DPDP Act 2023 & DPDP Rules 2025
- Consent Manager Deadline: 13 November 2026
- Principal Consultant on Every Engagement
DPDP Compliance Consulting For Indian Enterprises and Global Organisations
Every organisation that collects, stores, or processes the personal data of individuals in India is a Data Fiduciary under the DPDP Act 2023. There is no minimum size, no turnover threshold, and — critically for international organisations — no headquarters requirement. A US technology company with Indian employees, a UK firm processing Indian customer data through a Mumbai office, a Singapore-headquartered SaaS platform with Indian subscribers, or a European enterprise outsourcing to an Indian BPO: all are Data Fiduciaries, all carry the same core obligations, and all face the same penalty exposure.
DPDP compliance consulting is the structured programme that takes you from your current data handling practices to a position where those practices are fully aligned with the DPDP Rules 2025 — and remain that way.
The DPDP Rules 2025 came into force on 13 November 2025. Full enforcement applies from 13 May 2027. The Act imposes penalties on a per-breach basis — not as an annual aggregate. Failure to implement reasonable security safeguards: ₹250 crore. Failure to notify a breach to the Data Protection Board of India within 72 hours: ₹200 crore. Non-compliance with children’s data obligations: ₹200 crore. Every DPDP compliance engagement at AnantaQuanta Consulting is led directly by Vijay M (CDPSE, ISACA) — our Founder and principal consultant, certified by ISACA as a Certified Data Privacy Solutions Engineer.
For international organisations encountering DPDP Act obligations for the first time — adding an India-specific compliance layer to an existing GDPR or global privacy programme — AnantaQuanta Consulting builds integrated frameworks that align DPDP Rules 2025 with your existing data governance architecture rather than creating a standalone programme that duplicates effort and contradicts your existing policies. For Indian organisations that simultaneously face GDPR obligations for EU operations, we are the only practice that builds both within one unified programme.
Does DPDP Act Apply to Your International Organisation?
The DPDP Act 2023 applies based on where personal data is processed, not where an organisation is headquartered. If your organisation:
- Operates an office, subsidiary, or data centre in India that processes personal data
- Offers goods or services to individuals located in India (including digital services, apps, SaaS platforms, or websites with Indian users)
- Employs Indian nationals whose HR and payroll data is processed digitally
- Contracts with Indian BPOs, IT vendors, or shared service centres that process personal data on your behalf
…then your organisation is likely a Data Fiduciary under the DPDP Act and carries compliance obligations effective from 13 May 2027.
For multinational corporations adding DPDP compliance to an existing global privacy programme, AnantaQuanta Consulting designs integration frameworks that align DPDP Rules 2025 with GDPR, CCPA, or other existing frameworks — so you satisfy Indian regulatory requirements without rebuilding your data governance architecture from scratch.
Are You a Significant Data Fiduciary? The Enhanced Obligations Explained.
The DPDP Act designates certain Data Fiduciaries as Significant Data Fiduciaries (SDFs) — organisations whose scale, data sensitivity, or societal impact triggers enhanced obligations. SDF designation is determined by the Central Government based on volume and sensitivity of data processed, risk of harm, national security considerations, and impact on democratic processes. Significant Data Fiduciaries must: appoint a mandatory India-based Data Protection Officer (DPO), commission annual independent data audits, conduct periodic Data Protection Impact Assessments, and deploy registered Consent Manager integration as a regulatory requirement.
For multinational corporations, SDF designation is particularly relevant: global technology companies, large-scale SaaS platforms with Indian subscribers, and enterprises processing health or financial data of Indian residents are among the most likely categories. The SDF designation list has not yet been published — but if your organisation processes large volumes of Indian consumer data, assessing your SDF likelihood now — before designation — is the only sensible approach. AnantaQuanta Consulting conducts SDF likelihood assessments and designs compliance programmes to SDF standards from day one.
Our DPDP Compliance Services
DPDP Readiness Assessment
A structured gap analysis measuring your current data handling practices against every applicable provision of the DPDP Act 2023 and DPDP Rules 2025. Output: a prioritised remediation roadmap with timeline and resource estimates mapped to the May 2027 enforcement deadline.
- Consent mechanism and privacy notice adequacy against Rule 3 requirements
- Data Principal rights infrastructure assessment — all six DPDP Act rights
- Breach detection and 72-hour notification capability review
- Third-party processor contract compliance against DPDP Rule 9
Personal Data Mapping & Classification
A systematic inventory of every category of personal data your organisation collects — the purpose of processing, where it is stored, how it flows between systems and third parties, and whether the processing has a lawful basis under the DPDP Act. For organisations with legacy systems or fragmented data architectures, this is typically the most operationally complex part of the compliance programme.
