# DPDP Ready: A plain-language notice, consent wording, breach plan and data map for Indian small businesses before the DPDP Rules' main duties apply in May 2027.

> India's Digital Personal Data Protection Rules bring the main duties of the DPDP Act into force eighteen months after they were published in November 2025: notices, consent, security safeguards, breach reporting, retention and a contact for privacy questions. There is no size threshold. We map where your business collects personal data and write the notice, consent wording, breach plan and records you need, checked by a person and ready to put on your website and forms.

- Page: https://rotomal.com/dpdp-ready/
- Category: Compliance deadlines
- Language: en
- Billing: one-time payment
- From: ₹499 one-time
- Request (free, no card): https://rotomal.com/dpdp-ready/request/

- A data map of every form, app, WhatsApp flow, spreadsheet and vendor that touches customer or staff data, with the purpose and who has access.
- A notice and consent wording that follow Rule 3: itemised data, specific purposes, and how people withdraw consent, use their rights and complain to the Board.
- A one-page breach plan for the 72-hour report to the Board, a security checklist from Rule 6, and a rights-request process that answers within 90 days.

## A national privacy law with no small-business threshold

The DPDP Act applies to digital personal data processed in India, including data collected on paper and digitised later, and to processing outside India for offering goods or services to people in India. It has no turnover or headcount threshold: a clinic's appointment sheet, a coaching centre's WhatsApp group and an online shop's checkout are all in scope. The Rules, dated 13 November 2025, bring Rules 3 and 5 to 16 into force eighteen months after publication, which most advisers put at 13 May 2027.

Those Rules are specific. A consent notice must stand on its own, itemise the personal data and the purposes, and say how to withdraw consent as easily as it was given. Security safeguards must include measures such as encryption or masking, access control, logs kept for a year and backups. A breach must be reported to each affected person without delay and to the Data Protection Board with details within 72 hours. Every business must publish a contact for privacy questions.

Penalties under the Act run up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore for failing to report a breach or breaching the duties on children's data. Large firms have counsel and consultants; most small businesses have a website template and a folder of forms. DPDP Ready gives them the documents in plain language at a fixed price.

- Rules 3, 5 to 16, 22 and 23, covering notices, security, breaches, retention, contact details, children's data and rights, come into force eighteen months after the Rules' publication in November 2025. (source: https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf)
- The highest penalty, up to ₹250 crore, applies to failing to maintain reasonable security safeguards; up to ₹200 crore for not notifying a breach or for children's data violations; up to ₹50 crore for other violations. (source: https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf)
- After a personal data breach, each affected person must be told without delay, and the Board must get a detailed report within 72 hours of the business becoming aware of it. (source: https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf)
- Data Fiduciaries must respond to requests to access, correct, update or erase personal data within a maximum of ninety days. (source: https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf)

## How it works

1. **Data check for ₹499.** Send your website address. Within 2 business days we list the forms, sign-ups, checkouts, trackers and chat widgets we can see collecting personal data, and what the Rules expect at each one.
2. **A 30-minute questionnaire.** Offline and internal data: registers, spreadsheets, WhatsApp, payroll, CCTV, the software and vendors you use, and whether you handle children's data.
3. **We write your documents.** Data map, notice, consent wording, contact page text, breach plan, security checklist and rights-request process, written for your business and checked by a person.
4. **You publish and file them.** Within 7 business days you get editable files and the exact places to put them, with one round of changes included.

## Features

- **Data map.** Every place you collect or keep personal data, what is collected, why, where it is stored, who can access it and which vendor processes it.
- **Rule 3 notice.** A stand-alone notice in clear language with an itemised list of data, the specific purposes, and how to withdraw consent, exercise rights and complain to the Board.
- **Consent wording and records.** Short consent lines for each form, checkout and sign-up, a matching withdrawal route, and a simple way to keep a record of what each person agreed to.
- **Breach plan.** Who does what in the first hours, the message to affected people with the five items Rule 7 lists, and the details the Board needs within 72 hours.
- **Security checklist.** Rule 6 in practical terms for your setup: encryption or masking, access control, logs kept for a year, backups and the security clause for vendor contracts.
- **Rights requests and contact.** The privacy contact text Rule 9 requires on your website, and a process and reply templates for access, correction and erasure requests within 90 days.
- **Children's data flag.** For schools, tutors, clinics and apps used by under-18s: where verifiable parental consent is needed, where tracking and targeted ads are off-limits, and where the Fourth Schedule's narrow health and education exemptions may apply.
- **Vendor list.** Each data processor you use, such as your payment gateway, CRM or hosting, with a note on the contract terms the Act and Rules expect.

## Who it's for

- **Clinics, labs and wellness practices.** Patient registers, appointment apps and reports on WhatsApp, often with no one who owns data protection.
- **Schools, coaching centres and tutors.** Children's data, where parental consent and the ban on tracking and targeted advertising to children apply, with narrow exemptions for educational institutions.
- **Online shops and D2C brands.** Checkouts, marketing sign-ups, abandoned-cart messages and analytics on Shopify, WooCommerce or a custom site.
- **Startups and agencies.** SaaS products and client work that handle personal data and need clear documents before investors or enterprise customers ask.

