They expertly mapped the overlapping controls between SOC 2 and ISO 27001, which saved us from duplicating work.
Jasreet Kaur B.Silicon Physical Design Engineer · Small-BusinessSOC 2 + ISO 27001 · August 2026
DPDP ACT 2023 · 4-PHASE IMPLEMENTATION ROADMAP
DPDP countdown
Most DPDP duties apply from 13 May 2027.
Eighteen months after G.S.R. 843(E) and the DPDP Rules (G.S.R. 846(E)) were published in the Gazette dated 13 November 2025.
Countdown to 13 May 2027
Consent-manager registration rules take effect 13 November 2026
See every DPDP deadlineA comprehensive, week-by-week implementation roadmap for achieving DPDP Act compliance. Proven methodology used by organizations across Mumbai, Bangalore, Delhi, Hyderabad, Gurgaon, and Pune.
A program runs in four phases and takes 8–10 weeks for a small company, 12–14 weeks for an MSME and more than 16 weeks for an enterprise, at an indicative fee of ₹1.5–2 lakh, ₹2–4 lakh and ₹5–7 lakh.
12–14Weeks for an MSME
4Implementation phases
₹2–4LIndicative MSME fee
DPDP Act 2023 + DPDP Rules 2025 · Phased deadlines into 2027 · Last reviewed October 2026
Direct Answer
How do you implement the DPDP Act 2023?
Implementing the Digital Personal Data Protection Act, 2023 is a four-phase program that takes 8–10 weeks for a small company, 12–14 weeks for an MSME and more than 16 weeks for an enterprise: assessment and planning, policy and documentation, technical implementation, and training and awareness. The single most important step is the first — a complete data-mapping and gap assessment — because every later task depends on knowing exactly what personal data you process, where it lives, and on what lawful basis.
Our indicative fee is ₹1.5–2 lakh for a small company, ₹2–4 lakh for an MSME and ₹5–7 lakh for an enterprise, with Significant Data Fiduciaries adding DPO, independent-audit, and DPIA workstreams. Because obligations phase in through 2027 under the DPDP Rules 2025 notified by MeitY, start early enough to finish your timeline before 13 May 2027 with room to spare. Use the phase table and milestones below to plan, and the DPDP Act knowledge hub for the underlying obligations.
Key Takeaways
- A practical DPDP Act implementation runs in four phases: assessment and planning, policy and documentation, technical implementation, then training and awareness. It takes 8–10 weeks for a small company, 12–14 weeks for an MSME and more than 16 weeks for an enterprise.
- Phase 1 (data mapping and gap assessment) is the foundation — most downstream cost and rework comes from skipping a complete inventory of processing activities.
- Our indicative fee is ₹1.5–2 lakh for a small company, ₹2–4 lakh for an MSME and ₹5–7 lakh for an enterprise. Significant Data Fiduciaries add DPO, independent-audit, and DPIA workstreams.
- Most duties apply from 13 May 2027 under the DPDP Rules 2025, so start early enough to finish your timeline with room to spare for consent re-engineering and vendor contract updates.
The Program
The Roadmap at a Glance
12-14 WeeksMSME Timeline
5-15 PeopleTeam Size Range
₹2-4 LakhsMSME Fee (Indicative)
4 PhasesImplementation Stages
Timeline & Budget
Phase-by-Phase Timeline
The four phases of a DPDP implementation, their typical duration, team size, and indicative budget. Phases overlap — training begins before technical work fully concludes. Weeks and fees are for an MSME. A small company finishes in 8–10 weeks for ₹1.5–2 lakh, and an enterprise takes more than 16 weeks at ₹5–7 lakh.
