Guide · Cross-Border, Fintech & Emerging Technology
The DPDP Compliance Guide
Where the Digital Personal Data Protection Act, 2023 stands as at September 2026 - section and rule-wise commencement status, the penalty schedule, and a dated compliance roadmap to May 2027.
24 slides
What this covers
A section-by-section and rule-by-rule map of the DPDP Act, 2023 and the DPDP Rules, 2025 - what is already in force, what arrives in November 2026, and what waits for the final phase in May 2027.
Why it exists
The Data Protection Board, the definitions and the rule-making powers are live. The obligations that change how a business actually operates - notice, consent, security safeguards, rights and penalties - arrive with the final phase. Boards need to know which is which.
Inside
- The three-phase commencement structure and the basis for the computed dates
- Section-wise status across Chapters I to IX
- Rule-wise status across the DPDP Rules, 2025
- The Section 34 penalty schedule and the factors that set quantum
- A dated action list: now, before November 2026, and before May 2027
- Full compliance checklist, privacy notice checklist and breach response playbook
- Sector guidance for startups, foreign entities and IT service providers
The full deck is available to download below. It is marked for internal discussion and circulated on request.
Downloads