India Digital Personal Data Protection Act · Enforcement 13 May 2027

Your product collects data. The law is about to audit how.

India's DPDP Rules are live. Most products have compliance gaps across consent, user rights, retention, and breach handling. We audit your product and implement the fixes before enforcement begins.

₹250 Cr

MAX PENALTY ·

SECURITY SAFEGUARDS

₹200 Cr

MAX PENALTY · BREACH

NOTIFICATION

13 May 2027

FULL ENFORCEMENT

DEADLINE

Source: DPDP Act 2023, Schedule. Data Protection Board of India.

Check your compliance score

Inadequate security safeguards₹250 Cr//Failure to notify breach₹200 Cr//Children's data violations₹200 Cr//Non-compliance with DPDP Rules₹50 Cr//Enforcement begins13 May 2027//Penalty powers activate13 May 2027//Maximum single penalty₹250 Cr//Consent must be explicit and revocableSection 6//Data principal rights: access, correction, erasureSection 12-14//Breach notification window72 hours//Inadequate security safeguards₹250 Cr//Failure to notify breach₹200 Cr//Children's data violations₹200 Cr//Non-compliance with DPDP Rules₹50 Cr//Enforcement begins13 May 2027//Penalty powers activate13 May 2027//Maximum single penalty₹250 Cr//Consent must be explicit and revocableSection 6//Data principal rights: access, correction, erasureSection 12-14//Breach notification window72 hours//

A privacy policy is not compliance.

Most legacy consent is already invalid under DPDP's verifiable-consent standard. Pre-ticked boxes and buried opt-ins won't pass muster. The law requires clear, explicit, and revocable consent, and it must be technically auditable.

The obligations are engineering problems, not legal problems. Consent flows, rights portals, and breach detection are code, not documents. A privacy policy tells users what you do. Compliance means building the systems that prove you do it.

The enforcement window is real and closing. Full enforcement begins 13 May 2027. The Data Protection Board is live. Penalties are not theoretical; they are enumerated in the statute.

Time remainingThe deadline is fixed. Every sprint cycle you don't spend on DPDP is a sprint cycle you'll need under pressure in 2026.

"We don't hand you a checklist. We ship the fix into your product."

Audit

Map every point where personal data is collected, processed, stored, or shared. Identify gaps against DPDP Rules 2025 and prioritise them by regulatory risk.

Gap Report

A scored compliance report showing: Regulatory obligation, Risk severity, Affected systems, Recommended remediation, Engineering effort

Engineering Sprint

Consent flows, withdrawal mechanisms, rights request workflows, breach response systems, and compliance controls implemented directly into your product.

Evidence Pack

Audit-ready documentation, implementation records, policies, and evidence required during regulatory review.

Three tiers. Fixed scope. No surprises.

Every tier is a defined deliverable, not an open-ended retainer. Pricing is shared on the discovery call.

Audit

Discover what needs fixing

Data flow mapping
Gap analysis report against DPDP Rules 2025
Prioritised fix roadmap
One readout session

MOST CHOSEN

Compliance Sprint

Audit + implementation

Everything in Audit
Consent flow built and shipped
DPDP-compliant privacy notice and T&Cs
Data principal rights portal
Breach notification runbook
Retention and erasure automation
30 days post-launch support

Enterprise

Multi-product or multi-entity

Everything in Sprint
Multi-product or multi-entity scope
Significant Data Fiduciary readiness check
DPO handoff documentation
Optional ongoing retainer

Pricing shared on the discovery call. The Audit tier is the natural first step; it scopes the Sprint.

How we're different

Most DPDP providers stop before implementation.

DPDP is enforced against what your product does, not what your documents say.

Requirement	Legal Advisor	Audit Provider	GetDpdpCompliant.com
Explain DPDP obligations	✓	✓	✓
Review policies and notices	✓	Partial	✓
Audit product data flows	✗	✓	✓
Identify technical gaps	✗	Partial	✓
Design consent architecture	✗	Partial	✓
Build rights-request workflows	✗	✗	✓
Implement compliance controls	✗	✗	✓
Ship changes into production	✗	✗	✓
Create audit evidence pack	Partial	Partial	✓

Most providers can tell you what DPDP requires. Some can identify where you're exposed. Very few can implement the systems required to comply.

DPDP is ultimately enforced against what your product does, not what your documents say.

