INDIA DPDP ACT & RULES: Prepare your data practices for India's privacy requirements.
DPDP readiness assesses how your organisation handles digital personal data against the Indian data protection requirements applicable to it. We map collection, use, sharing and removal, identify gaps in systems and working practices and support implementation as the relevant provisions take effect for your organisation.
- Discipline
- Governance, Risk & Compliance
- Engagement type
- Advisory
Begin with the data journey, from collection to deletion.
Readiness depends on more than updating a notice. A withdrawal request, a breach or the end of a retention period may require coordinated action across products, support teams and processors. Those dependencies need to be understood before the process is put under pressure.
Collection and use
Map digital personal data, processing purposes, collection points and the roles involved in the agreed activities.
Notices and choice
Review the operational support for notices, consent and withdrawal where applicable, including how choices are recorded and acted on.
Safeguards and processors
Examine access, security practices, processor dependencies and incident escalation for the data in scope.
Rights, retention and governance
Establish how requests, grievances, deletion and responsibilities will be handled; identify additional requirements relevant to the organisation.
Plan the work around applicability and commencement.
We establish the activities and entities being reviewed, then assess the relevant requirements and their commencement dates. Data-flow mapping and interviews expose gaps between systems and written policies. The work plan separates changes to implement, decisions needing legal review and procedures to test before they are relied on.
What you receive
Data-handling map
Processing activities, systems, processors and responsible teams within scope.
Readiness assessment
Gaps linked to relevant requirements, dependencies and commencement considerations.
Implementation and evidence plan
Agreed changes to workflows and safeguards, with owners and records for ongoing review.
Are all DPDP requirements already in force?
The Act and the Digital Personal Data Protection Rules, 2025 have phased commencement arrangements. We check the provisions relevant to the engagement and distinguish obligations already operative from preparation for later commencement.
Can our GDPR work be reused?
Data maps, security controls and request processes may provide a useful starting point. India's requirements and terminology differ, so existing GDPR work needs to be reviewed rather than assumed sufficient.
Can you implement changes as well as assess gaps?
Yes. The scope can include technical and operational implementation. Legal interpretations and statutory responsibility remain with the appropriate advisers and your organisation.
What needs to change before your processes are ready?
Share how you collect and use digital personal data, the systems involved and any preparation already underway.
Related services: GDPR and Identity & Access Management.