25 things a Data Fiduciary has to be able to show by 13 May 2027, in the order they depend on each other. Each one names the section or rule it comes from and the evidence you will want when someone asks. For a scored version, take the readiness assessment.
Last reviewed · Sources: G.S.R. 843(E), G.S.R. 846(E), Lok Sabha Q.3960 (12 Aug 2026)
13 May 2027. That is when notice, consent, Data Principal rights, security safeguards, breach intimation, erasure, children's data and the Significant Data Fiduciary obligations become enforceable, along with Rules 3, 5 to 16, 22 and 23. Consent Manager registration opens earlier, on 13 November 2026.
Nothing below can be done without this. The Act does not call it a record of processing, but sections 11 and 8(7) assume you have one.
Inventory the digital personal data you hold, where it sits and which Data Processors receive it.
Evidence: A maintained data map
Confirm the Act applies: digital personal data, processed in India or for offering goods or services to people in India.
Evidence: Applicability note
Assign each processing purpose a ground: consent, or one of the legitimate uses in section 7.
Evidence: Purpose register
Where consent is the ground, you carry the burden of proving both the notice and the consent.
Write a standalone notice with an itemised list of data, the specified purpose and the goods or services it enables.
Evidence: Versioned notice
Offer the notice and the consent request in English or any Eighth Schedule language.
Evidence: Translations per version
Collect consent by a clear affirmative action, per purpose, limited to the data necessary.
Evidence: Consent record per purpose
Make withdrawal as easy as giving consent, and stop your Data Processors processing within a reasonable time.
Evidence: Withdrawal log, processor notices
Keep proof of which notice each person saw and what they agreed to, and when.
Evidence: Exportable consent artefacts
Send a notice to everyone whose consent predates the Act.
Evidence: Dispatch record
Gate non-essential cookies and trackers behind consent.
Evidence: Cookie scan and consent log
The two highest penalties in the Schedule sit here: up to ₹250 crore and ₹200 crore.
Put in place encryption or masking, access control, logging and monitoring, and backups.
Evidence: Security controls register
Keep logs and the related personal data for at least one year.
Evidence: Retention configuration
Write security obligations into every Data Processor contract.
Evidence: Contract clauses
Run a breach procedure that tells affected Data Principals and the Board without delay, and files a detailed report within 72 hours.
Evidence: Incident record and timestamps
Erase once the purpose is served or consent is withdrawn, unless another law requires you to keep it.
Set a retention period for each purpose, and erase at its end, including at your Data Processors.
Evidence: Retention schedule, erasure log
If you are a large e-commerce, gaming or social media platform, apply the Third Schedule periods and give 48 hours' notice before erasure.
Evidence: Erasure notices
Use the Act's vocabulary: Data Principal rights, not data subject requests.
Publish how to request access, correction, completion, updating or erasure, and nominate someone.
Evidence: Published request channel
Publish a grievance response period of no more than 90 days, and meet it.
Evidence: Request log with timings
Publish the business contact of your DPO, or a person who can answer questions about processing.
Evidence: Contact on site and in replies
Under the Act, a child is anyone under eighteen.
Get verifiable parental consent before processing a child's data, checking the parent is an identifiable adult.
Evidence: Verification record
Stop tracking, behavioural monitoring and targeted advertising directed at children, unless a Fourth Schedule exemption applies.
Evidence: Ad and tracking configuration
Verify the appointment of a lawful guardian acting for a person with disability.
Evidence: Verification record
Notification is by the Central Government under section 10(1). There is no numeric threshold in the Act.
Appoint a Data Protection Officer based in India, reporting to the board.
Evidence: Appointment record
Appoint an independent data auditor.
Evidence: Engagement letter
Carry out a DPIA and an audit every twelve months, and check your algorithmic software for risk to Data Principals' rights.
Evidence: DPIA and audit reports
One date comes sooner. Consent Manager registration opens on 13 November 2026. It changes nothing on this list unless you plan to accept consents routed through a registered Consent Manager; the Consent Manager guide explains why.
13 May 2027. That is when notice, consent, Data Principal rights, security safeguards, breach intimation, erasure, children's data and the Significant Data Fiduciary obligations become enforceable, along with Rules 3, 5 to 16, 22 and 23. Consent Manager registration opens earlier, on 13 November 2026.
Only for Significant Data Fiduciaries. Section 10(2)(b) requires them to appoint an independent data auditor, and Rule 13 requires an audit and a DPIA once every twelve months. Other Data Fiduciaries are not required to audit, but they carry the burden of proving consent under section 6(10).
This guide summarises the DPDP Act, 2023 and the DPDP Rules, 2025; the Gazette texts govern. This is informational and is not legal advice. Liability under the DPDP Act, 2023 remains with the Data Fiduciary.
