India’s DPDPA enforcement clock is running.
The Ministry of Electronics and Information Technology notified the DPDP Rules 2025 in November 2025, formally activating the compliance timeline for the Digital Personal Data Protection Act, 2023.
The deadline: May 13, 2027.
Every Data Fiduciary processing personal data of individuals in India, regardless of where the organisation is headquartered, must be fully compliant by that date.
Most organisations are aware of this. Fewer understand what “fully compliant” actually means in practice.
DPDPA compliance is not a status you achieve once and hold. It is an ongoing operational state that must be demonstrated, documented, and evidenced continuously. The Data Protection Board of India can investigate at any point after the deadline, not just on it, and can impose penalties for the current state of your data protection posture, not just historical failures.
A gap discovered in March 2028 is a penalty event in March 2028, regardless of when your last compliance review was completed.
That distinction separates organisations building a compliance programme from those completing a compliance project.
What Is DPDPA and Who Does It Apply To?
The Digital Personal Data Protection Act, 2023 (DPDPA) is India’s first comprehensive statutory framework for protecting digital personal data.
It establishes:
- The rights of Data Principals (individuals whose personal data is processed)
- The obligations of Data Fiduciaries (entities that decide the purpose and means of processing)
- The Data Protection Board of India as the enforcement authority
The territorial scope is wide. Any organisation that processes the digital personal data of individuals in India, or offers goods or services to people in India, is subject to DPDPA obligations. This applies regardless of where the organisation is incorporated or where its infrastructure is located. The reach is similar to that of the EU’s GDPR.
Within the Data Fiduciary category, the Central Government can designate specific entities as Significant Data Fiduciaries (SDFs) based on the volume and sensitivity of data they process. SDFs carry additional obligations: a Data Protection Officer, periodic Data Protection Impact Assessments, and mandatory independent audits every 12 months under Rule 13 of the DPDP Rules 2025.
According to Secure Privacy, 68% of companies with operations in India admit to an incomplete understanding of their DPDPA obligations, even with the rules now active. That gap is where enforcement risk lives.
The Penalty Structure: Why This Matters
DPDPA establishes a tiered penalty framework. The Data Protection Board determines actual penalties based on the nature of the breach, the number of individuals affected, and the organisation’s compliance history.
Maximum penalties per violation:
| Violation | Maximum Penalty |
| Failure to implement reasonable security safeguards (Section 8(5)) | Up to ₹250 crore |
| Failure to notify the Board or affected individuals of a breach (Section 8(6)) | Up to ₹200 crore |
| Non-compliance with children’s data provisions (Section 9) | Up to ₹200 crore |
| Failure to fulfil Significant Data Fiduciary obligations (Section 10) | Up to ₹150 crore |
Beyond financial penalties, Section 37 gives the Central Government authority to block public access to an organisation’s services in India if the Data Protection Board has imposed penalties on two or more prior occasions.
For a digital business with Indian customers, that is an existential enforcement action, not a financial one.
The Data Protection Board is formally established. The compliance window is running. Treating this as a documentation exercise is how organisations build exposure into their future.
Why DPDPA Cannot Be Treated as a One-Time Audit
The instinct to run a compliance project, complete it by April 2027, and move on is understandable. It maps cleanly to audit cycles, governance reporting, and board-level conversations.
But DPDPA operates continuously, and so do the obligations it creates.
Here is why a point-in-time approach fails structurally.
Data environments change constantly. A new SaaS tool adopted by the product team. A cloud migration. A new payment processor. A workforce expansion. Each of these changes what personal data is being processed, for what purposes, and which third parties touch it. An inventory mapped in January 2027 may be materially inaccurate by June 2027, without any deliberate change to the compliance posture.
Consent states change in real time. Data Principals have the right to withdraw consent at any time, and withdrawal must be as easy as giving it. A consent record captured during an annual audit does not reflect consent on any given Tuesday six months later. Organisations must track and honour consent states as they change, not as they were at the last review.
Third parties introduce ongoing risk. Data Fiduciaries are accountable for ensuring their Data Processors take reasonable security safeguards. A vendor assessed as compliant during onboarding may have changed their security posture since then. Verizon’s 2025 analysis of over 12,000 confirmed breaches found that third-party breaches doubled from 15% to 30% of all incidents in a single year. Third-party risk is a continuous monitoring obligation, not a static assessment.
