghComing
6.8Marketing: SMS, email, WhatsApp and callsConsent for SMS, email, WhatsApp and calls, alongside TRAI's rules.Being written by Parth ChauhanComing
6.9E-commerce, gaming and social media platformsThe Third Schedule three-year erasure rule for large platforms, engineered.Being written by Parth ChauhanComing

Module 07 · 5 lessons · 2 core · about 1 h 5 min · 4 ready

Reuse what you already run: GDPR, ISO 27001, ISO 27701 and SOC 2.

After this module you can map an existing GDPR, ISO or SOC 2 programme to the Act, and list only the gaps left to close.

3 more lessons in this module (2 ready)

7.2Twelve differences that change the workThe twelve differences that change what a GDPR team has to do for India.17 min
7.4ISO 27701, clause by clause against the ActISO 27701 clause by clause against the sections and rules of the Act.Being written by Saundhi ChauhanComing
7.5What a SOC 2 report proves for DPDP, and what it does notWhere the SOC 2 criteria support DPDP duties, and the duties they never touch.12 min

Module 08 · 13 lessons · 6 core · about 2 h 25 min · 5 ready

Build your DPDP programme.

After this module you can plan, price and run a DPDP programme from gap assessment to evidence, and answer your board when it asks where you stand.

8.1Start with a gap assessmentWhat a gap assessment covers, how long it takes and what you get at the end.Being written by Parth ChauhanCore · Coming
8.2Data mapping: find every place personal data livesHow to find every system, vendor and spreadsheet that holds personal data.Being written by Parth ChauhanCore · Coming
8.4The implementation roadmap, phase by phaseThe phases of a DPDP programme, and how long the whole programme takes: 8–10 weeks for a small company, 12–14 for an MSME, more than 16 for an enterprise.Core · 11 min
8.5The compliance checklistThe DPDP duties as a step-by-step checklist, in the order most teams tackle them.Core · 10 min
8.10What DPDP compliance costs, and how long it takesThe work, the tools and the time, priced by company size.Being written by Parth ChauhanCore · Coming
8.12Is there a DPDP certification?What exists, what it proves, and why the Act itself creates no certificate.Being written by Saundhi ChauhanCore · Coming

7 more lessons in this module (3 ready)

8.3A record of processing, with a free templateWhat a record of processing should hold, with an open template.Being written by Saundhi ChauhanComing
8.6The implementation guide for Indian companiesThe whole programme in one long read, from first scoping to evidence.10 min
8.7The Rules roadmap and its deadlinesWhat to do before each start date, quarter by quarter.16 min
8.8Working back from 13 May 2027A plan that starts from the main start date and works backwards.11 min
8.9A privacy policy, clause by clauseA privacy policy for the Act, clause by clause, with an open template.Being written by Saundhi ChauhanComing
8.11Choosing compliance softwareWhat a compliance tool can do and what it cannot, vendor-neutral.Being written by Parth ChauhanComing
8.13Eight questions a board should askEight questions a board or founder should put to management.Being written by Surendra Pal SinghComing

Jump in by role

Four ways in. Pick your role.

Founder or CEOWhat applies, what it costs, what the board should ask.10 lessons · 5 ready · about 1 h 55 min

1.1What the DPDP Act is, in plain words
1.2Is the DPDP Act in force? Every start date
1.5Who is who: fiduciary, processor and principal
3.1What every data fiduciary must do
4.8Penalties and how enforcement works
5.4Startups and section 17(3) (coming)
6.3SaaS and IT services: fiduciary or processor? (coming)
8.10What DPDP compliance costs, and how long it takes (coming)
8.12Is there a DPDP certification? (coming)
8.13Eight questions a board should ask (coming)

DPO or privacy leadThe desks you will run and the evidence you will keep.10 lessons · 4 ready · about 2 h

1.2Is the DPDP Act in force? Every start date
1.9The DPDP Rules 2025, rule by rule
2.3Consent under the DPDP Act
2.5Writing a notice that meets Rule 3 (coming)
3.7The DPO and the contact person: who needs one (coming)
3.8A DPO's first 90 days (coming)
3.10Running a DPIA under Rule 13 (coming)
4.2Answering a rights request in practice (coming)
4.3Grievance redressal and the 90-day limit (coming)
4.4Personal data breaches: who you tell and when

Engineer or security leadSafeguards, logs, erasure clocks and the two breach clocks.9 lessons · 2 ready · about 1 h 40 min

1.4What counts as personal data (coming)
2.10Cookie consent under the DPDP Act (coming)
3.4Reasonable security safeguards under Rule 6 (coming)
3.5Does the Act require penetration testing? (coming)
3.6Retention and erasure: the Third Schedule and the one-year log (coming)
4.4Personal data breaches: who you tell and when
4.6One incident, two clocks: DPDP and CERT-In (coming)
7.3What ISO 27001 covers, and what it does not
8.2Data mapping: find every place personal data lives (coming)

Legal or complianceThe text, the grounds, the exemptions and how a case ends.10 lessons · 2 ready · about 1 h 50 min

1.8Reading the Act and the Rules yourself (coming)
1.9The DPDP Rules 2025, rule by rule
2.2When you need consent, and the nine uses that do not (coming)
2.4Five words that make consent valid, tested (coming)
3.2Data processors: who counts and what the contract must say (coming)
3.3A data processing agreement, clause by clause (coming)
4.9How the Board sets a penalty: section 33(2) (coming)
4.10Ending a case: undertakings, mediation and appeals (coming)
5.1Exemptions in section 17, and the duties that survive (coming)
5.5Sending personal data outside India

The two-minute answer

What the DPDP Act is, and who it covers.

