India's DPDP Act: Your Checklist Before the May 2027 Deadline

India now has its first comprehensive data privacy framework. The Digital Personal Data Protection (DPDP) Act was passed in 2023, and the DPDP Rules that put it into practice were notified in November 2025. That started an 18-month countdown.

By 13 May 2027, covered businesses must comply with the Act and the Rules in full. With roughly seven months left, the window for planning is closing. Most of the work is not legal paperwork. It's changing how your systems collect, store, share and delete personal data.

The timeline at a glance

Who it applies to

The DPDP Act applies to organizations that process digital personal data in India, and to those outside India that process data of people in India while offering them goods or services. In the law's terms, the business deciding how data is used is a Data Fiduciary, and any vendor processing data on its behalf is a Data Processor. Compliance responsibility rests with the Data Fiduciary, even when a vendor does the processing.

One important point for global companies: being GDPR-compliant does not automatically make you DPDP-compliant. India's law has its own definitions, consent rules and obligations.

Your eight-step checklist

1. Map your personal data. List every system that holds personal data: ERP, CRM, HR, payroll, websites, mobile apps, marketing tools and spreadsheets. Note what data each holds, why, and where it flows.
2. Fix your consent flows. DPDP is largely consent-led. Consent must be clear, specific and as easy to withdraw as to give. Review every web form, app sign-up and customer touchpoint.
3. Rewrite your privacy notices. Notices must explain in plain language what you collect and why. Each should stand on its own, not be buried in general terms and conditions.
4. Set retention and deletion rules. Keep personal data only as long as you need it. Build automated deletion into your systems rather than relying on manual cleanups.
5. Strengthen security safeguards. Encryption, access controls, logging and monitoring are expected. Failing to take reasonable security safeguards carries the heaviest penalties under the Act, up to ₹250 crore.
6. Prepare for breach reporting. You'll need to notify the Data Protection Board and affected individuals of a personal data breach. Test your incident response plan now.
7. Update vendor contracts. The Rules require appropriate security provisions in agreements with Data Processors. Review contracts with cloud providers, IT vendors and outsourcing partners.
8. Handle data subject requests. People can ask to access, correct or erase their data. Your systems need a reliable way to find a person's data and act on these requests.

Where IT systems make or break compliance

Most of this checklist depends on technology. Consent records have to be stored and linked to the data they cover. Deletion rules have to run inside your ERP and CRM, not just in a policy document. Access requests require you to find a person's data across every system you run.

That's why compliance projects often turn into data projects. Organizations with scattered, duplicated customer records find DPDP far harder than those with clean master data and well-documented integrations.

Don't wait for May 2027

It's tempting to treat the deadline as the starting gun. But changing consent flows, retention rules and integrations across several systems takes months, and testing takes more. Start with the data map, since every other step depends on it.

This article is general information, not legal advice. Consult a qualified legal advisor on how the DPDP Act applies to your organization.

How QCSTech can help

QCSTech helps businesses map personal data across ERP, CRM and custom applications, build consent and retention controls into their systems, and secure the integrations between them.

Reach out to start your DPDP technology readiness review.