Breaches don’t give you advance notice. Under Rule 7 of the DPDP Rules 2025, organisations must notify the Data Protection Board without delay upon becoming aware of a breach, and submit a detailed follow-up report within 72 hours. That report must cover the nature and extent of the breach, likely impact, mitigation measures taken, and a summary of notices sent to affected individuals. A 72-hour clock requires detection, containment, and documentation capabilities to be operational at all times, not assembled in the weeks before an annual review.
These aren’t edge cases. They are structural reasons why compliance requires operational infrastructure, not documentation infrastructure.
The Practical Requirements DPDPA Places on Data Fiduciaries
- Data Discovery and Classification
You cannot map consent to data you don’t know you hold. You cannot honour erasure requests for data you haven’t classified. You cannot notify the Board of a breach without knowing what categories of personal data were involved.
Effective DPDPA compliance starts with a complete, current inventory of personal data: where it lives, in what systems, under what retention policies, for what stated purposes, and which internal teams and third parties process it.
For most organisations, this requires active discovery across structured databases, unstructured file stores, SaaS applications, and cloud environments, followed by classification by data type and sensitivity.
And it’s not a one-time exercise. As environments change, the inventory must update.
- Consent and Privacy Notice Management
DPDPA requires free, specific, informed, and unambiguous consent before processing personal data for any purpose not covered by a legitimate use basis. The consent request must state specific purposes clearly and provide an equally accessible mechanism for withdrawal.
The operational complexity is significant.
Organisations typically manage consent across multiple products, channels, geographies, and user types. Each consent record must be timestamped, purpose-linked, and retrievable on demand. When a Data Principal withdraws consent, processing must stop across all relevant systems and processors for that purpose.
Legacy data collected before the Act’s enforcement is also in scope. Organisations must provide retroactive notification and consent opportunity for pre-existing data where processing is based on consent.
Managing consent at scale, across multiple systems, without a purpose-built consent management capability, is one of the most operationally demanding DPDPA requirements. It is also one of the most frequently underestimated.
- Processing Visibility and Purpose Limitation
DPDPA mandates that personal data is processed only for the specific purposes for which consent was obtained or a legitimate use basis exists. Data minimisation applies: collection must be limited to what is necessary.
To demonstrate purpose limitation compliance, organisations need visibility into how data flows through internal systems and third-party integrations. Which teams and applications are accessing what data? For what functions? When does access extend beyond the stated purpose?
This is not achievable through policy alone. It requires technical controls, access logging, and ongoing monitoring of data flows against stated purposes.
Risk Assessments and Third-Party Accountability
- Data Protection Impact Assessments (DPIAs)
For Significant Data Fiduciaries, DPIAs are mandatory under Rule 13 of the DPDP Rules 2025. For all Data Fiduciaries, they represent sound risk practice before deploying new processing activities that carry heightened privacy risk: biometric systems, large-scale profiling, children’s data, or high-volume automated decision-making.
A DPIA is a structured analysis of processing purposes, data types, necessity and proportionality, risks to Data Principals, and mitigating controls. It must be documented, evidenced, and where required, reported to the Data Protection Board.
- Third-Party Risk Under DPDPA
Every Data Fiduciary that engages a Data Processor remains responsible for ensuring that processor takes reasonable security safeguards. This accountability cannot be delegated through contract language alone. It requires active oversight.
In Venminder’s 2025 survey, 49% of organisations reported experiencing a third-party cyber incident in the past year. Supply chain-related breaches rose from 4% of incidents in 2020 to 30% of all confirmed breaches in 2025, according to Verizon’s analysis.
For organisations that built their compliance posture on initial vendor assessments rather than continuous monitoring, each of these incidents is a potential DPDPA exposure.
Effective third-party risk management under DPDPA requires:
- Contracts obligating processors to take defined security safeguards and report breaches promptly
- Vendor security assessments at defined intervals, not just onboarding
- Monitoring for changes in a processor’s security posture or subprocessor arrangements
- Documented evidence of processor accountability for every engagement
- Audit Trails and Evidence Collection
The Data Protection Board has authority to request evidence of compliance. Policy documents alone are not evidence. They demonstrate intent. They do not demonstrate that the controls those policies describe are actually operating.
