Is your business DPDP-ready?
Check your website live, or answer seven quick questions if you do not have one. See what is missing, the Act section behind each gap, and the maximum fine at stake.
- 8duties assessed
- ₹250 crorehighest penalty tier
- < 2 minto your report
- Up to ₹250 croreFailing to keep reasonable security safeguards to prevent a personal data breach.
- Up to ₹200 croreFailing to notify the Data Protection Board and affected people of a breach, or breaching duties on children’s data.
- Up to ₹150 croreFailing to meet the additional duties of a Significant Data Fiduciary.
Dates and fines are from published summaries of the DPDP Act, 2023 and Rules, 2025, not the Gazette. Confirm with your legal adviser.
The DPDP Act in plain words
- What it isIndia’s data protection law. It sets rules for how any organisation collects, uses, stores and shares the personal data of people in India.
- Who it applies toAny business that handles personal data of individuals in India: customers, employees, leads and users. This includes small businesses and companies outside India that serve people in India.
- Why it matters nowThe detailed Rules were notified in November 2025. Most duties start about 18 months later, so the time to map your data and fix your systems is now.
What the law asks of a business
Clear notice
Tell people, in plain language, what data you collect, why, and how to withdraw consent or complain.
Valid consent
Ask for consent that is free, specific, informed and clear, and make it as easy to withdraw as to give.
Collect only what you need
Use personal data only for the purpose you stated, and keep it only as long as that purpose needs.
Reasonable security
Protect data with safeguards such as encryption, access control, logging and backups, so a breach is prevented or contained.
Breach response
Tell the Data Protection Board and affected people about a breach, and send a detailed report to the Board within 72 hours.
Children’s data
Get verifiable parental consent for anyone under 18, and avoid tracking or targeted advertising aimed at children.
People’s rights
Let people see a summary of their data, correct it, have it erased, nominate someone, and complain to you first.
Logs and erasure
Keep traffic data and processing logs for at least one year, then erase data you no longer need.
Six steps from here to ready
Map your data
Find where personal data enters, where it lives and who can reach it: website forms, CRM, email, spreadsheets, apps and vendors.
Check the gaps
Compare what you do today with what the Act and Rules ask for, and rank the gaps by risk.
Fix notices and consent
Update forms, notices and consent records so each choice is clear, recorded and easy to withdraw.
Strengthen security
Add access control, multi-factor login, encryption, backups and logging where the review shows gaps.
Plan for a breach
Write a response plan, test it, and set up the monitoring and logs you would need to report one.
Train and keep it running
Brief your team, set up ways to handle people’s requests, and review regularly as the Rules settle.
Key dates
- Aug 2023
The Act becomes law
The Digital Personal Data Protection Act, 2023 receives the President’s assent.
- Nov 2025
The Rules are notified
The DPDP Rules, 2025 are notified on 13 November and published on 14 November. Some enabling provisions start at once.
- Around Nov 2026
Consent managers
The rules for registering consent managers start about 12 months after publication.
- Around May 2027
Main duties apply
Notice, consent, security safeguards, breach reporting, children’s data and data principal rights start about 18 months after publication.
Ten things to have in place
Your ticks stay in this browser only. This is a self-check, not an audit.
DPDP questions
Does the DPDP Act apply to a small business?
Yes. The Act applies to any organisation that handles personal data of people in India, whatever its size. Some duties are heavier for large or high-risk organisations, called Significant Data Fiduciaries.
Does it apply to a company outside India?
It can. The Act covers processing outside India when it relates to offering goods or services to people in India.
What counts as personal data?
Any data about an identifiable person: name, phone number, email, address, account details, location and similar. It covers digital data, and paper records that are later digitised.
When do I have to be ready?
Most duties for businesses start about 18 months after the Rules were published in November 2025, which is around May 2027. Confirm the exact dates with your legal adviser.
What is a data fiduciary?
The organisation that decides why and how personal data is processed. That is usually you, the business. Vendors that process data for you are called data processors.
Can personal data be sent outside India?
Generally yes, except to countries the government restricts. Check the current notifications and your sector rules, which can be stricter.
What does Bedre actually do?
We help with the technical and operational side: data mapping, forms and consent flows, security controls, logging, backups and breach readiness. We are not a law firm, so we do not give legal advice or certify compliance. Your legal adviser confirms what the law requires.
Know where your website stands today
Free, read-only, about five minutes. We are a technology partner, not a law firm.