Can you help us get compliant with the DPDP Act?
Key takeaways
- DPDP Act 2023 compliance projects at AAVETech are fixed-fee and typically run 8 to 16 weeks depending on data volume and system count.
- Rule 7 notification obligations under the DPDP Rules commence from May 2027, which is the single most important date on an Indian compliance plan.
- 83% of Indian organisations have not begun comprehensive DPDP implementation, so starting early is a competitive advantage in tenders and vendor reviews.
- The Act requires a Data Protection Board, a data fiduciary, consent with notice, and a grievance redressal process that is visible to customers.
- Breach notification under the DPDP Rules runs to affected individuals and the Data Protection Board, and it sits alongside CERT-In's separate six-hour clock.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What does DPDP compliance actually require?
The Digital Personal Data Protection Act 2023 applies to any company processing personal data of individuals in India, and it obliges you to act as a data fiduciary in a defined way. In practice that means a maintained inventory of what personal data you hold and why, a clear notice and consent mechanism at collection, a grievance redressal process that a customer can actually reach, a defined retention and deletion schedule, security controls appropriate to the data, and a written breach response procedure. The obligations for a data fiduciary of personal data, including children's data and information on bodily or health identifiers, are stricter than the general regime. Most Indian firms' first real task is the data inventory, because nobody can comply with data they have not found.
What is the May 2027 deadline everyone is working towards?
Rule 7 of the Digital Personal Data Protection Rules sets the notification obligations, and they commence from May 2027. That is the date on which the breach-notification duty becomes live, and it is the date that should drive the plan, because it is a fixed external deadline rather than a self-assessed improvement. Note that it sits alongside, and does not replace, CERT-In's own six-hour reporting requirement for listed incidents, and the two timelines are different: CERT-In's is measured from when you noticed or were brought to notice of the incident, and it goes to incident@cert-in.org.in or 1800-11-4949. Build both into the same runbook rather than treating them as alternatives.
How long does a DPDP compliance project take?
Eight to sixteen weeks for a typical Indian company, and the length is driven by three things. The data inventory, because until you know what you hold you cannot build the notice, the retention schedule or the processor contracts. The processor and vendor contracts, because every third party that touches personal data needs written terms, and getting 40 vendor signatures takes calendar time you do not control. And the consent and notice redesign, which touches the product, the website and the customer communications. A company that starts with a data inventory and an evidence-collection routine can compress the later phases substantially.
Will a technical assessment be enough, or do we need legal advice?
You need both, and it is worth being clear about the split. A security firm can assess your controls, test your systems, verify logging and retention, and evidence your technical safeguards, which is the part that is objective and auditable. The lawful-basis analysis, the notice wording, the consent design for children and the processing of sensitive health and financial data sit with a lawyer, and under the Act the accountability sits with the board of the data fiduciary. The practical sequencing is to run the technical gap analysis and the legal review in parallel, so the legal team is not waiting on a list of what systems exist before they can advise.
| Workstream | Key deliverable | Indicative duration | Owner |
|---|---|---|---|
| Data inventory and classification | Register of personal data, purposes and systems | 2-4 weeks | Client and AAVETech |
| Notice and consent redesign | Privacy notice, consent capture, preference handling | 3-5 weeks | Client legal and product |
| Processor and vendor contracts | Signed data processing terms with each third party | 3-6 weeks | Client legal |
| Retention and deletion schedule | Documented retention periods with deletion jobs | 2-3 weeks | Client engineering |
| Technical control assessment | Findings report against DPDP security safeguards | 2-4 weeks | AAVETech |
| Breach notification runbook | Procedure covering the May 2027 Rule 7 obligations | 1-2 weeks | Both, with CERT-In clock |
What are the frequently asked questions?
Get a straight answer on this
Book a 30-minute scoping call and bring your list of systems and vendors that touch personal data, and we will return a fixed-fee compliance plan with a May 2027 working-back schedule.
Send us the details See pricing