Audit-ready compliance requires:
- Timestamped consent records showing when consent was given, for what purpose, and when it was withdrawn
- Records of data subject rights requests and responses
- Documentation of data flows and the legal basis for each
- Breach detection logs, incident timelines, and notification records
- Evidence that security controls are active, including access control configurations, encryption status, and monitoring alerts
This evidence must be current. Evidence that is six months old does not demonstrate the current compliance state.
Policies vs. Demonstrable Compliance: The Critical Difference
Many organisations approaching DPDPA have the policies.
A privacy notice on their website. A data retention policy in the employee handbook. A data processing agreement template in the legal library.
What they often don’t have is evidence that those policies are being followed, in real time, across every system, team, and vendor relationship that touches personal data.
The Data Protection Board will assess compliance with the Act. Not compliance with an organisation’s internal policies.
If a privacy notice states that data is retained only for the specified purpose, but actual retention schedules in the database don’t align with that statement, the policy is evidence of intent, not compliance.
According to Hyperproof’s 2026 compliance benchmarking, 76% of GRC professionals still spend 30% or more of their working hours on repetitive, manual administrative tasks related to compliance. That means most compliance teams are occupied assembling last quarter’s evidence while this quarter’s controls drift, vendor relationships change, and consent states update without anyone monitoring them.
The organisations that demonstrate ongoing compliance are not the ones with the best policy documents. They are the ones with systems that show their controls are working right now, with evidence that doesn’t require a team to manually compile before they can answer a regulator’s question.
How Scrut Automation Operationalises DPDPA Compliance
- Scrut Automation is a continuous compliance and GRC platform built to close the gap between documented compliance and evidenced compliance.
For organisations navigating DPDPA, Scrut enables the shift from annual audit preparation to real-time compliance visibility.
- Data asset visibility and risk mapping. Scrut’s asset management and risk assessment modules maintain a continuously updated inventory of data assets, mapped to the processing purposes and business systems they support. When new tools are added or integrations change, the compliance picture updates automatically.
- Continuous control monitoring. Rather than checking once a year whether controls are in place, Scrut monitors control effectiveness continuously and flags deviations in real time. Security safeguards, access controls, and data processing configurations can be verified as active and effective at any point, not only during audit cycles.
- Automated evidence collection. Scrut replaces manual evidence gathering with automated collection from the systems that generate compliance evidence: cloud infrastructure, endpoint management platforms, SaaS applications, and security tools. Evidence is timestamped, versioned, and organised against specific control requirements. Audit readiness becomes a permanent state, not a six-week project.
- Third-party risk management. Scrut’s vendor risk management module enables organisations to assess, monitor, and document processor compliance on an ongoing basis. Questionnaires, assessment schedules, and risk scores for each vendor relationship are maintained within the platform, creating the documented accountability chain DPDPA requires.
- Risk assessments and DPIAs. The platform provides structured workflows for conducting and documenting risk assessments, including DPIAs for new processing activities. Assessment outputs are stored with version history, providing an audit trail that shows not just current risk posture but how assessments have evolved over time.
- Breach readiness and incident tracking. Scrut supports incident management workflows aligned with Rule 7 breach notification requirements. When an incident is identified, the platform helps teams document the discovery, scope the affected data, track notification timelines, and maintain the evidence trail the Data Protection Board requires within 72 hours.
- Multi-framework coverage. For organisations operating across multiple regulatory frameworks, including DPDPA alongside ISO 27001, SOC 2, SEBI CSCRF, or RBI guidelines, Scrut’s control mapping reduces duplication. A single control can be mapped to multiple framework requirements, significantly reducing the evidence collection burden.
For organisations across India and the APAC region, Scrut Automation is available through EGUARDIAN, which provides localised deployment support, regional compliance context, and ongoing partner engagement.
Your DPDPA Readiness Assessment: Where to Start
The most valuable first step for organisations working toward the May 2027 deadline is an honest assessment of where you actually stand against what DPDPA operationally demands.
EGUARDIAN offers a structured DPDPA readiness assessment, delivered in partnership with Scrut Automation, that evaluates your organisation across six dimensions:
Data Discovery and Inventory
- Have you mapped all categories of personal data your organisation processes?
