Is your business ready for India's DPDP law? Check in two minutes.
Tick the ten basics your business already has. You see how prepared you are and what to build next. This is a self-check list for small businesses. Free and private. Nothing you tick is saved or sent.
- Most duties start on 13 May 2027, so there is time to prepare
- Plain-English steps, no legal jargon
- Rules and dates can change, so check the current position
Advocates do not solicit work. You visit this page voluntarily.
Your readiness check
Is your business ready for India's DPDP law? Check in two minutes.
Tick the ten basics your business already has. You see how prepared you are and what to build next. This is a self-check list for small businesses. Free and private. Nothing you tick is saved or sent.
- Most duties start on 13 May 2027, so there is time to prepare
- Plain-English steps, no legal jargon
- Rules and dates can change, so check the current position
Advocates do not solicit work. You visit this page voluntarily.
Your readiness check
Want a lawyer to review your DPDP readiness?
A lawyer can review your notices, consent records and contracts, explain what applies and share the fee before any work starts. No outcome is promised.
Want a lawyer to review your DPDP readiness?
A lawyer can review your notices, consent records and contracts, explain what applies and share the fee before any work starts. No outcome is promised.
Getting your business ready for the DPDP law
India's Digital Personal Data Protection Act, 2023 applies to businesses that handle the digital personal data of people in India. That includes customer lists, orders, enquiries, job applications and website sign-ups. The Rules were notified in November 2025. Most duties start on 13 May 2027, and Consent Manager registration starts on 13 November 2026. Changes have been proposed for some large companies, so please check the current position.
The basics are simple. Tell people what data you collect and why. Ask for consent in plain language and keep a record. Collect only what you need and delete it when the purpose is done. Let people see, correct and erase their data and withdraw consent. Name a contact for complaints.
Security matters most. Keep basic safeguards such as access control, encryption and backups, and be able to show them. If a breach happens, you must tell the Data Protection Board and the affected people without delay, and send details within 72 hours. Have a plan ready.
If you use vendors for cloud, payments or marketing, put data protection terms in your contracts. If children use your service, you need verifiable parental consent, and tracking or targeted ads for children is not allowed, except where an exemption applies.
Penalties are maximums set by the Act and are decided by the Data Protection Board after an inquiry. The highest, up to Rs.250 crore, is for failing to take reasonable security safeguards. Rules and dates can change, so confirm the current position. Need help? See legal documents or talk to a lawyer.
Common questions
Does the DPDP Act apply to small businesses?
It applies to businesses that process digital personal data of people in India, whatever their size, with some exceptions and some extra duties for large ones. Please check how it applies to you.
When must we comply?
Most duties start on 13 May 2027. Consent Manager registration starts on 13 November 2026. Changes have been proposed for some large companies, so please check the current position.
What must we do if there is a data breach?
Tell the Data Protection Board and the affected people without delay, and send detailed particulars within 72 hours. Have a plan before a breach happens.
What are the penalties?
The Act sets maximum penalties: up to Rs.250 crore for failing to take reasonable security safeguards, up to Rs.200 crore for failing to report a breach or for breaching children's data duties, and up to Rs.50 crore for other breaches. The Board decides the amount after an inquiry.
Do we need a Data Protection Officer?
Only significant data fiduciaries must appoint one. Please check whether the rules for significant data fiduciaries apply to you.
Is my information stored?
No. The checklist runs in your browser. What you tick is not saved or sent anywhere.
Getting your business ready for the DPDP law
India's Digital Personal Data Protection Act, 2023 applies to businesses that handle the digital personal data of people in India. That includes customer lists, orders, enquiries, job applications and website sign-ups. The Rules were notified in November 2025. Most duties start on 13 May 2027, and Consent Manager registration starts on 13 November 2026. Changes have been proposed for some large companies, so please check the current position.
The basics are simple. Tell people what data you collect and why. Ask for consent in plain language and keep a record. Collect only what you need and delete it when the purpose is done. Let people see, correct and erase their data and withdraw consent. Name a contact for complaints.
Security matters most. Keep basic safeguards such as access control, encryption and backups, and be able to show them. If a breach happens, you must tell the Data Protection Board and the affected people without delay, and send details within 72 hours. Have a plan ready.
If you use vendors for cloud, payments or marketing, put data protection terms in your contracts. If children use your service, you need verifiable parental consent, and tracking or targeted ads for children is not allowed, except where an exemption applies.
Penalties are maximums set by the Act and are decided by the Data Protection Board after an inquiry. The highest, up to Rs.250 crore, is for failing to take reasonable security safeguards. Rules and dates can change, so confirm the current position. Need help? See legal documents or talk to a lawyer.
Common questions
Does the DPDP Act apply to small businesses?
It applies to businesses that process digital personal data of people in India, whatever their size, with some exceptions and some extra duties for large ones. Please check how it applies to you.
When must we comply?
Most duties start on 13 May 2027. Consent Manager registration starts on 13 November 2026. Changes have been proposed for some large companies, so please check the current position.
What must we do if there is a data breach?
Tell the Data Protection Board and the affected people without delay, and send detailed particulars within 72 hours. Have a plan before a breach happens.
What are the penalties?
The Act sets maximum penalties: up to Rs.250 crore for failing to take reasonable security safeguards, up to Rs.200 crore for failing to report a breach or for breaching children's data duties, and up to Rs.50 crore for other breaches. The Board decides the amount after an inquiry.
Do we need a Data Protection Officer?
Only significant data fiduciaries must appoint one. Please check whether the rules for significant data fiduciaries apply to you.
Is my information stored?
No. The checklist runs in your browser. What you tick is not saved or sent anywhere.
Consult for FREE
Fill the form and claim a free consultation!