That's why we focus on the implementation layer: consent systems, rights management, retention controls, breach workflows, and audit evidence.

Built by the team behind Smoketrees Digital, a product engineering company that has spent years implementing analytics, consent systems, customer data infrastructure, and workflow automation for digital businesses.

See exactly what we build →Book a DPDP Review

Scope check

Are you likely covered by DPDP?

If you checked even two of these boxes, there is a strong chance your product has DPDP obligations.

Check your readiness score →

Your business probably qualifies if it:

✓Collects user registrations

✓Uses analytics tools

✓Stores customer information

✓Sends marketing emails

✓Uses CRM systems

✓Runs a mobile app

✓Accepts online payments

✓Tracks user behaviour

✓Uses third-party SaaS tools

✓Processes personal data of Indian residents

Built for product companies.

Typically hired by

FoundersCTOsProduct LeadersCompliance TeamsEngineering Leads

Sensitive data + long sharing chains

Health Insurance

SDF Risk

Your TPA sees everything. So does the regulator.

Health insurers process diagnoses, prescriptions, and claims across a chain of processors — TPAs, hospitals, wellness partners, analytics vendors. Every link needs a contract. Every consent needs to be verifiable. We build the infrastructure that makes that possible.

Key obligations

Verifiable consent for sensitive health data

Data processing agreements with TPAs and processors

Breach notification within 72 hours

Retention limits on claims and medical records

Penalty exposure

Up to ₹250 crore

See full guide →

KYC, account aggregators, credit data

Fintech and Lending

SDF Risk

Financial data flows need consent at every step.

NBFCs, lending platforms, and wealth apps process KYC, account-aggregator feeds, and credit history. Consent chains are long. Purpose limitation is strict. And RBI scrutiny amplifies DPDP exposure. We map every data flow and build consent and rights infrastructure that holds up.

Key obligations

Purpose-limited consent for KYC and credit data

Account aggregator compliance alignment

Data principal rights portal for customers

Processor contracts with DSPs, bureaus, and analytics partners

Penalty exposure

Up to ₹250 crore

See full guide →

Children's data — highest protection tier

EdTech and LMS

If your platform has learners under 18, the stakes are different.

DPDP gives children's data its own protection tier: verifiable parental consent, no behavioural tracking, no targeted advertising. Most edtechs are nowhere near compliant on this. We build the consent verification flows, parental rights portal, and tracking guardrails that the statute requires.

Key obligations

Verifiable parental consent for users under 18

No behavioural tracking or profiling of minors

No targeted advertising to children

Age verification mechanism

Penalty exposure

Up to ₹200 crore per violation

See full guide →

Customer PII, payment data, marketing consent

E-commerce and D2C

Checkout consent is not marketing consent.

D2C brands collect customer data at checkout, then use it for remarketing, segmentation, and analytics. Those are different purposes and DPDP requires separate, specific consent for each. We untangle your consent flows, update your privacy notices, and build the rights portal your customers can actually use.

Key obligations

Purpose-specific consent at checkout and post-purchase

Marketing opt-in separated from transactional consent

Data deletion and correction request handling

Third-party marketing vendor agreements

Penalty exposure

Up to ₹250 crore

See full guide →

Employee data across multiple client organisations

HR Tech and Payroll

You process employee data for dozens of companies. Each one is your liability.

HR platforms, payroll processors, and staffing tools act as Data Processors for their clients — who are the Fiduciaries. That means airtight data processing agreements, strict purpose limitation, and breach response procedures that cover every client. We build the infrastructure and documentation that makes that viable at scale.

Key obligations

Data processing agreements for every client

Purpose limitation on employee personal data

Breach notification runbook covering sub-processors

Retention and erasure automation post-offboarding

Penalty exposure

Up to ₹250 crore

See full guide →

Buyer KYC, financial data, broker sharing chains

Real Estate and Proptech

Lead databases shared across brokers and lenders are a compliance liability.

Real estate platforms collect KYC, financial details, and location preferences, then share them across broker networks and lending partners. Under DPDP, every handoff needs a lawful basis and a contract. We map your data flows and build the agreements and consent infrastructure that cover your entire distribution chain.

Key obligations

Lawful basis for lead data sharing with brokers

Processor contracts with lending and valuation partners

Data principal rights for buyers and sellers

Retention limits on stale lead data

Penalty exposure

Up to ₹250 crore

See full guide →