- Do you have a documented record of data flows, including all third-party processors?
- Is your data inventory maintained as your technology environment changes?
Consent and Privacy Notice Management
- Are your consent mechanisms compliant with DPDPA’s requirements for specificity and granularity?
- Can you retrieve a complete, timestamped consent record for any Data Principal on demand?
- Do you have a documented process for honouring consent withdrawal across all relevant systems?
Processing Visibility and Purpose Limitation
- Can you demonstrate that personal data is processed only for the purposes stated in your consent notice?
- Are your data retention schedules aligned with your stated processing purposes?
Risk Assessments and Third-Party Risk
- Have you conducted a DPIA for high-risk processing activities?
- Do you have a documented third-party risk management programme covering all Data Processors?
- Are your processor contracts updated with DPDPA-mandated security and breach notification obligations?
Audit Trails and Evidence Collection
- Is your compliance evidence collected continuously, or assembled before audits?
- Can you produce a complete incident response record within the 72-hour breach notification window?
Security Controls and Breach Readiness
- Do you have technical controls in place for encryption, access management, and anomalous access detection?
- Has your breach notification process been documented, tested, and assigned to named owners?
If any of these questions expose gaps without a clear path to closing them, the readiness assessment will identify priorities and map a practical remediation programme.
📧 hello@eguardian.com | 🌐 www.eguardian.com
Frequently Asked Questions About DPDPA Compliance
1.What is the DPDPA and when does it take effect?
The Digital Personal Data Protection Act, 2023 is India’s first comprehensive data protection law. The DPDP Rules 2025 were notified by MeitY on November 13, 2025, formally activating the enforcement timeline. Full compliance is required by May 13, 2027.
2. Who is a Data Fiduciary under DPDPA?
A Data Fiduciary is any entity that determines the purpose and means of processing personal data. Any organisation that processes digital personal data of individuals in India, or offers goods or services to people in India, is a Data Fiduciary subject to DPDPA obligations, regardless of where the organisation is based.
3. What are the penalties for DPDPA non-compliance?
Penalties are tiered by violation type. Failure to implement reasonable security safeguards carries a maximum penalty of ₹250 crore per violation. Failure to notify the Data Protection Board or affected individuals of a breach carries a maximum of ₹200 crore. Repeat violators may also face the blocking of their services to users in India under Section 37.
4. What is the breach notification timeline under DPDPA?
Under Rule 7 of the DPDP Rules 2025, a Data Fiduciary must notify the Data Protection Board without delay upon becoming aware of a personal data breach. A detailed follow-up report, covering facts, circumstances, mitigation measures, and a summary of individual notifications, must be submitted within 72 hours. There is no minimum-harm threshold. All personal data breaches are reportable.
5. What is a Significant Data Fiduciary and what additional obligations apply?
Significant Data Fiduciaries are designated by the Central Government based on the volume and sensitivity of personal data they process. They must appoint a Data Protection Officer, conduct periodic Data Protection Impact Assessments, and undergo an independent audit every 12 months under Rule 13 of the DPDP Rules 2025. SDF threshold criteria are expected to be formally specified in 2026.
6. How is DPDPA different from GDPR?
Both frameworks share core principles around consent, purpose limitation, data minimisation, and breach notification. GDPR applies to processing involving EU residents; DPDPA applies to processing involving Indian residents. The legal basis structures and enforcement authorities differ. For organisations operating across both jurisdictions, many technical controls overlap. A GRC platform like Scrut Automation supports cross-framework compliance mapping, reducing duplicated effort.
7. Is a GRC automation platform necessary for DPDPA compliance?
Not technically required, but practically essential for most organisations at scale. Manual compliance management through spreadsheets and periodic evidence collection cannot maintain the continuous evidence trail, real-time control monitoring, and third-party accountability documentation DPDPA demands on an ongoing basis. According to Hyperproof research, 76% of GRC professionals spend 30% or more of their time on manual, repetitive compliance tasks. Automation shifts that capacity from administrative maintenance to active risk management.
EGUARDIAN is a value-added distributor and technology enabler operating across APAC and MEA, representing leading cybersecurity and GRC vendors across India, GCC, Southeast Asia, and South Africa.
Enquiries: hello@eguardian.com | www.eguardian.com
