Get your business DPDP-ready before May 2027, in plain language
India's Digital Personal Data Protection Rules bring the main duties of the DPDP Act into force eighteen months after they were published in November 2025: notices, consent, security safeguards, breach reporting, retention and a contact for privacy questions. There is no size threshold. We map where your business collects personal data and write the notice, consent wording, breach plan and records you need, checked by a person and ready to put on your website and forms.
Updated
- A data map of every form, app, WhatsApp flow, spreadsheet and vendor that touches customer or staff data, with the purpose and who has access.
- A notice and consent wording that follow Rule 3: itemised data, specific purposes, and how people withdraw consent, use their rights and complain to the Board.
- A one-page breach plan for the 72-hour report to the Board, a security checklist from Rule 6, and a rights-request process that answers within 90 days.
Rules 3, 5 to 16, 22 and 23, covering notices, security, breaches, retention, contact details, children's data and rights, come into force eighteen months after the Rules' publication in November 2025.
Source: meity.gov.inThe highest penalty, up to ₹250 crore, applies to failing to maintain reasonable security safeguards; up to ₹200 crore for not notifying a breach or for children's data violations; up to ₹50 crore for other violations.
Source: static.pib.gov.inAfter a personal data breach, each affected person must be told without delay, and the Board must get a detailed report within 72 hours of the business becoming aware of it.
Source: meity.gov.inA national privacy law with no small-business threshold
The DPDP Act applies to digital personal data processed in India, including data collected on paper and digitised later, and to processing outside India for offering goods or services to people in India. It has no turnover or headcount threshold: a clinic's appointment sheet, a coaching centre's WhatsApp group and an online shop's checkout are all in scope. The Rules, dated 13 November 2025, bring Rules 3 and 5 to 16 into force eighteen months after publication, which most advisers put at 13 May 2027.
Those Rules are specific. A consent notice must stand on its own, itemise the personal data and the purposes, and say how to withdraw consent as easily as it was given. Security safeguards must include measures such as encryption or masking, access control, logs kept for a year and backups. A breach must be reported to each affected person without delay and to the Data Protection Board with details within 72 hours. Every business must publish a contact for privacy questions.
Penalties under the Act run up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore for failing to report a breach or breaching the duties on children's data. Large firms have counsel and consultants; most small businesses have a website template and a folder of forms. DPDP Ready gives them the documents in plain language at a fixed price.
Without it
- Free templates: Free toolkits such as TCSA's DPDP compliance template (a checklist, data-mapping template, sample notices and a breach…
- Consent apps for online stores: Shopify apps such as DPDPA-Desk, listed from $3.99 a month when we checked on 3 November 2026, and others with free…
- A law firm: The right choice for Significant Data Fiduciaries, cross-border transfers, sensitive health or financial processing at…
With DPDP Ready
- A data map of every form, app, WhatsApp flow, spreadsheet and vendor that touches customer or staff data, with the purpose and who has access.
- A notice and consent wording that follow Rule 3: itemised data, specific purposes, and how people withdraw consent, use their rights and complain to the Board.
- A one-page breach plan for the 72-hour report to the Board, a security checklist from Rule 6, and a rights-request process that answers within 90 days.
- Data map
- Rule 3 notice
How it works
- 1
Data check for ₹499
Send your website address. Within 2 business days we list the forms, sign-ups, checkouts, trackers and chat widgets we can see collecting personal data, and what the Rules expect at each one.
- 2
A 30-minute questionnaire
Offline and internal data: registers, spreadsheets, WhatsApp, payroll, CCTV, the software and vendors you use, and whether you handle children's data.
- 3
We write your documents
Data map, notice, consent wording, contact page text, breach plan, security checklist and rights-request process, written for your business and checked by a person.
- 4
You publish and file them
Within 7 business days you get editable files and the exact places to put them, with one round of changes included.
Features
Data map
Every place you collect or keep personal data, what is collected, why, where it is stored, who can access it and which vendor processes it.
Rule 3 notice
A stand-alone notice in clear language with an itemised list of data, the specific purposes, and how to withdraw consent, exercise rights and complain to the Board.
Consent wording and records
Short consent lines for each form, checkout and sign-up, a matching withdrawal route, and a simple way to keep a record of what each person agreed to.
Breach plan
Who does what in the first hours, the message to affected people with the five items Rule 7 lists, and the details the Board needs within 72 hours.
Security checklist
Rule 6 in practical terms for your setup: encryption or masking, access control, logs kept for a year, backups and the security clause for vendor contracts.
Rights requests and contact
The privacy contact text Rule 9 requires on your website, and a process and reply templates for access, correction and erasure requests within 90 days.
Children's data flag
For schools, tutors, clinics and apps used by under-18s: where verifiable parental consent is needed, where tracking and targeted ads are off-limits, and where the Fourth Schedule's narrow health and education exemptions may apply.
Vendor list
Each data processor you use, such as your payment gateway, CRM or hosting, with a note on the contract terms the Act and Rules expect.
A look inside
What you get: the working view and the delivery report.
Illustration of the layout, built from this page's own feature list. It shows no real results.
Who it's for
Clinics, labs and wellness practices
Patient registers, appointment apps and reports on WhatsApp, often with no one who owns data protection.
Schools, coaching centres and tutors
Children's data, where parental consent and the ban on tracking and targeted advertising to children apply, with narrow exemptions for educational institutions.
Online shops and D2C brands
Checkouts, marketing sign-ups, abandoned-cart messages and analytics on Shopify, WooCommerce or a custom site.