| Phase | Duration | Team Size | Indicative Budget |
|---|---|---|---|
| Phase 1: Assessment & Planning | Weeks 1-3 | 3-5 people | ₹0.5-1 Lakh |
| Phase 2: Policy & Documentation | Weeks 3-6 | 4-6 people (Legal, Compliance, IT) | ₹0.5-1 Lakh |
| Phase 3: Technical Implementation | Weeks 6-11 | 6-10 people (Engineering, DevOps, Security) | ₹0.5-1 Lakh |
| Phase 4: Training & Awareness | Weeks 9-12 | 2-3 people (HR, Compliance, Training) | ₹0.5-1 Lakh |
| Total program (indicative) | 12–14 weeks (MSME) | 5–15 people | ₹2–4 Lakh (MSME) |
Phase Detail
Implementation Phases
- 1
Phase 1: Assessment & Planning
Weeks 1-33-5 people₹0.5-1 LakhKey Activities- Conduct comprehensive gap assessment against DPDP Act requirements
- Map all personal data processing activities across the organization
- Identify data flows, systems, and third-party processors
- Establish governance structure and assign roles (DPO if SDF)
- Define project scope, timeline, and resource requirements
- Secure executive sponsorship and budget approval
Deliverables- Gap assessment report with prioritized remediation plan
- Data inventory and processing activity register
- Project charter with defined milestones and KPIs
- Governance framework with roles and responsibilities
- 2
Phase 2: Policy & Documentation
Weeks 3-64-6 people (Legal, Compliance, IT)₹0.5-1 LakhKey Activities- Develop comprehensive privacy policy aligned with DPDP Act
- Create privacy notices for all data collection touchpoints
- Draft Data Processing Agreements (DPAs) for vendors
- Establish consent management framework and templates
- Document data retention and deletion procedures
- Create Data Principal rights request handling procedures
- Develop breach response and notification plan
Deliverables- Privacy policy and privacy notices (website, app, B2B)
- Standard DPA templates for vendors and processors
- Consent form templates and consent withdrawal procedures
- Data retention schedule by data category
- Data Principal rights request workflow and SLA
- Incident response and breach notification plan
- 3
Phase 3: Technical Implementation
Weeks 6-116-10 people (Engineering, DevOps, Security)₹0.5-1 LakhKey Activities- Implement consent management system or integrate Consent Manager
- Deploy data encryption for data at rest and in transit
- Implement access controls and role-based permissions
- Set up automated data retention and deletion workflows
- Build Data Principal rights request portal
- Implement security monitoring and logging
- Configure breach detection and alerting mechanisms
- Integrate privacy controls into existing applications
Deliverables- Consent management platform (CMP) or Consent Manager integration
- Encryption implementation across databases and file systems
- Identity and Access Management (IAM) system
- Automated data lifecycle management system
- Self-service Data Principal rights portal
- Security Information and Event Management (SIEM) integration
- Privacy-enhanced application architecture
- 4
Phase 4: Training & Awareness
Weeks 9-122-3 people (HR, Compliance, Training)₹0.5-1 LakhKey Activities- Conduct role-based DPDP Act training for all employees
- Specialized training for data handlers and processors
- Executive briefing on DPDP compliance and risks
- Developer training on privacy-by-design principles
- Customer support training on Data Principal rights
- Vendor and third-party processor training
Deliverables- Training materials and e-learning modules
- Role-specific training completion certificates
- Privacy awareness campaign materials
- Developer privacy guidelines and secure coding standards
- Vendor onboarding and training program
Checkpoints
Critical Milestones
Week 3
Gap Assessment Complete
Full understanding of compliance gaps and remediation priorities
Week 6
Policies Approved
All privacy policies and procedures documented and approved
Week 8
Consent System Live
Consent management platform operational across all touchpoints
Week 11
Technical Controls Deployed
All security and privacy technical controls implemented
Week 12
Training Complete
Organization-wide DPDP awareness and training completed
Week 14
Compliance Validation
External audit or assessment validates DPDP readiness
Proof
In their words.
Quotes verbatim from G2. Company names added where the client confirmed them.
Instead of simply providing generic templates or checklists, their team took the time to understand our environment and requirements.
Anand .Market Risk Analyst · Mid-MarketCompliance readiness · September 2026
The team’s willingness to work with us and ease of communication.
sam v.CEO · Small-BusinessSOC 2 Type I + ISO 27001 · August 2026
They delivered the project with speed, accuracy, and cost-effectiveness.
Maneet P.Mid-MarketSOC 2 · August 2026
My only regret is that we didn’t engage them sooner in our compliance journey, which would have saved us even more time.
Mahesh Raju C. · XonarSmall-BusinessSOC 2 · GRC · August 2026
They were always responsive and willing to go the extra mile whenever we had questions or needed guidance.
Chandan J. · DsiderSmall-BusinessSOC 2 Type I · August 2026
Managing the auditor relationship on our behalf was especially valuable — it took a lot of pressure off our internal team.