The Digital Personal Data Protection Act, 2023 (DPDP Act) sets the rules for how a business handles the digital personal data of people in India, and the DPDP Rules 2025 fill in the detail: what a notice must say, how fast a breach is reported and how long data is kept. The duties fall on the data fiduciary, the business that decides why and how the data is used (section 2(i)). That includes Indian startups and enterprises, and foreign companies that process personal data in connection with offering goods or services to people in India (section 3(b)), wherever the processing happens.

The Act switches on in three steps. The definitions and the Data Protection Board have applied since 13 November 2025. The consent-manager registration provisions take effect on 13 November 2026. Notice and consent, verifiable parental consent, security safeguards and breach reporting apply from 13 May 2027. The extra duties of a Significant Data Fiduciary (SDF) start then too, but only for a business the government notifies under section 10(1), and we found no such notification in the Gazette on 22 October 2026. A notified SDF appoints a Data Protection Officer based in India, engages an independent data auditor and runs a Data Protection Impact Assessment and an audit every twelve months (section 10(2), Rule 13).

From 13 May 2027 the Data Protection Board can impose penalties that may extend to ₹250 crore for failures such as inadequate security safeguards. You can model your exposure with our DPDP penalty calculator. Our indicative fee is ₹1.5–2 lakh for a small company, ₹2–4 lakh for an MSME and ₹5–7 lakh for an enterprise, and the work takes 8–10, 12–14 or more than 16 weeks, so start well before 13 May 2027.

Start with lesson 1.1 and read the core lessons in order. Keep lesson 1.9, the DPDP Rules 2025, rule by rule, open while you work. The modules above take obligations, rights, consent, breach response and transfers abroad in turn. When you want hands-on help, our DPDP compliance consulting team is part of a firm that has delivered 1,000+ audits across 20+ frameworks. Our proof page shows how we count them. Or compare providers in our review of the top DPDP consultants in India, with city lists for Delhi NCR, Mumbai and Bengaluru.

Four things to know first.

The Act covers digital personal data processed in India, and processing abroad when it is part of offering goods or services to people in India (section 3). Data used for personal or domestic purposes, and data a person has chosen to make public about herself, sit outside it.
Obligations phase in through 2027 under the DPDP Rules 2025: the Consent Manager registration provisions take effect first, on 13 November 2026, and consent notices, security safeguards and breach reporting apply from 13 May 2027. SDF duties apply from then only to a business the government notifies under section 10(1).
Penalty ceilings may extend to ₹250 crore for failing to take reasonable security safeguards, and to ₹200 crore for an unreported breach or a breach of the children’s data duties.
Our indicative fee is ₹1.5–2 lakh for a small company, ₹2–4 lakh for an MSME and ₹5–7 lakh for an enterprise. A business notified as a Significant Data Fiduciary has more to build: a DPO based in India, an independent data audit and a DPIA every twelve months.

The reference shelf

Everything else, within reach.

The Act and the Rules

Read the law itself, section by section.

Reading the Act and the Rules yourself (section and rule map with start dates)Coming
The DPDP Rules 2025, rule by rule
The Act, as published in the Gazette (MeitY copy)
The DPDP Rules 2025, G.S.R. 846(E) (eGazette)
Commencement notification, G.S.R. 843(E) (eGazette)

Glossary

Short definitions, each linked to the lesson that goes deeper.

Templates and downloads

Open, no form to fill.

DPDP Act templates and resourcesOpen templates for a privacy notice, a DPA, consent forms, a DPIA, breach notices and a data inventory.
DPDP compliance template (page)
DPDP compliance template (PDF)
Breach-response playbook: the first 72 hours (PDF)
Record of processing template (in lesson 8.3)Coming
Data processing agreement template (in lesson 3.3)Coming
Privacy policy template (in lesson 8.9)Coming

Tools

Answer one question about your own business.

Revise and practise

For revision, training sessions and exams.

DPDP training questions, answered from the ActComing
The DPDP Act for UPSC and other examsComing
The DPDP Act in HindiComing

When you want help

Not lessons. Where to go when you want someone to do the work with you.

Beyond DPDP

Related frameworks. Outside the course, linked from the lessons that need them.

Proof

In their words.

Quotes verbatim from G2. Company names added where the client confirmed them.

Verify on G2

They expertly mapped the overlapping controls between SOC 2 and ISO 27001, which saved us from duplicating work.

Jasreet Kaur B.Silicon Physical Design Engineer · Small-BusinessSOC 2 + ISO 27001 · August 2026

Instead of simply providing generic templates or checklists, their team took the time to understand our environment and requirements.

