Be ready for India's DPDP Act, and able to show it.
India's DPDP Act and Rules change how every organisation collects, uses and protects personal data. Fideliora helps you understand what applies to you, put the right steps in place and keep them working.
We start with the DPDP Act, and add GDPR, ISO/IEC 27701 and sector rules where your customers, staff or contracts need them.
- Data mapping and records
- Notices and consent
- Breach response and training
Consent done right, from the first notice to the last record
How personal data should be handled under the DPDP Act, in four steps. We help you build each one into your own forms, apps and processes.
A clear notice
People see in plain words what personal data you collect and why, and how they can withdraw consent, raise a complaint or go to the Data Protection Board.
A real choice
Consent is free and specific, given by a clear action for each purpose, and just as easy to refuse.
Used only for that purpose
The data is used for what people agreed to, kept secure, and erased when it is no longer needed and no law requires you to keep it.
Rights honoured, with records
People can withdraw consent as easily as they gave it, and ask to see, correct or erase their data. Your records show each request was handled.
The DPDP Act at a glance
India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 set out how organisations must handle personal data. These are the main points.
Who it covers
Personal data in digital form, including paper records that are later digitised, processed in India. It also covers processing outside India when it is for offering goods or services to people in India.
What you must do
- Give a clear notice before asking for consent, in English or any of the 22 languages of the Eighth Schedule.
- Ask for consent that is free, specific and as easy to withdraw as to give.
- Keep personal data secure and accurate, and delete it when it is no longer needed.
- Report personal data breaches to the Data Protection Board and to the people affected.
Rights you must support
People can ask for a summary of their data, have it corrected, completed, updated or erased, raise a complaint and name someone to act for them. You need a simple way to receive and answer these requests.
Children's data
For anyone under 18, you need verifiable consent from a parent or guardian. Tracking, behavioural monitoring and targeted advertising aimed at children are not allowed, with limited exemptions under the Rules.
Significant Data Fiduciaries
The government can name organisations that handle large volumes of data or sensitive data as Significant Data Fiduciaries. They must appoint a Data Protection Officer based in India and an independent data auditor, and carry out an impact assessment and an audit every year.
What is at stake
The Data Protection Board can impose penalties of up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore each for failing to report a breach or to meet the duties on children's data.
Key dates
- 13 Nov 2025DPDP Rules notified; the rules on the Data Protection Board take effect.
- 13 Nov 2026Consent Managers can register with the Data Protection Board.
- May 2027Most duties apply, including notices, security, breach reporting, children's data and people's rights.
A short summary to help you plan. In January 2026 the government was reported to be considering an earlier date for some duties, mainly for Significant Data Fiduciaries; no change has been notified. Your legal counsel, or an independent advocate you engage, confirms how the Act applies to you, and we work alongside them.
Putting the DPDP Act into practice
Meeting the DPDP Act means knowing how personal data is collected, used, stored, shared, kept and protected across your organisation, and being able to show it.
Fideliora supports organisations through a structured implementation approach covering assessment, personal data mapping, privacy documentation, consent and rights workflows, vendor review, breach readiness, privacy training and governance support.
What our DPDP Act work covers
Assessment and mapping
- DPDPA applicability review.
- Personal data mapping.
- Privacy gap assessment.
- Systems, vendors, access, sharing and retention review.
Documentation and workflows
- Privacy notices and consent workflows.
- Data Principal rights handling.
- Grievance redressal workflow.
- Privacy officer advisory support, where applicable.
Governance readiness
- Vendor and Data Processor review.
- Data retention and deletion governance.
- Personal data breach response readiness.
- Significant Data Fiduciary readiness, where applicable.
Training and support
- Privacy governance framework.
- Privacy awareness and DPDPA training sessions, scoped per engagement.
- Scoped privacy advisory support, where required.
- Management review, action tracking and maturity improvement.
How ready are you? A two-minute check
Tick each statement that is true for your organisation today.
What privacy means in your sector
The Act covers any organisation that handles personal data of customers, staff, students, patients or users, including data in websites, apps, CRM, HR and payroll, cloud and payment tools. Here is what it often involves.
Banking, NBFC and fintech
Typical data: KYC records, account and transaction details, credit information.
Focus: consent for each purpose, vendor and processor controls, and fitting DPDP work with sector rules.
Healthcare and diagnostics
Typical data: patient records, test reports, health insurance details.
Focus: strong security safeguards, tight access control and clear notices for patients.
Education and edtech
Typical data: student records, parent contacts, learning and assessment data.
Focus: verifiable parental consent for children, and no tracking or targeted advertising aimed at them.
E-commerce and retail
Typical data: customer accounts, addresses, order and payment details, marketing preferences.
Focus: consent for marketing, cookie choices, and easy ways to withdraw consent or delete an account.
IT, SaaS and BPO
Typical data: client data you process on their behalf, plus your own staff data.
Focus: processor contracts, security controls, and helping clients with requests and breaches.
HR and staffing
Typical data: resumes, employee records, payroll and background checks.
Focus: notices for candidates and staff, limits on how long resumes are kept, and secure sharing with clients.
Manufacturing
Typical data: employee and contractor records, visitor logs, CCTV footage.
Focus: notices at entry points, retention rules for footage and logs, and supplier contracts.