Achyut B.Senior Software Engineer · Small-BusinessSOC 2 + ISO 27001 · September 2026
Their focus on ensuring that we were genuinely audit-ready rather than simply completing documentation.
Ravi V.Founder & CEO · Mid-MarketSOC 2 Type II · August 2026
The guidance was not generic or simply based on a standard checklist — they suggested practical approaches that made sense for our business.
Verified UserInternational Trade and Development · Small-BusinessSOC 2 + ISO 27001 · September 2026
What I like best is the hands-on support and clear guidance throughout the SOC 1 and SOC 2 process.
Sai Sudha S. · ExcersSmall-BusinessSOC 1 + SOC 2 · September 2026
DPDP Implementation — Frequently Asked Questions
Timelines, first steps, indicative cost, and how to reuse an existing GDPR program.
How long does DPDP Act implementation take?
It depends on size. End to end, a small company takes 8–10 weeks, an MSME 12–14 weeks and an enterprise more than 16 weeks. The work runs in four phases: assessment and planning, policy and documentation, technical implementation, and training and awareness, with a validation step at the end. For an MSME that is roughly weeks 1–3, 3–6, 6–11 and 9–12, then validation by week 14. Significant Data Fiduciaries take longer because of additional DPO, audit, and DPIA workstreams.
What is the first step in DPDP implementation?
The first step is a gap assessment paired with a full data-mapping exercise — cataloguing every personal-data processing activity, the systems that hold the data, the lawful basis for each, and the third-party processors involved. Almost every downstream task (consent flows, privacy notices, retention schedules, breach playbooks) depends on this inventory, so a rushed or partial map is the most common cause of cost overruns and rework later.
How much does DPDP compliance cost in India?
An end-to-end DPDP program — gap assessment, data mapping, policies, consent flows, breach playbooks, and training — costs ₹1.5–2 lakh for a small company, ₹2–4 lakh for an MSME and ₹5–7 lakh for an enterprise (indicative). The figure scales with your data footprint, the number of processing activities, and whether Significant Data Fiduciary obligations apply. You can size penalty exposure separately with our DPDP penalty calculator.
When should we start DPDP implementation?
Start early enough to finish before 13 May 2027 with room to spare. The DPDP Act received assent in August 2023 and the DPDP Rules 2025 stagger the operative duties over a runway extending into 2027 — Consent Manager registration opens first, on 13 November 2026, and consent notices, security safeguards, breach reporting and Significant Data Fiduciary duties apply from 13 May 2027. Data mapping, consent re-engineering, and vendor-contract updates take time (8–10 weeks end to end for a small company, 12–14 for an MSME, more than 16 for an enterprise), so an early start avoids a compressed, higher-risk scramble near the deadline.
Can we reuse a GDPR program for DPDP implementation?
A GDPR program is a strong head start but is not a substitute. The DPDP Act is consent-centric with no legitimate-interest ground, sets an 18-year age threshold for children’s data, and introduces India-specific constructs such as Consent Managers and Significant Data Fiduciaries. Reuse your data inventory, DPIA methodology, and breach processes, but plan a dedicated workstream to close the India-specific deltas. Tranquility Cybersecurity (TCSA) maps existing GDPR controls onto DPDP requirements as part of implementation.
Ready to plan your rollout? Anchor it against the DPDP Act knowledge hub, quantify downside risk with the penalty calculator, and review delivered outcomes on our proof page. Tranquility Cybersecurity (TCSA) runs the full program through DPDP compliance consulting in India.
Keep Exploring
Related Reading
Privacy
DPDP Knowledge Hub
Rules 2025, penalties, SDF obligations and 14 deep-dive guides.
Read morePrivacy
DPDP Compliance Checklist
A step-by-step checklist for DPDP Act readiness.
Read morePrivacy
DPDP Rules 2025
The rules under the DPDP Act, each with its start date and what it asks of a company.
Read moreService
DPDP Consulting in India
DPDP Act readiness ahead of the 2027 deadline.
Read morePrivacy
DPDP Consent Management
Lawful consent collection, withdrawal and record-keeping under the DPDP Act.
Read moreTrust
Proof & Track Record
Every number we publish — explained, sourced and verifiable.
Read more