- Personal data inventory across all systems, applications, and databases
- Data flow mapping — from collection point through processing to deletion
- Lawful basis documentation per data processing activity
- Third-party processor and vendor data flow identification
Consent Architecture & Management
Design and implementation of a consent framework meeting the DPDP Act’s requirements for specific, informed, unconditional, and unambiguous consent — across web, mobile, and offline collection points. Includes Consent Manager alignment ahead of the 13 November 2026 registration deadline.
- Privacy notice design aligned to DPDP Rule 3 requirements
- Consent collection flow redesign for web, app, and offline channels
- Consent withdrawal mechanism implementation with audit trail
- Consent Manager integration readiness assessment and architecture.
Data Principal Rights Management
Operational design for all six rights available to data principals under the DPDP Act: right to information, correction and erasure, grievance redressal, nomination, consent withdrawal, and data access. Includes intake workflow design, 30-day response protocols, escalation procedures, and audit trails.
- Data Subject Access Request (DSAR) intake and processing workflow
- 30-day DPDP Act response protocol with escalation triggers
- Right to correction, erasure, and data portability procedures
- Grievance redressal mechanism design and officer appointment
Vendor & Processor Compliance
Review and remediation of third-party data processing arrangements against DPDP Rule 9 obligations — ensuring your vendors, processors, and SaaS providers meet the Act’s requirements. Includes contract gap analysis, standard contractual clauses, cross-border transfer assessment, and a vendor risk register.
- Data Processing Agreement (DPA) gap analysis against DPDP Rule 9
- Vendor contract updates and standard clauses for processor agreements
- Cross-border data transfer assessment under the DPDP Act
- Vendor risk register build with periodic review process
Breach Response Planning & Incident Readiness
Design and operationalisation of your DPDP breach notification programme — aligned to the DPDP Rules 2025 requirement for preliminary notification to the Data Protection Board of India without delay, with a detailed report within 72 hours. For organisations also subject to CERT-In directions, the first clock starts at 6 hours.
- Breach detection and internal escalation workflow design
- 72-hour notification procedure to the Data Protection Board of India
- CERT-In 6-hour parallel notification workflow (where applicable)
- Tabletop incident response exercise and playbook testing
Ready to Assess Your DPDP Exposure?
How a DPDP Compliance Engagement Works From Gap to Audit-Ready
A compliance programme built around a checklist tends to look complete and hold up poorly. We design DPDP programmes around your actual operational environment — the systems you run, the data you collect, the vendors you rely on, and the resources you have available. Our engagement model follows five structured phases, each with defined outputs that the next phase builds on.
Discovery & Scoping
We begin every engagement with a structured discovery session — mapping your business model, your data processing activities, your current technical environment, and your regulatory exposure profile. This includes an initial review of existing privacy documentation, vendor contracts, and any prior assessments. Output: a scoped engagement plan with timelines, resource requirements, and defined deliverables for each phase.
DPDP Readiness Assessment
A systematic audit of your current practices against every provision of the DPDP Act 2023 and DPDP Rules 2025 — covering lawful basis, consent mechanism adequacy, privacy notice compliance, Data Principal rights infrastructure, breach detection and notification capability, security safeguard implementation, and third-party processor contract compliance. We score each gap by regulatory risk severity and enforcement timeline. Output: a prioritised gap report you can take to your board.
Programme Design & Policy Development
Design of the governance framework, policy suite, and operational procedures required to close the gaps identified in Step 2. Typical deliverables include: updated consent notices and privacy statements, a Consent Manager-aligned consent architecture specification, data retention and erasure schedules, Data Principal rights handling procedures, breach response playbook, and vendor due diligence framework aligned to DPDP Rule 9.
Implementation Support & Training
We work alongside your technical, legal, and compliance teams to implement the controls and procedures designed in Step 3 — including review of technical implementations, staff training for relevant functions, and a pre-go-live audit to verify readiness. The engagement closes when your team can operate the DPDP compliance programme independently, not when we have delivered a set of documents.
Why AnantaQuanta Consulting for DPDP Compliance
Understanding the DPDP Act requires more than reading the legislation. The Rules create obligations that cut across your legal function, your engineering team, your procurement and vendor management processes, your customer experience operations, and your executive governance structure. For Indian enterprises, this means navigating a new regulatory framework across existing teams and systems. For international organisations, it means adding a new compliance layer to an existing global programme — without creating contradiction between DPDP Rules 2025 and your existing GDPR, CCPA, or ISO 27701 frameworks.