## Works with

Shopify, WooCommerce and WordPress sites, Wix, Squarespace and website builders, Google Forms and website contact forms, WhatsApp Business, Payment gateways and checkout pages, CRMs, email marketing and SMS tools, Word and Google Docs editable files

## Pricing

The data check costs ₹499 and is credited in full against Starter or Business if you order within 30 days. Starter and Business are one-time prices in Indian rupees, paid once, with one round of changes included. We prepare documents and checklists; putting them on your site and running the processes stays with you. We are not a law firm and this is not legal advice, and Significant Data Fiduciaries and complex cross-border processing need a lawyer. Founding customer pricing applies to early-access orders.

| Plan | Price | Includes |
| --- | --- | --- |
| Data check | ₹499 one-time | One website; Forms, checkouts and trackers listed; What the Rules expect at each one; Reply within 2 business days; The ₹499 is credited in full against Starter or Business if you order within 30 days |
| Starter | ₹2,999 one-time | Data map; Rule 3 notice; Consent wording for up to 5 forms or flows; Privacy contact text for your website; Rights-request reply templates; One round of changes |
| Business | ₹7,999 one-time | Up to 20 collection points, online and offline; Everything in Starter; Breach plan with 72-hour Board report; Rule 6 security checklist; Vendor list with contract notes; Children's data review; 30-minute call to walk through |

## Compared with the alternatives

- **Free templates.** Free toolkits such as TCSA's DPDP compliance template (a checklist, data-mapping template, sample notices and a breach plan) are a good start if you have time to adapt them to your own data, forms and vendors.
- **Consent apps for online stores.** Shopify apps such as DPDPA-Desk, listed from $3.99 a month when we checked on 3 November 2026, and others with free plans add consent banners, notice generators and, on higher plans, rights and breach tools to a store. They cover the store, not offline records or staff data.
- **A law firm.** The right choice for Significant Data Fiduciaries, cross-border transfers, sensitive health or financial processing at scale, or a dispute. Our documents can be the starting point for their review.

## Security and data

- We only look at your public website for the data check; nothing is installed and no login is needed.
- We never ask for customer or patient records: the data map lists types of data, not people.
- Questionnaire answers and documents are stored encrypted and deleted 60 days after delivery, or earlier on request.
- Your documents are shared only with you and anyone you name.

## From website address to published notice

The data check comes back within 2 business days; your documents within 7 business days of the questionnaire.

- Day 1: Send your website address for the data check.
- Day 2–3: We send the check; you choose a plan and fill in the questionnaire.
- Day 4–10: We write your documents and a person checks them.
- Day 11: You get editable files and where to put each one; one round of changes follows.

## FAQ

### When do the DPDP Rules apply?

Rules 1, 2 and 17 to 21 applied on publication in November 2025. Rule 4 on Consent Managers applies one year after publication, from November 2026, and Rules 3, 5 to 16, 22 and 23, the main business duties, eighteen months after publication. Most advisers use 13 May 2027.

### Does the DPDP Act apply to a small business?

Yes, if it processes digital personal data in India. The Act has no turnover or employee threshold. Data kept only for personal or domestic purposes is outside it.

### Could the deadline come forward?

In January 2026, press reports said MeitY had asked industry for views on cutting the eighteen-month period to twelve; some reports said only for Significant Data Fiduciaries. When we checked on 3 November 2026 we found no notified amendment, and the Gazette text still says eighteen months. We will update this page if that changes.

### Do we need a Data Protection Officer?

A Data Protection Officer is required for Significant Data Fiduciaries. Every Data Fiduciary must publish the business contact of a person who can answer questions about its processing of personal data.

### Does it cover paper records?

The Act covers personal data collected in digital form, and data collected on paper that is digitised later. A register that is scanned or typed into a spreadsheet is in scope.

### Do we need a Consent Manager?

No. Consent Managers are registered platforms people can use to manage consent; a business can collect consent directly, as long as its notice and consent meet the Rules.

### Is this legal advice?

No. DPDP Ready is an independent document service that applies the published Act and Rules. For complex processing or a dispute, use a lawyer.

## Guides

- [DPDP Rules compliance deadline: what applies when](https://rotomal.com/dpdp-ready/dpdp-rules-compliance-deadline/): The DPDP Rules apply in phases: on publication, after one year and after eighteen months. The dates, what each phase covers, penalties and what to do first.
- [DPDP privacy notice requirements: the Rule 3 checklist](https://rotomal.com/dpdp-ready/dpdp-privacy-notice-requirements/): What a DPDP consent notice must contain under Rule 3: itemised data, specific purposes, withdrawal, rights and the Board complaint route, plus Rule 9 contact.

---
Rotomal · https://rotomal.com/dpdp-ready/ · hello@rotomal.com