Hospitality and travel
Typical data: guest ID copies, booking and payment details, travel preferences.
Focus: keeping ID copies secure and deleting them on time, and contracts with partners and booking platforms.
Examples only; the work depends on your organisation. Sector regulators such as RBI, SEBI or IRDAI may add their own rules, which we review with your legal counsel or an independent advocate you engage.
Beyond the DPDP Act
Many organisations also serve customers abroad, follow sector rules or want a recognised privacy standard. These services can be added to a DPDPA engagement or requested on their own, scoped per engagement.
Privacy laws outside India
- Gap review and documentation support against the EU GDPR and the UK GDPR, for organisations with customers, users or staff in Europe or the UK.
- Other countries' privacy laws reviewed on request, with your local legal counsel where needed.
- Review of personal data sent outside India and the safeguards in place.
Standards and sector rules
- ISO/IEC 27701 privacy information management readiness, on its own or alongside ISO/IEC 27001 (see ISO Standards and Frameworks).
- Breach response readiness that also covers CERT-In cyber incident reporting.
- Sector requirements, such as those of RBI, SEBI or IRDAI, identified and reviewed with your legal counsel or an independent advocate you engage.
Privacy assessments and records
- Data protection impact assessments for higher-risk processing.
- Records of processing activities.
- Periodic privacy reviews and data audit readiness, where applicable.
Websites, apps and products
- Cookie and consent setup review for websites and mobile apps.
- Children's personal data and parental consent workflows, where applicable.
- Privacy by design reviews for new apps, products and features.
- Consent Manager readiness, where applicable.
How we deliver, step by step
Proposal Intake
We begin by reviewing the proposal request submitted through the website, email or direct communication.
Assessment
We review current privacy practices, documents, workflows, responsibilities, systems and gaps.
Data Mapping
We help map personal data categories, collection points, purposes, systems, access, sharing, vendors and retention practices.
Documentation and Workflow Design
We support privacy notices, consent workflows, rights-handling processes, grievance workflows, breach response processes, vendor review processes and privacy governance documentation.
Implementation Support
We support practical implementation through trackers, registers, templates, responsibilities, review mechanisms and management reporting.
Training and Review
We run privacy awareness and DPDPA training sessions, scoped per engagement, then support management review, action tracking and privacy governance where required.
Ways to work with us
Choose the option that fits where you are today. The proposal confirms the scope.
Assessment
Applicability review, data mapping and gap assessment, ending with a prioritised action plan.
Implementation project
From assessment through documentation, workflows, registers and training, with a defined end.
Ongoing support
Periodic reviews, help with rights requests and breach readiness, refresher training and management reporting.
Training only
Privacy awareness and DPDPA sessions for all staff, managers or teams such as HR, IT and customer support.
What you receive
Depending on the scope, an engagement can include:
- Personal data inventory and data map.
- Gap assessment report with a prioritised action plan.
- Draft privacy notices and consent text, for review by your legal counsel.
- Data Principal rights and grievance procedures.
- Data retention and deletion schedule.
- Personal data breach response procedure.
- Vendor and Data Processor review checklist.
- Registers and trackers for ongoing governance.
- Training sessions with attendance records.
- Management review reports.
Typical outcomes
Depending on the scope, you know what personal data you hold and why; people get clear notices and real choices; requests and complaints are handled on time; vendors are held to the same standard; your team knows what to do in a breach; and staff understand their part.
Frequently asked questions
Does the DPDP Act apply to our organisation?
The Act covers digital personal data processed in India, and processing outside India connected with offering goods or services to people in India. We start with an applicability review; your legal counsel confirms how the Act applies to you.
Does the DPDP Act apply to small businesses?
Yes. The Act has no size threshold. The government may exempt some organisations, such as startups, from certain duties by notification. Your counsel can confirm which duties apply to you.
What is a Consent Manager?
A company registered with the Data Protection Board that gives people one place to give, review and withdraw consent across organisations. Registration opens on 13 November 2026. We can help you prepare for consent that arrives through one.
We also have customers in Europe or the UK. Can you help?
Yes. GDPR and UK GDPR support can be added to a DPDPA engagement, so one set of records and procedures serves both where possible.
How do you work with our lawyers?
We provide advisory, implementation, documentation, training and governance support, and work alongside your legal counsel, who handles legal interpretation. You get clear evidence of where you stand and what to do next.
How long does an engagement take?
It depends on your size, systems and starting point. The proposal sets out the timeline after we review your request.
Can you train our staff?
Yes. Sessions are scoped per engagement, for all staff, managers or specific teams.
What do you need from us for a proposal?
The proposal request form asks about your organisation and what you need. When you tick Data Privacy and Protection, it adds a few short optional questions about where your customers, users or staff are, the personal data you handle, your systems and vendors, where you stand today and training.
How we prepare your proposal
To prepare a suitable proposal, we review what you tell us in the proposal request form: what you need and when you would like to start, your organisation's size and country, the countries where your customers, users or staff are, the kinds of personal data you handle, about how many systems or apps hold personal data, about how many vendors or processors handle it, where you stand today and about how many people need privacy training.
Based on the submitted information and any required clarifications, we prepare a proposal covering the proposed scope, deliverables, timeline, manpower involvement, assumptions, dependencies, pricing and next steps.
Opens the Contact Us page and its proposal request form.