Every DPDP compliance engagement at AnantaQuanta Consulting is led by Vijay M (CDPSE, ISACA) — directly, from initial scoping through final delivery. CDPSE (Certified Data Privacy Solutions Engineer) is ISACA’s professional certification for data privacy programme implementation — the same body that issues CISA and CISM. There is no handoff to junior analysts.
Our practice brings together expertise in Indian data protection law, privacy programme design, technical security architecture, and cross-functional governance — applied across healthcare, financial services, SaaS, manufacturing, IT services, and BPO sectors. We understand how the DPDP Act’s obligations translate into operational requirements differently by sector and by organisation type. And because we are the same firm that implements GDPR and AI governance programmes, we are the only partner who can build you a single, unified compliance framework that satisfies DPDP Act, GDPR, and EU AI Act obligations simultaneously.
DPDP Compliance Programmes Built for Your Organisation Wherever You Operate From
DPDP Act obligations do not look the same for every organisation. An Indian fintech startup processing the financial data of 50,000 Indian users has different compliance priorities than a multinational corporation adding DPDP obligations to an existing GDPR programme, or an e-commerce platform approaching the Significant Data Fiduciary designation threshold. We structure our DPDP compliance programmes around that reality — whether you are building from scratch, integrating into a global privacy framework, or preparing for Significant Data Fiduciary designation.
Frequently Asked Questions — DPDP Act Compliance
What is the penalty for DPDP Act violations?
The DPDP Act imposes penalties on a per-breach basis, not as an annual cap. Failure to implement reasonable security safeguards: up to ₹250 crore. Failure to notify the Data Protection Board of India and affected data principals within 72 hours: up to ₹200 crore. Non-compliance with children’s data obligations: up to ₹200 crore. Failure to register as a Consent Manager when required: up to ₹50 crore. These penalties apply per incident, which means a single breach event can trigger multiple separate penalty proceedings.
Who is a Data Fiduciary under the DPDP Act?
A Data Fiduciary is any organisation that determines the purpose and means of processing personal data of individuals in India. There is no size threshold. If your organisation collects, stores, or processes the personal data of individuals in India — through a website, app, CRM, HR system, or any digital channel — you are a Data Fiduciary under the DPDP Act and must meet all core obligations.
What is a Significant Data Fiduciary and what extra obligations apply?
A Significant Data Fiduciary (SDF) is a Data Fiduciary designated by the Central Government based on volume and sensitivity of data processed, risk of harm, and impact on sovereignty or democracy. SDFs must appoint an India-based Data Protection Officer, conduct annual independent data audits, perform periodic DPIAs, and deploy Consent Manager integration. The SDF designation list has not yet been published — but if your organisation processes large volumes of consumer, health, or financial data, you should assess your SDF likelihood now.
What is the DPDP Act Consent Manager registration deadline?
The DPDP Rules 2025 require organisations to use registered Consent Managers to obtain and manage personal data consent. The deadline for Consent Manager registration with the Data Protection Board of India is 13 November 2026. Organisations whose consent architecture is not aligned to a registered Consent Manager by this date will be non-compliant from that day. AnantaQuanta Consulting designs Consent Manager-ready consent architectures ahead of this deadline.
How long does DPDP compliance take?
A typical DPDP compliance programme takes 10–14 weeks from initial gap assessment to audit-ready status for most organisations, depending on data architecture complexity, the number of third-party processors in scope, and whether consent mechanisms need to be built from scratch. Significant Data Fiduciary programmes requiring DPO appointment and annual audit readiness take longer. Given the May 2027 full enforcement deadline, organisations should begin no later than Q3 2026 to reach compliance comfortably.
Does the DPDP Act apply to foreign companies operating in India?
Yes. The DPDP Act 2023 applies to any organisation that processes the personal data of individuals located in India — regardless of where the organisation is headquartered, incorporated, or legally registered. A US technology company with Indian employees, a European enterprise using an Indian BPO, a Singapore SaaS platform with Indian subscribers, or a UK firm processing Indian customer data through an India subsidiary are all Data Fiduciaries under the Act and carry the same core compliance obligations as Indian-incorporated companies. AnantaQuanta Consulting builds DPDP compliance programmes specifically designed for multinational organisations adding this obligation to an existing global privacy framework.