How do I comply with the DPDP Act? (first steps for a business)

1. Map your data: what personal data you collect, why, where it is stored and who gets it.
2. Update notices and consent: clear, simple notice and a consent request in English or an Eighth Schedule language, with an easy way to withdraw.
3. Secure the data: encryption, access control, logging, backups, vendor contracts with processors.
4. Prepare for breaches: an incident plan to inform the Board and affected people and report within 72 hours.
5. Set up rights handling: a grievance contact and process to answer access, correction and erasure requests.
6. Delete data that is no longer needed, and get verifiable parental consent for children's data.
7. Check whether you may be notified as a Significant Data Fiduciary.

The main obligations apply from 13 May 2027.