DPDP compliance is due in May 2027. Most companies haven't started.

Ask a room of founders about the DPDP Act and you'll hear the same line: "We have till 2027, we'll figure it out next year." The Digital Personal Data Protection Rules were notified on 13 November 2025. Full compliance — notice, consent, data-principal rights, grievance systems — lands on 13 May 2027.

That's about 200 working days. And DPDP compliance is not a policy you download; it's an operating system you build. Here's the honest state of play.

What "compliance" actually means

Know your data. Every category of personal data you hold — customers, employees, website visitors, CCTV, vendor staff — mapped to a purpose and a lawful basis. Most companies discover data they didn't know they had. This mapping alone takes 4-8 weeks in a mid-sized business.

Consent and notice, rebuilt. Privacy notices in clear language (English plus scheduled languages where needed), consent that's actually specific and withdrawable, verifiable parental consent for minors — and no behavioural tracking or targeted ads aimed at children, full stop.

Vendor contracts rewritten. Every processor — your CRM, payroll provider, cloud host, even the laptop-rental vendor — needs DPDP clauses: purpose limitation, security standards, breach notification to you within 24-48 hours, deletion on exit. You cannot delegate your liability to "the vendor handles it". The duty sits on you as Data Fiduciary.

A breach clock that works. On a personal data breach, you notify the Data Protection Board and every affected person. That requires a rehearsed runbook, not a panic. Companies that have never run a breach drill will not invent one at 2 a.m. during an actual incident.

SDF readiness, if you're in the zone. If your volumes or sector (consumer platform, healthtech, edtech, payments) make Significant Data Fiduciary notification likely, you additionally need an India-based DPO, independent data audits, and periodic DPIAs. Retrofitting these after notification is far more expensive than building toward them now.

The penalty maths

Failure to maintain reasonable security safeguards: up to ₹250 crore. Failure to notify a breach: up to ₹200 crore. SDF obligation breaches: up to ₹150 crore. Per contravention, decided by the Data Protection Board.

You don't need to believe you'll be fined the maximum. You need to believe a single breach — with no consent records, no vendor DPAs, and no response runbook — is an existential headline for a growth-stage company. Investors now diligence DPDP posture the way they diligence tax. It shows up in deals. It has already shown up in ours.

The phased plan we'd run

Now to January 2027: data mapping, gap assessment, DPO appointed, consent architecture designed. February to April 2027: notices live, vendor DPAs signed, breach runbook drilled, rights-request workflow tested. By 13 May 2027: full compliance operating, with evidence — because under DPDP, being compliant and being able to prove it are the same thing.

CorpCFO runs DPDP readiness as part of our Corporate Law & Secretarial practice — the same team that handles your board and compliance calendar builds the data governance layer on top of it. One accountable firm, no hand-offs between your CS, your lawyers and a separate privacy consultant.