DPDP compliance, explained for Indian founders.

16 practical guides covering the Act, consent, rights, breach readiness, and sector-specific obligations. No legal jargon, no filler.

FoundationsStart here

What is the DPDP Act? A founder's guide

The Digital Personal Data Protection Act governs how companies collect, store, and use the personal data of Indian users. Almost every company holding Indian user data has obligations under it.

5 min read · 20 Jun 2026

Foundations

3 articles

Foundations

The DPDP deadline: what 13 May 2027 means and what to do now

Full enforcement of India's DPDP Act applies from 13 May 2027. Most products need several weeks of engineering work to be ready, so the time to start is now.

6 min read · 18 Jun 2026

Foundations

Why a privacy policy is not DPDP compliance

A privacy policy is a document. DPDP compliance is a set of working systems. Publishing a policy does not satisfy the DPDP Rules.

5 min read · 15 Jun 2026

Foundations

DPDP penalties explained

The DPDP Act sets financial penalties for breaches of its obligations. The highest is up to INR 250 crore for failing to maintain reasonable security safeguards.

5 min read · 12 Jun 2026

Consent

2 articles

Consent

What verifiable consent requires under DPDP

Consent must be free, specific, informed, unconditional, and unambiguous, given through a clear affirmative action. Pre-ticked boxes and bundled terms do not count.

6 min read · 10 Jun 2026

Consent

Re-consent under DPDP: is your existing consent still valid?

Most existing consent does not meet the DPDP standard. Consent collected through old sign-up forms or pre-ticked boxes fails the Act's test.

6 min read · 8 Jun 2026

Data Rights

2 articles

Data Rights

How to build a DPDP data rights portal

The DPDP Act gives users the right to access, correct, and erase their data. A compliant portal connects to live data so erasure triggers real deletion across all your systems.

7 min read · 5 Jun 2026

Data Rights

Vendor and processor liability under DPDP

You remain responsible for personal data even when a third party processes it for you. Every analytics tool, payment provider, and SaaS vendor is your liability.

6 min read · 2 Jun 2026

Breach & Security

1 article

Breach & Security

DPDP breach detection and the 72-hour rule

You must notify the Data Protection Board and affected users when a breach occurs. To do that, you first have to know a breach happened, which means detection has to be built in advance.

7 min read · 30 May 2026

Sector Guides

7 articles

Sector Guides

Children's data under DPDP

Before processing the personal data of a child, you must obtain verifiable consent from a parent or lawful guardian. Breaches involving children's data can draw penalties of up to INR 200 crore.

6 min read · 28 May 2026

Sector Guides

DPDP for D2C and e-commerce brands

D2C brands hold large volumes of customer data spread across many third-party tools. Under the DPDP Act, every one of those tools is the brand's responsibility.

6 min read · 25 May 2026

Sector Guides

DPDP for fintech and lending platforms

Fintech platforms process some of the most sensitive personal data covered by the DPDP Act. Consent must be precise and purpose-bound, and every data-sharing partner is a processor you are accountable for.

6 min read · 22 May 2026

Sector Guides

DPDP for SaaS products

SaaS products process personal data on two levels: their own users and the data their customers load into the platform. Enterprise buyers now ask for DPDP evidence in procurement.

6 min read · 20 May 2026

Sector Guides

DPDP for healthcare and clinic platforms

Healthcare platforms handle highly sensitive patient data, which raises the stakes under the DPDP Act. Security safeguards face the highest penalty tier.

6 min read · 18 May 2026

Sector Guides

The Shopify DPDP problem

A typical Shopify store runs 15 to 40 third-party apps, each receiving customer personal data, and tracking pixels that frequently fire before the customer has consented.

6 min read · 15 May 2026

Sector Guides

DPDP compliance for corporate health insurers and TPAs

A group health policy moves an employee's diagnoses, claims, and prescriptions across the employer, the insurer, and the TPA. Under the DPDP Act, each link in that chain is a separate fiduciary, and most of the work is engineering.

8 min read · 20 May 2026

Strategy

1 article

Strategy

Who should you hire for DPDP compliance?

There are five options for DPDP compliance, and each stops at a different point. A law firm gives legal advice. A consultant gives a gap report. An implementation partner builds the fixes into your product.

7 min read · 12 May 2026

Find out where your product stands.

Ten questions. Covers consent, data rights, security, and breach readiness.

Start the readiness check →