What is in force on October 2, 2026?
The DPDP Act and final Rules use phased commencement. The November 2025 notifications brought institutional provisions into operation immediately, with another tranche after one year and the core processing duties and rights after eighteen months. The Rules were finalized in November 2025; the January 2025 version was a draft. Do not tell customers that all DPDP duties are already operative in October 2026. Check the Act commencement notification and final Rules for the provision relevant to a request.
Start with the actual data flow
For each feature, record the data collected, purpose, responsible party, processor, location, access permissions and retention. Separate DevBrows-style business inquiries from personal data handled on a customer’s instructions. Include logs, support tools, backups, AI model providers and retrieval stores.
A useful enterprise evidence pack connects a statement to a real control: an access policy to an access review; a retention statement to deletion behavior; and a consent statement to a retrievable record. Avoid claiming a statutory officer, registered Consent Manager, certification or production safeguard that has not been established.
Prepare notice, choices and rights workflows
Use clear notices at collection. Separate a requested sales response from optional analytics or marketing. Make withdrawal accessible and route privacy requests to an accountable owner. Record verification, actions, permitted exceptions and completion. A website checkbox is not a registered Consent Manager, and a notice cannot replace operational fulfillment of a request.
Plan for the applicable DPDP duties and language options against their commencement dates. Do not import GDPR’s legitimate-interest basis into an Indian workflow without checking the legal grounds available under Indian law.
Security and incident reporting are separate workstreams
Readiness work should cover identity, authorization, tenant isolation, backups, logging and incident ownership. The DPDP timeline does not suspend existing obligations, including applicable CERT-In directions. A single “72-hour rule” is an inadequate incident plan: different events and authorities have different triggers. See our CERT-In reporting and logging guide.
Transfers need a scoped review
Identify where data is processed and accessed, including subprocessors and model providers. Assess the current transfer provisions, any government restrictions and sector/customer requirements. Avoid presenting an India cloud region as proof of compliance: administrative access, email, telemetry and backup locations can create additional flows.
Turn a questionnaire into a realistic action plan
List which requirements are current law, future readiness work or contractual requests. Give the buyer evidence, an owner and a delivery date for each gap. Do not answer “yes” to a control because a policy template mentions it.
The Security Gate Sprint · $2,250 reviews one agreed enterprise request and produces an evidence and remediation plan. Technical validation is a separate SaaS Pentest or AI Application & Agent Security Assessment. Legal applicability should be confirmed with qualified counsel for the actual processing.