The DPDP Act: a practical first 90 days

The dates that matter

• 13 November 2025: Rules notified.
• About 13 November 2026: Consent Manager provisions apply.
• About 13 May 2027: most Data Fiduciary duties apply, as notified.

Check for amendments before you plan around these. If you start in October 2026, that leaves roughly seven months until most duties apply. It sounds like plenty. It is not much once you see how long it takes to find every place personal data lives, fix the systems that collect it and change habits across sales, HR and support.

Days 1 to 30: understand what you hold

1. Name one owner for the programme and a small working group from legal, IT, security and operations. A committee with no owner will meet and not decide.
2. Build a personal data inventory: what data, about whom, for what purpose, in which systems, shared with which vendors. Include the unofficial places, such as the Excel sheet of customer phone numbers on a sales manager's laptop and the WhatsApp groups used for deliveries.
3. Check whether you could be notified as a Significant Data Fiduciary, which brings extra duties.
4. List every point where you collect personal data: website forms, apps, call centres, branches, walk-in registers and job applications.

Days 31 to 60: close the biggest gaps

1. Rewrite notices so each purpose is clear, specific and in plain language. Offer them in the languages your customers actually read, such as Hindi or Gujarati, as well as English.
2. Fix consent: separate consent for separate purposes, and a way to withdraw that is as easy as giving it.
3. Set up a process for access, correction, erasure and grievance requests, with timelines and someone accountable for meeting them.
4. Review vendor contracts for data processing terms. Your payroll provider and your CRM vendor both count.
5. Draft a breach response plan with clear roles, covering notice to the Data Protection Board and to the people affected.

Days 61 to 90: make it routine

1. Set retention periods and start deleting data you no longer need. This is often the hardest conversation, because "we might need it someday" is a strong habit.
2. Run a breach drill, even a one hour tabletop exercise.
3. Train the staff who handle personal data, starting with sales, support and HR.
4. Put compliance work into a system with tasks, owners and evidence, so an audit does not depend on who remembers what.

Where TrustOS fits

TrustOS, our DPDP compliance platform, keeps the inventory, notices, consent, rights requests, breach response and audit evidence in one place, and turns each obligation into work assigned to a named person. It is a tool that supports these decisions. Those decisions still need your people and, where needed, your legal team.

Start with a quick check

Our DPDP Readiness Check takes a few minutes and gives you a first view of where you stand.