DPDP by 13 May 2027: The IT Work Behind India’s Data Protection Law

Ask five people in one company who owns DPDP compliance and you will usually get five answers. Legal assumes IT is handling it. IT assumes legal is handling it. Marketing points at the cookie banner on the website. Management knows it matters but cannot say what “done” looks like.

Meanwhile the clock is real. The Digital Personal Data Protection Act, 2023 now has its rules: the DPDP Rules, 2025 were notified on 13 November 2025, and the substantive obligations — notice, consent, security safeguards, breach reporting, retention, children’s data and the rights of individuals — are scheduled to commence on 13 May 2027. From today, that is under seven months.

Here is the part most businesses miss: the law is written in legal language, but the bulk of the work is IT work. You cannot write a privacy policy about data you have not located. You cannot honour a deletion request your systems cannot execute. You cannot report a breach in 72 hours if nothing in your environment would have noticed it. That part — the plumbing — is what SNA Infotech has been building for Indian businesses since 1989, and it is what this guide is about.

When enforcement starts, you will need clear answers to three questions. Notice that none of them is answered by a document:

• Where does personal data sit across your organisation — every system, device, drive and vendor?
• Who has access to it, and how would you demonstrate that?
• Can you prove you comply if you are audited or asked to explain an incident?

DPDP covers any organisation handling the digital personal data of people in India — customer records, employee files, CCTV footage, visitor logs, HR data, even printed documents that get scanned back in. Policies alone will not carry it. Compliance needs visibility and evidence.

The dates that actually matter

The rollout is phased, so not everything lands at once:

Date	What comes into force	Who it affects
13 November 2025	Rules notified (G.S.R. 846(E)). Provisions establishing the Data Protection Board of India took effect immediately.	Regulator-facing — no direct business obligation yet
13 November 2026	Rule 4 — registration of Consent Managers.	Only businesses that intend to operate as a Consent Manager
13 May 2027	Rules 3 and 5–16, 22 and 23, plus the Act’s core obligations, data principal rights and the penalty provisions.	Every Data Fiduciary — i.e. almost every business that handles customer or employee data

What it costs to get this wrong

The Act sets penalty ceilings, not standard fines — the Board decides each case on its facts. But the ceilings signal where the regulator expects the most effort:

Failure	Penalty up to
Failure to take reasonable security safeguards to prevent a personal data breach	₹250 crore
Failure to notify a personal data breach, or breach of children’s-data obligations	₹200 crore
Significant Data Fiduciary failing its additional duties	₹150 crore

Notice which one carries the highest ceiling: security. That is not a drafting accident. And the cost of a breach itself is rising independently of any penalty — IBM’s 2026 Cost of a Data Breach Report put the average breach in India at ₹25.5 crore, up 15.9% year on year, with 39,500 records compromised on average.

Where legal ends and IT begins

It helps to split the work honestly, because the two halves need different people:

Legal and process work	IT and infrastructure work
Drafting notices and consent language	Finding where personal data actually lives
Deciding lawful purposes and retention policy	Making encryption, masking and access control real
Data processor contracts and vendor clauses	Logging, monitoring and one-year log retention
Grievance redressal policy and DPO appointment	Detecting a breach fast enough to report it in 72 hours
DPIA methodology, audit scope	Executing access, correction and erasure requests across systems

SNA Infotech is a system integrator, not a law firm. We do not draft your privacy policy. What we do is build and operate the right-hand column — and in our experience that is where compliance projects stall, because it is the column that costs real engineering time.

Rule 6, translated into an IT checklist

Rule 6 of the DPDP Rules is the clearest instruction in the entire framework for an IT team, because it lists minimum measures rather than principles. Here is what it requires, and what each line means in a working environment:

What Rule 6 requires	What that means in your environment
Encryption, obfuscation, masking, or virtual tokens mapped to the personal data	Disk encryption on laptops and servers; TLS in transit; masking in test and reporting environments; tokenisation where full values are not needed
Appropriate measures to control access to the computer resources used	Role-based access, least privilege, MFA, removal of shared logins and ex-employee accounts, review of who can export data from the CRM or ERP
Visibility on the accessing of personal data, through logs, monitoring and review	Centralised logging from endpoints, servers, firewall and cloud apps — and someone or something actually reviewing it
Retention of logs and personal data for one year, unless another law requires longer	Log storage sized and budgeted for twelve months; retention configured rather than assumed
Reasonable measures for continued processing if data is compromised, such as data backups	Tested backups, offline or immutable copies, a documented restore time — not a backup job nobody has restored from
Appropriate security provisions in contracts with Data Processors	Every vendor touching your data — payroll, cloud, marketing, AMC — under a contract that passes these obligations down
Technical and organisational measures ensuring the safeguards are effectively observed	Policy that matches configuration; periodic verification that controls are still switched on

The 72-hour clock, and why detection is the hard part

Rule 7 is where a quiet assumption breaks. On becoming aware of a personal data breach, a Data Fiduciary must:

• Tell every affected individual without delay, in clear plain language, through their user account or a channel they registered with you — describing the nature, extent and timing of the breach, the likely consequences for them, what you have done to mitigate it, what they should do to protect themselves, and who they can contact with questions.
• Inform the Board without delay with a description of the breach, its nature, extent, timing, location and likely impact.
• File a detailed report with the Board within 72 hours of becoming aware — the facts and circumstances leading to the breach, mitigation taken and proposed, findings about who caused it, remedial steps to prevent recurrence, and a summary of what you told affected individuals. A longer period can be requested in writing.