Startups and agencies
SaaS products and client work that handle personal data and need clear documents before investors or enterprise customers ask.
Works with
- Shopify, WooCommerce and WordPress sites
- Wix, Squarespace and website builders
- Google Forms and website contact forms
- WhatsApp Business
- Payment gateways and checkout pages
- CRMs, email marketing and SMS tools
- Word and Google Docs editable files
Pricing
The data check costs ₹499 and is credited in full against Starter or Business if you order within 30 days. Starter and Business are one-time prices in Indian rupees, paid once, with one round of changes included. We prepare documents and checklists; putting them on your site and running the processes stays with you. We are not a law firm and this is not legal advice, and Significant Data Fiduciaries and complex cross-border processing need a lawyer. Founding customer pricing applies to early-access orders.
Orders are subject to the DPDP Ready terms.
Data check
₹499 one-time
What your website collects today
- One website
- Forms, checkouts and trackers listed
- What the Rules expect at each one
- Reply within 2 business days
- The ₹499 is credited in full against Starter or Business if you order within 30 days
Starter
₹2,999 one-time
One website or app, up to 5 collection points
- Data map
- Rule 3 notice
- Consent wording for up to 5 forms or flows
- Privacy contact text for your website
- Rights-request reply templates
- One round of changes
Business
₹7,999 one-time
Website, offline records and vendors
- Up to 20 collection points, online and offline
- Everything in Starter
- Breach plan with 72-hour Board report
- Rule 6 security checklist
- Vendor list with contract notes
- Children's data review
- 30-minute call to walk through
Compared with the alternatives
- Free templates
- Free toolkits such as TCSA's DPDP compliance template (a checklist, data-mapping template, sample notices and a breach plan) are a good start if you have time to adapt them to your own data, forms and vendors.
- Consent apps for online stores
- Shopify apps such as DPDPA-Desk, listed from $3.99 a month when we checked on 3 November 2026, and others with free plans add consent banners, notice generators and, on higher plans, rights and breach tools to a store. They cover the store, not offline records or staff data.
- A law firm
- The right choice for Significant Data Fiduciaries, cross-border transfers, sensitive health or financial processing at scale, or a dispute. Our documents can be the starting point for their review.
What changed
- Rules 3, 5 to 16, 22 and 23, covering notices, security, breaches, retention, contact details, children's data and rights, come into force eighteen months after the Rules' publication in November 2025. Source: meity.gov.in
- The highest penalty, up to ₹250 crore, applies to failing to maintain reasonable security safeguards; up to ₹200 crore for not notifying a breach or for children's data violations; up to ₹50 crore for other violations. Source: static.pib.gov.in
- After a personal data breach, each affected person must be told without delay, and the Board must get a detailed report within 72 hours of the business becoming aware of it. Source: meity.gov.in
- Data Fiduciaries must respond to requests to access, correct, update or erase personal data within a maximum of ninety days. Source: static.pib.gov.in
From website address to published notice
The data check comes back within 2 business days; your documents within 7 business days of the questionnaire.
- Day 1: Send your website address for the data check.
- Day 2–3: We send the check; you choose a plan and fill in the questionnaire.
- Day 4–10: We write your documents and a person checks them.
- Day 11: You get editable files and where to put each one; one round of changes follows.
Security and data
- We only look at your public website for the data check; nothing is installed and no login is needed.
- We never ask for customer or patient records: the data map lists types of data, not people.
- Questionnaire answers and documents are stored encrypted and deleted 60 days after delivery, or earlier on request.
- Your documents are shared only with you and anyone you name.
Guides and answers
DPDP Rules compliance deadline: what applies when
The DPDP Rules apply in phases: on publication, after one year and after eighteen months. The dates, what each phase covers, penalties and what to do first.
Read the guide →DPDP privacy notice requirements: the Rule 3 checklist
What a DPDP consent notice must contain under Rule 3: itemised data, specific purposes, withdrawal, rights and the Board complaint route, plus Rule 9 contact.
Read the guide →Questions
When do the DPDP Rules apply?
Rules 1, 2 and 17 to 21 applied on publication in November 2025. Rule 4 on Consent Managers applies one year after publication, from November 2026, and Rules 3, 5 to 16, 22 and 23, the main business duties, eighteen months after publication. Most advisers use 13 May 2027.
Does the DPDP Act apply to a small business?
Yes, if it processes digital personal data in India. The Act has no turnover or employee threshold. Data kept only for personal or domestic purposes is outside it.
Could the deadline come forward?
In January 2026, press reports said MeitY had asked industry for views on cutting the eighteen-month period to twelve; some reports said only for Significant Data Fiduciaries. When we checked on 3 November 2026 we found no notified amendment, and the Gazette text still says eighteen months. We will update this page if that changes.
Do we need a Data Protection Officer?
A Data Protection Officer is required for Significant Data Fiduciaries. Every Data Fiduciary must publish the business contact of a person who can answer questions about its processing of personal data.
Does it cover paper records?
The Act covers personal data collected in digital form, and data collected on paper that is digitised later. A register that is scanned or typed into a spreadsheet is in scope.
Do we need a Consent Manager?
No. Consent Managers are registered platforms people can use to manage consent; a business can collect consent directly, as long as its notice and consent meet the Rules.
Is this legal advice?
No. DPDP Ready is an independent document service that applies the published Act and Rules. For complex processing or a dispute, use a lawyer.
Be ready before the main DPDP duties start
Start with a ₹499 check of what your website collects, credited against your plan. Notice, consent wording, breach plan and data map, from ₹2,999.
Request service