With May 2027 approaching, businesses have a limited window to prepare for the major DPDP compliance requirements scheduled to take effect then. Our first post in this series called 2026 the “build year.” This article turns that idea into a practical four-phase plan to help businesses identify gaps, strengthen their processes, and prepare for the upcoming requirements.
To make each phase concrete, we will follow a composite example throughout: Ashok runs a 40-person IT services company in Chennai. Nothing about his business is unusual, which is exactly why it is useful. If you run something similar, or something in a completely different industry that still touches customer data, the same four phases apply.
Before you start: this is a recommended pace, not a legal deadline
The DPDP Act and Rules have a phased implementation schedule. Some provisions are already in force, the Consent Manager registration provisions are scheduled to commence in November 2026, and many of the main compliance obligations are scheduled to commence in May 2027.
The four phases below are a recommended preparation plan, not statutory deadlines for completing individual tasks. Businesses should use this plan to prepare for the applicable requirements and confirm which provisions apply to their activities.
Start wherever you are today. If you are reading this partway through 2026 with several months already behind you, move through the earlier phases faster rather than skipping them, the sequence still matters even if the pace has to change.
Phase 1: Find out what data you actually have
You cannot protect data you cannot account for, and most businesses are surprised by how scattered their own data actually is once they look properly.
When Ashok’s team actually mapped their data, here is roughly what they found: An Excel sheet containing client backup credentials. The discovery highlighted a security risk: these credentials needed to be moved to an appropriately secured credential vault, with access restricted to authorised personnel and exposed credentials reviewed and rotated where necessary.
Use a simple table to run this exercise yourself. You can build this directly in a spreadsheet:
| Data type | Where it lives | Who has access | Why we have it |
|---|---|---|---|
| Client contact details | Ticketing system | Support team | Active support relationship |
| Backup client credentials | Old Excel sheet | 2 senior engineers | Historical, should be migrated to vault |
| Employee onboarding forms | Shared Drive folder | HR, 1 manager | Employment records |
| Old CRM export | Downloaded file on a laptop | Nobody, forgotten | No current reason, candidate for deletion |
By the end of this phase, you should have your own version of that table filled in, along with a named owner for compliance, even if it is one person wearing this as one of several hats for now.
Phase 2: Find your gaps
With the map from Phase 1 in hand, compare what you actually do against what DPDP requires. This is where most businesses realise their existing privacy policy and consent flows were written for a world before DPDP existed.
Here is what a real gap looks like in practice, not just in theory. Ashok’s old website notice said this:
“By using this site you agree to our terms and privacy policy.”
That tells a visitor nothing. A more useful starting point looks like this:
“We collect your name, phone number, and relevant service details to provide IT support. We use this information for the purposes explained in our privacy notice. For questions about your personal data or to exercise your rights under applicable law, contact us at privacy@[business].com.”
Run the same before-and-after test on your own notice and consent flows. Two things to check specifically:
- Consent: Where consent is the basis for processing personal data, check whether it is freely given, specific, informed, unconditional and unambiguous, with a clear affirmative action. Avoid pre-checked boxes or bundling marketing consent with an unrelated service signup. Where the Act permits processing under a specified legitimate use or another applicable legal provision, assess the relevant requirements instead of assuming consent is always necessary
- Security safeguards: Review whether your business has appropriate access controls, encryption, and measures to protect personal data from unauthorised access. Depending on your systems and risks, consider multi-factor authentication, secure backups, access monitoring, and incident logging. The DPDP Rules prescribe security safeguards, including measures relating to access control, logging, monitoring, and backups. Businesses should assess the applicable requirements and implement safeguards appropriate to their processing activities
By the end of this phase, you should have a written list of gaps like the notice example above, area by area, with an owner assigned to each one and a rough priority order so the riskiest gaps get fixed first.
Phase 3: Build the infrastructure
This is the heaviest phase, and it is where the actual building happens.
Rewrite your consent notices and flows based on the gaps you found in Phase 2, using the before-and-after test as your guide. Fix withdrawal the same way you fixed the notice.
If Ashok’s old process required emailing support and waiting three days to withdraw consent for marketing emails, he should review that process. Under the DPDP Act, withdrawing consent must be as easy as giving it. A clear unsubscribe link that allows users to withdraw consent easily is one practical way to support this requirement.