Now set that against the IBM figure above: without AI or security automation, the average organisation took 236 days to identify a breach. A 72-hour reporting duty attached to a 236-day detection reality is not a documentation problem. It is a monitoring problem.

Two more practical points on breaches. First, the DPDP obligation sits alongside CERT-In’s existing directions, which require certain cyber incidents to be reported within six hours — so one incident may trigger two different clocks. Second, the notification to individuals is only possible if you can determine whose data was in scope. That depends entirely on knowing what data you held and where.

What this actually needs in place

• Endpoint detection and response on every machine, not just servers — so that “becoming aware” happens in hours, not months.
• Managed detection and response, or someone on call, if you do not run a 24×7 security team of your own. (See our guide to the Sophos security stack for how firewall, ZTNA, XDR and MDR fit together.)
• An incident runbook naming who declares a breach, who drafts the Board report, who notifies individuals, and who signs off — written before you need it.
• Log retention that can reconstruct what happened. Without a year of logs, the detailed 72-hour report is guesswork.

You cannot protect data you cannot find

Every DPDP project we have scoped runs into the same wall first: nobody has a complete list of where personal data sits. Typically it is in more places than the inventory suggests:

• The obvious systems — CRM, ERP, HRMS, accounting, email.
• Spreadsheets and shared drives — the exported customer list from 2019 that nobody deleted.
• Endpoints and mobile devices — particularly field and sales staff carrying customer contact data on personal phones. This is exactly the problem mobile device management exists to solve, and it is one of the most common gaps we see.
• Print and scan infrastructure — a multifunction device stores spooled jobs, scan-to-email address books, and in many cases a hard disk holding images of everything printed. An MFP at end of lease, leaving the building with its drive intact, is a data breach waiting to be discovered. Secure print release, drive encryption and certified data wiping at disposal are part of DPDP readiness, not printer trivia.
• CCTV and access control — recorded footage and biometric or card logs are personal data too. Retention periods and who can export clips need a decision, not a default. Our surveillance and access control practices cover this.
• Backups and archives — an erasure request has to reach these, or your deletion is cosmetic.
• Third parties — payroll bureaus, marketing agencies, cloud platforms and AMC vendors processing on your behalf.
• AI tools — and this one is new.

The shadow AI problem

An AI usage policy can tell staff what not to upload. It cannot tell you what has already been pasted into a chatbot. A salesperson drops a customer enquiry list into an AI tool to draft replies; a developer pastes production logs into a coding assistant; HR summarises employee files. Each is a new, undocumented path for personal data out of your environment.

IBM found that 26% of malicious breaches in India were AI-generated, and that shadow AI added an average of ₹1.79 crore to breach costs where it was present — ranking among the top three cost-increasing factors alongside non-compliance and cloud migration. For DPDP purposes, data in an unsanctioned AI tool is still data you are accountable for. Practical first steps: inventory the AI tools actually in use, decide which are approved, control access to the rest, and give staff a sanctioned option so the shadow route stops being the convenient one.

The wider point is that AI governance and DPDP compliance reinforce each other. Know what data you feed into AI systems, obtain proper consent for that purpose rather than relying on consent given for something else, and keep a human in the loop on decisions that affect people. Teams that can answer “what goes into the model, and on whose authority?” are most of the way to answering the same question about every other system they run.

Retention, erasure and the rights you will have to honour

From May 2027, individuals can ask to access, correct and erase their data, withdraw consent, nominate someone to exercise their rights, and raise grievances. Three operational details catch businesses out:

• Erasure must be real. If the record survives in a backup, a reporting warehouse, a vendor’s system or an old spreadsheet, it is not erased. Mapping the downstream copies is the work.
• Individuals get at least 48 hours’ notice before their data is erased under the retention rules — so erasure has to be a scheduled, notified process, not an ad-hoc cleanup.
• Grievances must be resolved within 90 days. That requires a logged, assignable queue with an owner — the same discipline as an IT helpdesk, which is why ticketing systems tend to end up carrying this.

Specified large platforms — certain e-commerce, social media and online gaming intermediaries above user thresholds set in the Rules — additionally face a three-year erasure rule measured from the user’s last interaction. Most mid-sized Indian businesses fall outside that class, but if you run a consumer platform at scale, check where you sit.

One more: a consent withdrawal has to propagate. If someone opts out of marketing, every system that could send them a message needs to know — the CRM, the mailer, the WhatsApp broadcast list, the agency’s copy of the list.

Children’s data, Consent Managers and Significant Data Fiduciaries

Children’s data

Processing a child’s personal data requires verifiable parental consent, with the parent’s identity and age verified. Behavioural monitoring and targeted advertising directed at children are prohibited. Limited exemptions exist for healthcare professionals, educational institutions and providers of child transport. If your business touches schools, coaching, paediatric healthcare or children’s products, treat this as a separate workstream.

