India's DPDP Act applies to every business that handles the personal data of people in India — whether you are a 12-person startup or a listed enterprise, and whether or not you are based in India. The DPDP Rules were notified on 13 November 2025, and the substantive obligations become enforceable on 13 May 2027. Find out in ten minutes where you actually stand.
The DPDP Rules, 2025 commence in phases. The clock on the obligations that carry the largest penalties is already running.
The DPDP Rules were notified and the Data Protection Board of India was established, along with the provisions governing its appointments and procedure. The supervisory machinery exists from this date onward.
Registration and obligations for Consent Managers come into force. Organisations relying on consent at scale need their notice and consent architecture ready to interoperate well before this date.
Notice and consent, security safeguards, breach notification, retention limits, children's data rules, processor contracts and Data Principal rights all become fully enforceable, with the Schedule's penalties available to the Board.
The Schedule to the DPDP Act sets the maximum monetary penalty the Data Protection Board may impose for each class of breach. These are per-instance ceilings, not annual caps.
The single largest exposure under the Act. Encryption, access control, logging and backups are not optional hygiene — they are a statutory duty under Section 8(5).
Section 8(5)Both the Data Protection Board and every affected Data Principal must be informed. Silence, or a delayed disclosure, is penalised separately from the breach itself.
Sections 8(6) & 8(7)Verifiable parental consent, and a prohibition on tracking, behavioural monitoring and targeted advertising directed at children under 18.
Section 9Notified SDFs must appoint an India-resident Data Protection Officer and an independent data auditor, and carry out periodic Data Protection Impact Assessments.
Section 10The catch-all. Defective notice, invalid consent, unserved rights requests, missing processor contracts and over-retention all land here.
Residual entryIndividuals are not exempt either. Frivolous or false complaints and impersonation carry a penalty on the individual under Section 15.
Section 15Penalties are determined by the Board having regard to the nature, gravity and duration of the breach, and the remedial action taken.
22 questions across 9 compliance domains, roughly ten minutes. You will get a readiness score, a domain-by-domain breakdown and your priority gaps.
Tell us who you are and we will unlock your readiness score straight away. A copy is sent to our compliance team so that a specialist can walk you through the findings if you would like.
This rapid assessment is an educational readiness indicator, not legal advice, and does not create a lawyer–client relationship. For a binding view on your obligations under the DPDP Act, 2023, consult qualified legal counsel.
Both assessments work through the same nine domains. The rapid version samples each one; the full version tests every control point within it.
Whether you are a Data Fiduciary, a Processor or both for each activity, plus a Record of Processing Activities covering what you collect, why, where it lives and who you share it with.
Itemised Section 5 notice, granular unbundled consent, withdrawal that is as easy as giving consent, and availability in the Eighth Schedule languages.
Access, correction, completion, erasure and nomination requests served within a defined turnaround, with a published grievance contact or DPO.
Encryption in transit and at rest, least-privilege access with logging, monitoring, and backups whose restores have actually been tested.
A written response plan with named roles, and the practical ability to notify the Board and every affected Data Principal within the prescribed timeline.
Retention schedules per data category, erasure once the purpose is served or consent is withdrawn, and accuracy controls where data drives decisions.
Age assurance, verifiable parental or guardian consent, and technical suppression of tracking and targeted advertising aimed at children.
Valid written contracts carrying DPDP obligations for every processor, a maintained vendor register, and security due diligence that is repeated, not one-off.
Knowing every destination country and cloud region your data reaches, and readiness for the additional duties that follow an SDF notification.
Our full assessment is a guided engagement led by a JJPMS compliance specialist. We work through 180+ control points across all nine domains, review your actual notices, contracts and system configuration, and hand you an evidence-backed remediation roadmap you can take to your board.
Our executive will talk to you soon.
A JJPMS compliance specialist will reach out on the phone number and email you provided to scope your full DPDP assessment.
Partly enforceable, and no. The Act received assent in August 2023, and the DPDP Rules were notified on 13 November 2025. The Data Protection Board of India exists from that date. The Consent Manager provisions follow on 13 November 2026, and the remaining substantive obligations become enforceable on 13 May 2027.
The work that takes longest — data discovery, re-architecting consent, renegotiating processor contracts, closing security gaps — is exactly the work that cannot be compressed into the final quarter. Organisations that start in the last few months typically discover they cannot even identify where their personal data sits.
There is no turnover or headcount threshold for the Act to apply. If you process digital personal data of individuals in India, you are in scope. It also applies extraterritorially: an entity outside India is covered where the processing relates to offering goods or services to Data Principals in India.
Size affects one thing only — whether the Central Government notifies you as a Significant Data Fiduciary, which adds duties such as an India-resident DPO, an independent data auditor and periodic DPIAs. It does not exempt anyone from the baseline obligations.
The rapid assessment is 22 self-reported questions, roughly ten minutes, sampling each of the nine domains. It gives you a directional readiness score and shows which domains are weakest. It is free and you get the result immediately.
The full assessment is a guided engagement across 180+ control points in which we review your actual artefacts — live notices, consent flows, processor contracts, system configuration — rather than relying on self-reporting. It produces a gap register mapped to specific sections and penalty ceilings, plus a prioritised remediation roadmap.
Your answers and contact details are sent to our compliance team at support@jjpmetasystems.com so that a specialist can interpret the result with you if you would like. They are used for that purpose alone. We do not sell them, and we do not share them with third parties.
No. Both assessments are compliance readiness tools, and this page is general information about the DPDP Act, 2023. Neither constitutes legal advice, and neither creates a lawyer–client relationship. For a binding view on how the Act applies to your specific circumstances, consult qualified legal counsel. We are happy to work alongside your counsel on the technical and operational remediation.