.png)
The DPDP Act is being switched on in stages. The Rules were notified and the Data Protection Board was set up on 13 November 2025. The next milestone is 13 November 2026, when Consent Manager registration opens. Every remaining obligation applies from 13 May 2027.
If you hold personal data of people in India, such as worker records, biometric attendance, or customer and vendor contacts, the Act applies to you. Penalties go up to ₹250 crore.
What to do in the next six months
- Map the personal data you hold. Where it comes from, where it is stored, who can see it and which vendors hold a copy.
- Write clear notices. Tell people what you collect and why, in plain language, before you collect it.
- Record consent properly. Keep a record of who agreed to what, and make it as easy to withdraw as it was to give.
- Set retention periods. Decide how long each kind of data is kept, and delete it when that time is up.
- Plan for a breach. Know who decides, who reports to the Board, and what you tell the people affected.
- Check your vendors. Payroll, ERP, cloud hosting and CRM providers all handle your data. Their contracts should say how they protect it.
Where to start
Start with the data map. Everything else depends on knowing what you hold. If you’d like help, our DPDP compliance service covers the data inventory, consent and notice templates and a breach playbook, and VaultorNet Vero keeps the records in one place.