Anand .Market Risk Analyst · Mid-MarketCompliance readiness · September 2026

The team’s willingness to work with us and ease of communication.

sam v.CEO · Small-BusinessSOC 2 Type I + ISO 27001 · August 2026

They delivered the project with speed, accuracy, and cost-effectiveness.

Maneet P.Mid-MarketSOC 2 · August 2026

My only regret is that we didn’t engage them sooner in our compliance journey, which would have saved us even more time.

Mahesh Raju C. · XonarSmall-BusinessSOC 2 · GRC · August 2026

They were always responsive and willing to go the extra mile whenever we had questions or needed guidance.

Chandan J. · DsiderSmall-BusinessSOC 2 Type I · August 2026

Managing the auditor relationship on our behalf was especially valuable — it took a lot of pressure off our internal team.

Achyut B.Senior Software Engineer · Small-BusinessSOC 2 + ISO 27001 · September 2026

Their focus on ensuring that we were genuinely audit-ready rather than simply completing documentation.

Ravi V.Founder & CEO · Mid-MarketSOC 2 Type II · August 2026

The guidance was not generic or simply based on a standard checklist — they suggested practical approaches that made sense for our business.

Verified UserInternational Trade and Development · Small-BusinessSOC 2 + ISO 27001 · September 2026

What I like best is the hands-on support and clear guidance throughout the SOC 1 and SOC 2 process.

Sai Sudha S. · ExcersSmall-BusinessSOC 1 + SOC 2 · September 2026

Questions people ask about the DPDP Act

Straight answers to the questions Indian and global teams ask before starting DPDP compliance.

Who must comply with the DPDP Act 2023?

Every data fiduciary, meaning any organisation that decides the purpose and means of processing digital personal data of individuals in India. The Act also applies extraterritorially to foreign companies that process personal data in connection with offering goods or services to data principals in India. Duties grow with the stakes. The government can notify a fiduciary that handles large volumes of personal data, or sensitive data, as a Significant Data Fiduciary with extra duties under section 10.

What is the deadline for DPDP compliance?

Compliance is phased. The Act received assent in August 2023, and G.S.R. 843(E) switches it on in three steps. The definitions and the Data Protection Board’s provisions took effect on 13 November 2025. The Consent Manager registration provisions take effect on 13 November 2026. Consent notices, security safeguards, breach reporting and rights apply from 13 May 2027, and so do the Significant Data Fiduciary duties, for any business the government notifies as one under section 10(1). The work takes 8–10 weeks for a small company, 12–14 weeks for an MSME and more than 16 weeks for an enterprise, so start well before May 2027.

What are the penalties under the DPDP Act?

From 13 May 2027 the Data Protection Board can impose monetary penalties of up to ₹250 crore for failing to maintain reasonable security safeguards, up to ₹200 crore for breach-notification and children’s-data violations, and lower slabs for other defaults. These are ceilings, not a sum per breach, and a single incident that touches several obligations can engage more than one entry.

What is a Significant Data Fiduciary (SDF)?

An SDF is a class of data fiduciary designated by the central government based on factors such as the volume and sensitivity of personal data processed and the risk to data principals, electoral democracy, state security, or public order. SDFs must appoint an India-based Data Protection Officer, engage an independent data auditor, and conduct periodic Data Protection Impact Assessments and audits.

How much does DPDP compliance cost in India?

An end-to-end DPDP compliance programme, covering the gap assessment, data mapping, policies, consent flows, breach playbooks and training, costs ₹1.5–2 lakh for a small company, ₹2–4 lakh for an MSME and ₹5–7 lakh for an enterprise (indicative). The final figure depends on your data footprint, the number of processing activities, and whether Significant Data Fiduciary obligations apply.

We already comply with GDPR. Does that cover DPDP?

Not on its own. A GDPR programme covers much of the ground, but the DPDP Act has no legitimate-interests ground (without consent, a business can rely only on the section 7 uses or a section 17 exemption), adds consent managers and Significant Data Fiduciaries, and has a breach reported to both the Board and each affected person. Lesson 7.1 sets the two laws side by side and lists the work you still have to do.

Is there a certificate at the end of the course?

No. The course is free to read and it does not lead to a certificate. The DPDP Act creates no certification scheme of its own, which lesson 8.12 explains. What you keep is the knowledge and the templates.

Who teaches this course

Surendra Pal SinghChief Information Security Officer & Data Protection OfficerCISODPOCISAMCSEITILISO 27001 Lead AuditorISO 27701 Lead AuditorISO 42001 Lead Auditor

Saundhi ChauhanLead AuditorISO 27001 Lead AuditorISO 27701 Lead AuditorISO 42001 Lead Auditor

Parth ChauhanChief Compliance Officer & Co-FounderISO 27001 Lead AuditorISO 27701 Lead AuditorISO 42001 Lead AuditorCEH

Last checked against the Gazette: 22 October 2026 • Written and reviewed by certified lead auditors

1,000+Audits Delivered

300+SOC 2 Engagements

100+SOC 1 Engagements

20+Frameworks

Keep Exploring