When clients ask me about the Digital Personal Data Protection (DPDP) Act, the first question is rarely “What does it say?” It is usually “Are we compliant, and how would we even know?”
It is a fair question. Most organisations hold personal data in more places than they realise: HRMS exports, candidate documents in inboxes, vendor portals, shared drives, old backups. Compliance is not a single policy you sign. It is a set of working habits that you can show to a regulator, a client or an auditor.
At Quinfy we handle sensitive identity, education, employment and address data for hundreds of clients, so we think about this every day. This article gives you three things: the official timeline, a quick way to test where you stand, and a roadmap for getting ready. A downloadable toolkit with the full checklist sits at the end.
The timeline: what is already in force and what is coming
The Digital Personal Data Protection Rules, 2025 were notified by the Ministry of Electronics and Information Technology (MeitY) on 13 November 2025. They switch the Act on in three stages.
| Date | What applies | What it means for you |
|---|---|---|
| 13 November 2025 (already in force) | Rules 1, 2 and 17 to 21: definitions and the Data Protection Board of India | The enforcement body exists and can receive complaints. No heavy day-to-day duties yet for most businesses. |
| 13 November 2026 (about two weeks away) | Rule 4: registration and obligations of Consent Managers | Mainly affects organisations planning to act as Consent Managers, and those who plan to use them. Treat it as your first milestone. |
| 13 May 2027 (full compliance) | Rules 3 and 5 to 16, plus 22 and 23: notice, consent, security safeguards, breach reporting, retention and erasure, children’s data, data principal rights, Significant Data Fiduciary duties and cross-border rules | This is the date by which your processes must be working. |
Two cautions from our reading of current commentary:
- The May 2027 date could move earlier. Some legal commentators note that media reports have anticipated a shorter timeline. Plan as if your real deadline is earlier than 13 May 2027, and confirm the latest position with your counsel or on the MeitY website.
- Eighteen months is shorter than it sounds. Rebuilding consent flows, renegotiating vendor contracts and putting security controls in place typically takes most of the available window. If you start in November, you have roughly six and a half months.
The penalty that gets boardroom attention
The Act allows penalties of up to ₹250 crore for failing to maintain reasonable security safeguards, with other breaches carrying their own penalties. Whatever the number turns out to be in practice, the commercial risk is just as real: enterprise clients are already asking vendors for DPDP assurances in their security questionnaires and contracts.
A five-minute self-check
Answer these ten questions honestly. They are drawn from the full 30-point checklist in the toolkit.
- Do we know where personal data lives? Can we produce a map of systems, vendors and files that hold personal data, including candidate and employee data?
- Does one named person own DPDP? Is there an accountable lead with senior backing?
- Is our notice clear? Do people get a plain-language notice, before we collect data, that says what we collect, why, how to exercise rights and how to complain?
- Can we prove consent? Do we hold a timestamped record of who agreed to what purpose?
- Can people withdraw consent as easily as they gave it?
- Can we answer a rights request? If someone asks what we hold about them, or asks us to correct or erase it, can we respond within a defined time?
- Are security safeguards in place and evidenced? Think encryption, access control, monitoring and logs kept for at least a year.
- Could we handle a breach? Do we have a tested plan to inform the Data Protection Board and affected individuals, including a detailed report within 72 hours?
- Do our vendor contracts bind our processors? Do they cover instructions, security, breach alerts and deletion?
- Do we delete data when the purpose ends? Is there a retention schedule that is actually followed?
How to read your answers. Eight or more “yes” answers means you are in reasonable shape and should now evidence it. Four to seven means there are gaps to close in the next two quarters. Three or fewer means you should start this month. The full toolkit uses a 60-point score so you can track progress over time.
A six-step roadmap to readiness
Work backwards from the deadline. Here is the sequence we recommend.
Step 1: Mobilise and discover (November 2026). Appoint an owner, brief the leadership, and build your data inventory. Decide whether you could be classed as a Significant Data Fiduciary, which brings extra duties such as a Data Protection Officer based in India, an annual impact assessment and an independent audit.
Step 2: Fix the foundations (December 2026 to January 2027). Redraft your privacy notice, redesign consent capture, and write your retention schedule and rights-handling procedure.
Step 3: Secure systems and vendors (January to March 2027). Implement the technical safeguards, switch on logging, and update contracts with every processor that touches personal data. Map any cross-border transfers.
Step 4: Prepare people and incident response (March to April 2027). Train the teams that handle data, set up your grievance channel, notify existing data principals where required, and run a breach drill.
Step 5: Verify and go live (April to 13 May 2027). Re-run the self-assessment, assemble the evidence file, and have leadership sign off.
Step 6: Sustain. Review annually, and whenever MeitY issues new guidance.
A note for HR and hiring teams
Hiring is where many organisations first meet the DPDP Act. A single background check can involve identity numbers, addresses, education records and employment history. Four habits help most:
- Capture candidate consent digitally, linked to each check, instead of relying on a scanned form.
- Match the check package to the role, so you only collect what the role needs.
- Set a retention period for verification reports and make sure vendors honour it.
- Treat the employment-related “legitimate use” provision with care. It is not a licence to collect everything, so take legal advice on how it applies to you.
Download the toolkit
To make this practical, we have put the full process into a free, Quinfy-branded document: the official timeline, the 30-point self-assessment with a scoring guide, a six-phase roadmap, a responsibilities matrix (RACI), an evidence register and a hiring-specific checklist. Use it to run your own review, share it with your leadership team, or hand it to your auditors.
If you would like a second pair of eyes on your hiring and verification workflows, our team is happy to walk through them with you.
This article and the toolkit are general guidance and not legal advice. Dates and rule references reflect public sources at the time of writing and may change. Please confirm the current position with qualified legal counsel and the official MeitY notifications before relying on them.
About the author: Suvarna Singh is the Chief Client Officer and Co-Founder of Quinfy, an AI-native background verification company serving clients across more than 45 countries.
Sources: Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), 13 November 2025); commentary and timeline summaries from LKS (lkslaw.com), Legismith (legismith.com), LLM Advocates (dpdp.llmadvocates.com) and Sumrite (sumrite.com).
