The DPDP Readiness Guide turns India's Digital Personal Data Protection Act and Rules, 2025 into plain duties, a timeline and checklists you can hand to your team.
Quantarra helps teams in healthcare, telecom, SaaS and logistics stay audit-ready across frameworks.
The DPDP Rules take effect in phases. Notices, consent flows, retention schedules and safeguards all take months to design and test, so this is the preparation window.
The Data Protection Board of India was established, with select provisions on definitions, powers and enforcement.
Registration and functioning rules for Consent Managers, a new regulated category, come into force 12 months after notification.
Consent notices, retention and erasure workflows, and security safeguards, 18 months after notification.
What's at stake? Penalties go up to ₹250 crore (₹2.5 billion), depending on severity and the type of violation, including failing to protect personal data and delays in breach notification. Source: published summaries of the DPDP Rules, 2025. Dates are counted from notification and shown as approximate; confirm against the official text.
Work backwards from the deadline with a clear plan, starting today.
Get the free guideRead it in order the first time. After that, keep the breach worksheet and the readiness checklist open while you work.
The four terms you need to know.
What comes into force, and when.
Start hereA quick self-check.
Notice, consent, safeguards and children's data.
The 72-hour report and a one-page worksheet.
WorksheetAnnual DPIA, independent audit, reports to the Board.
What the ceiling is, and what triggers it.
One page to tick through with your team.
ChecklistWhat to record, and who owns it.
Three things to do this week.
Under the Rules, the hard part is rarely the template. It is knowing, in the moment, who owns the report, where the facts live and who signs off.
Tell each affected person, in plain language: what happened, the possible impact, the steps taken and who to contact.
Send an initial intimation to the Data Protection Board as soon as you know.
A detailed report to the Board within 72 hours, or a longer period if the Board formally permits it.
Who writes your 72-hour report? Chapter 5 has a one-page worksheet to settle it.
Get the free guideFor organisations that process the personal data of people in India, in sectors such as fintech, healthcare and SaaS. No legal background needed.
Much of DPDP readiness is evidence work: controls with named owners, proof linked to what it shows, and a review before anyone external sees it. Quantarra is an AI-driven audit and compliance platform, with expert oversight, that helps teams run that discipline in one place.
Every requirement broken down to the control level, with an owner, a status and a due date.
300+ connectors gather evidence automatically and keep it linked to the control it proves.
An internal review step and a live dashboard for every audit: what is accepted, overdue and due this week.
Reuse the same controls and evidence across the frameworks you follow, such as ISO 27001, SOC 2 and GDPR.
Auditors work from the same immutable audit ledger as your team, which can cut external audit fieldwork from months to days.
We guide you on what evidence to collect, who owns it, and how to work with your auditors, from first gap check onwards.
Runs on AWS · 24x7 support · 99.99% availability
Tracking notices, consent records and safeguards by hand is fine at first. As data, owners and frameworks grow, it means missed owners, stale evidence and no review trail. Quantarra automates the busywork, so your team spends audit week reviewing, not scrambling.
The platform itself is remarkably intuitive and robust, truly transforming how we manage our internal audits and maintain continuous compliance.Satbeer Bhatia, Head of Compliance, NucleusTeq
Start with the guide. When you're ready, we'll show you how teams keep their evidence audit-ready.
Get the free guideYes. Enter your details and we email you the PDF straight away. You'll get two short follow-up emails, and you can unsubscribe at any time.
If your organisation decides why and how the personal data of people in India is processed, you are likely a Data Fiduciary with duties under the law. Chapter 1 explains the key terms; confirm your position with your legal adviser.
A Data Fiduciary designated by the Central Government for extra duties, based on factors such as the volume and sensitivity of the data it processes. Extra duties include an annual DPIA and an independent audit. Chapter 3 has a self-check.
The core business duties apply about 18 months after the Rules were notified on 14 November 2025, so around May 2027. Chapter 2 sets out the full timeline.
No. It is general information to help you prepare. The Act, the Rules and notifications of the Government of India are the authority, so confirm what applies to you with your legal adviser.
Free, twelve pages, and ready to share with your team. When you want help putting it into practice, we're one call away.
