DPDP Compliance Kit | DigitalSnot

Your business

Business name

What you do

Area and city

Website

Who answers questions about personal data

Their email

Their phone (optional)

Other languages for your notice

The Act asks you to offer the notice in English or any language in the Eighth Schedule to the Constitution.

Where do you keep it?

Website database or hosting Email inbox Spreadsheets (Google Sheets, Excel) CRM, booking or practice software WhatsApp Business app Billing or accounting software Paper files

Delete personal data at the latest

Our suggestion: a fixed period, unless a law needs you to keep a record longer.

Most duties for businesses apply from

About 13 May 2027

Eighteen months after the DPDP Rules, 2025 were published (our count from the Gazette date).

Key dates

13 November 2025
The DPDP Rules, 2025 published in the Gazette. Rules 1, 2 and 17 to 21 came into force, and the Data Protection Board of India was set up the same day.
About 13 November 2026
Rule 4 comes into force, one year after publication.
About 13 May 2027
Rules 3, 5 to 16, 22 and 23 come into force, including reasonable security safeguards (rule 6) and breach intimation (rule 7).

Who is who in the Act (section 2)

Data Fiduciary: You: the business that decides why and how personal data is processed, alone or with others.
Data Principal: The person the data is about. For a child, this includes the parents or lawful guardian.
Data Processor: Anyone who processes personal data on your behalf, such as your web host.
Consent Manager: A company registered with the Data Protection Board that lets people give, manage, review and withdraw consent through one accessible, transparent and interoperable platform.
Significant Data Fiduciary: A business the Central Government notifies, based on factors such as the volume and sensitivity of its data. It needs a Data Protection Officer based in India, an independent data auditor, and periodic impact assessments and audits.
Child: Anyone who has not completed 18 years of age.

0 of 0 done

Built from your answers. Each item names its source in the Act or the Rules, or says it is our suggestion.

Penalties in the Schedule to the Act

The most the Data Protection Board can impose for each kind of breach.

Not taking reasonable security safeguards to prevent a personal data breach (section 8(5))Up to ₹250 crore
Not telling the Board or the people affected about a breach (section 8(6))Up to ₹200 crore
Not meeting the extra duties for children (section 9)Up to ₹200 crore
Not meeting the extra duties of a Significant Data Fiduciary (section 10)Up to ₹150 crore
Any other breach of the Act or the Rules (PIB summary)Up to ₹50 crore

Next steps

Have a lawyer check the result against your business.

Privacy notice section

A draft from your answers. Edit it here, then copy it to your privacy page.

You can edit the text. Changes to your answers update it until you do.

Consent text for forms

Unticked boxes for your contact, booking and job forms, and a WhatsApp first reply.

You can edit the text. Changes to your answers update it until you do.

Our suggestion, not a legal requirement we could find

We found no cookie-specific rule in the Act or the Rules. This banner follows their consent rules: Google Analytics loads only after a clear "Accept", "Reject" is just as easy, and "Cookie choices" lets visitors change their mind at any time.

Using Google Ads too? Google needs consent signals for visitors in the EEA, the UK and Switzerland: check Consent Mode with our Google Ads Tag Checker.

Google Analytics 4 measurement ID (optional)

It starts with G-. Remove any other Google Analytics code from your pages, so it does not load twice.

How it looks

HTML, CSS and JavaScript to paste

Test it in a private window: no request to googletagmanager.com should appear until you accept.

The DPDP Rules, 2025 (rule 7)

72 hours

to send the Data Protection Board the detailed report, after telling it and the people affected without delay.

In a real breach: when did you become aware of it? (IST)

The Board can allow a longer period on a written request. The headings for the report and the steps marked "our suggestion" are ours, not the Rules' wording.

Privacy notice section

Consent text for forms

HTML, CSS and JavaScript to paste

Breach response plan