Consent Managers (from 13 November 2026)

A Consent Manager is a registered intermediary through which individuals can give, manage and withdraw consent. Registration requires an India-incorporated entity with a minimum net worth of ₹2 crore. The large majority of businesses do not need to register as one — you may eventually interact with Consent Managers, but Rule 4 is not a deadline most companies have to meet. Do not let it distract from the May 2027 work.

Significant Data Fiduciaries

The government may notify certain organisations as Significant Data Fiduciaries based on factors such as volume and sensitivity of data processed, risk to individuals and national-interest considerations. Additional duties include appointing a Data Protection Officer based in India, appointing an independent data auditor, carrying out periodic Data Protection Impact Assessments and audits, and conducting due diligence on algorithmic software for transparency and fairness. If you process personal data at scale, plan for the possibility of being notified rather than assuming you will not be.

The control that is not technology

One gap no appliance closes: a large share of data breaches start with ordinary human error — a file emailed to the wrong recipient, a password reused, an attachment opened, a customer list pasted somewhere convenient. Every control described above can be configured correctly and still be walked around by a well-meaning employee on a deadline.

Regular, short awareness training is therefore part of DPDP readiness, not an optional extra: what counts as personal data, what must never leave approved systems, how to recognise a phishing attempt, and who to tell within the hour when something looks wrong. It is also among the cheapest line items in the whole programme, and the one most likely to decide whether you find out about an incident in hours or in months.

A realistic plan for the months you have left

The order matters more than the speed. Knowing your data shapes your notices; your notices shape consent; consent shapes everything after it. Working out of order means doing it twice.

Window	Focus	What “done” looks like
Nov – Dec 2026	Discover and own	A written inventory of personal data: what you hold, where it sits, which system or vendor holds it, how sensitive it is, who owns it, and why you have it. Delete what has no purpose.
Jan – Feb 2027	Close the security gaps	Rule 6 measures implemented and evidenced: encryption, access control and MFA, centralised logging with a year of retention, tested backups, processor contracts updated.
Feb – Mar 2027	Notice and consent	Purpose-specific notices live across website, apps, forms and onboarding; consent recorded with timestamp and the exact text shown; withdrawal reaching every downstream system.
Mar – Apr 2027	Operations	Working queues for rights requests and grievances; a rehearsed breach runbook that can produce a 72-hour report; retention schedules configured.
Apr – May 2027	Evidence and dry run	A compliance file you could hand over: consent history, notice versions, request logs, incident records, audit trail. Run one simulated access request and one simulated breach end to end.

Where SNA Infotech fits

We are an IT system integrator, operating since 1989, with an ISO 9001:2015-certified delivery practice and a team that includes a DPDPA-certified consultant. Our role in a DPDP programme is the technical half — working alongside your legal advisors rather than replacing them:

What DPDP demands	What we deploy for it
Data discovery and audit trails	Data classification and auditing tools across file servers, SharePoint, cloud storage and endpoints
Security monitoring and compliance evidence	SIEM and log management, network detection and response, SOAR for repeatable incident handling
Network protection	Next-generation firewalls, and replacement of end-of-life devices that no longer receive security updates
Ransomware resilience	Backup and disaster recovery for endpoints, servers and Microsoft 365
Physical data security	CCTV, access control, and barcode or RFID tracking for assets and visitors
Document security	Secure print management with user authentication and a print audit trail
Knowing where you stand	A DPDP gap assessment and a step-by-step compliance roadmap

In practice, that breaks down as:

• Discovery and assessment — a structured walk through your environment to produce the data inventory and a gap list against Rule 6, including the places that get missed: endpoints, print devices, CCTV, backups and vendor systems.
• Security build-out — firewall, zero-trust access, endpoint and email security, MFA and access control, through our cybersecurity practice, with penetration testing to establish where you actually stand.
• Detection and response — XDR, or managed detection and response for 24×7 cover, so the 72-hour clock is achievable.
• Logging, backup and retention — centralised logs sized for the one-year requirement, and backups that have actually been restored, via our infrastructure and cloud teams.
• Device and mobile control — MDM for field staff, policy enforcement on laptops, and certified data wiping before any device is returned, resold or scrapped.
• Print and physical security — secure print release, MFP drive handling at end of lease under our AMC and print practices, plus retention and access decisions on surveillance footage and access control logs.
• Request and grievance workflow — using ticketing you already own, so rights requests and complaints have an owner, an SLA and an audit trail.

Most engagements start small: an assessment that tells you where you stand, then a prioritised plan sized to your business. That is a far better use of the next seven months than a policy document written over data nobody has mapped.

Do not wait for an audit or a breach

The deadline is fixed and enforcement follows it. Starting now buys you the thing a last-minute scramble cannot: time to plan properly, budget across two financial years, and roll out controls in an order that does not require redoing the earlier ones. Starting in April 2027 buys you a scramble.

Protect your data, protect your customers, protect your business — in that order, because the third depends on the first two.

Frequently asked questions