DPDPA for Operating Enterprises: A 90-Day Compliance Roadmap
With the DPDP Rules notified and phased obligations now landing on operating enterprises, DPDPA compliance has moved from legal memo to engineering program. Penalties scale to ₹250 crore per instance for security failures, and the Data Protection Board is operational. The good news: for a typical enterprise, a defensible baseline is a 90-day program, if it's sequenced correctly.
Days 1–30: Know your data
Everything downstream fails without an honest inventory. Map every system holding digital personal data; classify by purpose; identify cross-border flows and processors. Two outputs matter: a record of processing (what, why, where, how long) and a gap register ranked by exposure. Most organizations discover their largest liability in this phase, shadow spreadsheets, stale CRM exports, and vendor integrations nobody owns.
Days 31–60: Consent and notice architecture
DPDPA's consent standard is strict: free, specific, informed, unconditional, and unambiguous, with a notice in clear language (and available in Eighth Schedule languages). Practically: rebuild collection points with itemized purposes; implement consent records that survive audit; stand up withdrawal that is as easy as the grant; and paper your processor contracts with DPDPA-grade clauses. Legacy data collected under old consents needs a remediation decision, notice-and-continue or purge.
Days 61–90: Rights, breach, and proof
- Data-principal rights workflows, access, correction, erasure, grievance, with defined SLAs and an owner. A shared inbox is not a workflow.
- Breach-notification runbook, DPDPA requires notifying both the Board and affected data principals. Pre-draft both templates; wire detection to the runbook; drill it once before the 90 days end.
- Significant Data Fiduciary check, if you may be designated an SDF, begin DPO appointment, data-audit, and DPIA planning now rather than after designation.
- Evidence pack, policies, records, consent logs, and drill results assembled so compliance is demonstrable, not asserted.