Update your privacy policy to match what you are actually doing now, not what it said before Phase 2. If you work with vendors or processors who touch personal data on your behalf, your payment gateway, your email service provider, the cloud host storing your backups, review those contracts and make sure their obligations to you are spelled out, not assumed.
If your business is notified as a Significant Data Fiduciary (SDF) by the Central Government, it will have additional obligations, including appointing a Data Protection Officer based in India and an independent data auditor, and completing prescribed assessments and audits. If you believe your business may fall within this category, review the applicable requirements and seek legal advice rather than relying on company size or data sensitivity alone.
By the end of this phase, you should have updated notices and consent flows live for customers, a working one-click withdrawal mechanism tested by someone who did not build it, a published current privacy policy, and reviewed vendor contracts with gaps flagged for renegotiation.
Phase 4: Test it, train people, and get ready for enforcement
By this phase, the infrastructure should largely exist. This is about making sure it actually works and that the people running your business know how to use it.
Run a breach response dry run using a realistic scenario. Here is roughly how Ashok’s team walked through theirs, starting from a support engineer’s laptop with access to client backup credentials getting stolen from a car:
Hour 0: The theft is discovered and reported internally.
Immediately: Activate the incident-response plan, secure affected systems, assess potential exposure, and reset or revoke compromised credentials where appropriate.
Within 6 hours, where applicable: Report the incident to CERT-In if it falls within the reportable incidents covered by CERT-In’s directions.
DPDP reporting, scheduled for May 2027: When the relevant provisions commence, a Data Fiduciary that becomes aware of a personal data breach must notify affected Data Principals without delay. It must also inform the Data Protection Board without delay and provide the detailed information required by the Rules within 72 hours, unless the Board allows a longer period on a written request.
We walk through this timeline in full detail, including how the CERT-In and DPDP clocks relate to each other, in a dedicated post on breach response.
Beyond the dry run, train the people who actually handle customer data day to day, support teams, sales, marketing, on what changed and why. Then do a final pass checking that your notices, consent flows, and vendor contracts all actually match what you are doing in practice, not just what a policy document says you do.
By the end of this phase, you should have a written breach response plan that has actually been tested, staff trained on what changed, and a final check confirming policy matches practice.
Completing this phase gives your business time to address remaining gaps before the relevant DPDP requirements commence, rather than discovering problems at the last minute.
Frequently Asked Questions
When should a business start preparing for DPDP compliance?
Businesses should start preparing as early as possible. Many of the main DPDP compliance obligations are scheduled to commence in May 2027, while some provisions are already in force and others have earlier commencement dates. Starting early gives businesses time to identify gaps and prepare for the requirements that apply to them.
What is the first step in DPDP compliance?
Data mapping: identifying what personal data your business collects, where it is stored, who has access to it, and why you have it.
Does DPDP set specific deadlines for each stage of compliance?
The DPDP Act and Rules have a phased commencement schedule, but they do not prescribe a universal deadline for completing every step in a business’s internal compliance roadmap. The Consent Manager registration provisions are scheduled to commence in November 2026, while many of the main compliance obligations are scheduled for May 2027. Businesses should prepare in advance and check the commencement dates of the provisions relevant to them.
Do small businesses need a Data Protection Officer?
Under the DPDP Act, a Data Protection Officer is required for a Significant Data Fiduciary (SDF). SDF status depends on notification by the Central Government, not simply on company size. Even if a business is not an SDF, it is good practice to assign someone responsibility for coordinating privacy and data protection activities.
What happens if a business is not ready by May 2027?
Once the relevant provisions commence, businesses that fail to meet applicable DPDP requirements may face penalties under the Act. The maximum penalty for failing to take reasonable security safeguards to prevent personal data breaches is ₹250 crore. This is a statutory maximum, not an automatic fine for every compliance failure. Businesses should identify and address gaps before the relevant requirements take effect.
References
For more information, refer to the official legal documents below:
Digital Personal Data Protection Act, 2023
DPDP Act, 2023 — Commencement Notification, 13 November 2025
Digital Personal Data Protection Rules, 2025
Disclaimer: This article is intended for general informational purposes only and does not constitute legal advice. Businesses should consult qualified legal professionals to understand how the DPDP Act applies to their specific circumstances.
Follow our Twitter and Facebook feeds for new releases, updates, insightful posts and more.
