The DPDP Rules are notified, the Data Protection Board is operational, and the compliance window is already narrower than most Indian businesses realise.
February 2026 · 6 min read
The DPDP compliance clock isn't waiting for some future "once enforcement starts" moment. It's already running. India's Digital Personal Data Protection Act, 2023 was passed on 11 August 2023, but for most businesses the real compliance clock started on 13 November 2025 — the day the DPDP Rules were officially notified. Roughly sixteen months remain from that point for Indian companies to reach real compliance before enforcement expectations fully harden.
The Data Protection Board of India is operational, and the market is already shifting — from privacy as an awareness exercise to privacy as something you're accountable for.
DPDP is the Digital Personal Data Protection Act. It applies to any organisation offering goods or services to individuals in India and processing their personal data in digital form, regardless of where that organisation is physically located. This is not a law aimed only at large technology companies.
It reaches banks, NBFCs, and fintech platforms; insurance and wealth management firms; ecommerce and retail businesses; health-tech startups, clinics, and hospitals; automobile dealers and service centres; schools, ed-tech platforms, and coaching institutes; hotels, logistics, and delivery businesses — and, realistically, even a neighbourhood service business if it's storing customer phone numbers in a spreadsheet. If personal data gets collected and stored digitally, DPDP applies.
Over time, certain organisations will be classified as Significant Data Fiduciaries, based on factors like the volume and sensitivity of the personal data they process, the risk to individual rights, and any impact on public order or the wider national interest. That classification brings additional obligations — enhanced governance, audits, closer oversight.
The exact line for that classification hasn't been fully drawn yet. But waiting for that clarity before acting is precisely how organisations end up over-correcting under pressure later, once the line does get drawn.
Most organisations have historically operated on a simple, largely unexamined assumption: we have the data, so how can we use it? DPDP inverts that logic entirely. Data and purpose become inseparable — even data you already hold is effectively unusable without a defined purpose and valid consent attached to it.
That's not a legal nuance to footnote. It's a shift in how the business itself has to operate, because DPDP touches every team that ever interacts with personal data: business teams defining use cases, product teams designing user flows, marketing teams running campaigns, analytics teams building pipelines, support teams handling requests, and vendors or processors who touch the data on your behalf.
The new default rule is closer to: we have this data, for this specific purpose, and it can't be reused for anything else without a fresh basis. That single constraint reshapes how organisations think about why data was collected in the first place, how each purpose gets justified, whether data can be reused later, how consent and context and history actually get tracked, what happens the moment consent is withdrawn, and — critically — whether all of it can be demonstrated to a regulator on request.
DPDP compliance was never really about writing a privacy policy, updating terms and conditions, or running a one-time compliance project and calling it done. It's about building systems that can produce proof — systems able to demonstrate, at any point, that consent was valid, that a purpose was clearly defined, that processing stayed inside that purpose's bounds, that a withdrawal request was actually honoured, and that retention was under control rather than indefinite by default.
That's why DPDP is better understood as an engineering and operational challenge first, and a legal one second — the legal requirement is clear enough; building the systems that can prove you met it is the actual work.
If there's a single idea to hold onto here, it's this: most companies still think in terms of "we have data, how can we use it." DPDP changes that to data and purpose being inseparable — without valid consent and a defined purpose, the data simply isn't usable. That's not a policy tweak. It's a change to how the business itself is allowed to run.
Yes, DPDP is disruptive, and yes, it forces uncomfortable redesigns of systems that were never built with this in mind. But it also creates something India's digital economy has genuinely lacked until now: trust as a structural property of how systems are built, rather than a claim made in marketing copy. Implemented properly, DPDP doesn't just deliver compliance — it gives India's digital economy trust that's built into the architecture, not just asserted on top of it. That's a future worth taking the sixteen months seriously for.
With the window this narrow, the fastest way to find out exactly where your organisation stands is our DPDP gap assessment.
30 minutes to talk through your specific data footprint — no obligation.
Book a Consultation