DPDP Readiness Assessment for the DPDP Act and the 2025 Rules.

No, and nobody can issue you one. The Act created an adjudicating body — the Data Protection Board of India — not a certification scheme, and there is no accredited DPDP certifier anywhere. If a firm offers you a DPDP certificate or badge, treat it as information about the firm. What is real, and what enterprise customers and regulators respond to, is demonstrable readiness: a documented data inventory, consent and rights processes that work, a tested breach playbook and evidence you can produce on request. That is also what the Board weighs when it decides what a violation costs you.

The Rules commence in three stages from their notification on 13 November 2025. The Board’s set-up rules applied at once. Consent Manager registration starts on 13 November 2026. The core obligations — notice and consent, rights, security safeguards, children’s data, breach intimation, Significant Data Fiduciary duties and cross-border transfer — apply from 13 May 2027. A January 2026 proposal to shorten the window has not, as of our review, been notified. The practical answer is earlier: a data map takes weeks, and a breach playbook is only worth anything once rehearsed. The deadlines tracker has every date.

Less than starting from zero, more than clients expect. The security-safeguards limb is where ISO 27001 and GDPR work hardest for you, and records of processing give you a head start on the data map. What does not carry across: consent as the primary basis with no legitimate-interest fallback, plain-language notice requirements, grievance redressal and nomination, verifiable parental consent for anyone under 18, the Consent Manager framework, and breach reporting to a different regulator on a different clock. The cross-border model is inverted too: transfers are permitted unless the government restricts the destination.

Two to four weeks elapsed for a typical mid-sized organisation. From you we need six to twelve interview sessions with the people who own the systems — product, engineering, HR, marketing, support and whoever handles vendors — plus your notices, processor contracts and any retention or security documentation that exists. The bottleneck is almost always calendar access to those people, so we agree the interview list at kick-off and hold the dates.

A fixed price, quoted after a 30-minute scoping call and confirmed at kick-off. The variables are the number of entities and business units in scope and how many distinct systems process personal data, not headcount. We quote the whole engagement rather than a day rate, so the number you agree is the number you pay. Remediation, if you want our help with it, is scoped and priced separately once the gaps are known.

No. We are a security and compliance firm, not a law firm, and we are explicit about that. The assessment tells you what personal data you process, what your obligations look like operationally and where you fall short. Where a question turns on genuinely contested interpretation, we flag it and recommend you take that specific question to counsel, rather than quietly picking an answer and presenting it as settled.

You do not decide it and cannot volunteer for it. The government notifies a Data Fiduciary, or a class of them, as significant, based on the volume and sensitivity of the personal data and the risk it carries. The extra duties are substantial: a Data Protection Officer based in India, a Data Protection Impact Assessment and an audit once in every twelve months, and algorithmic due diligence. The assessment flags whether the triggers are in reach so designation does not arrive as a surprise with a build programme attached.

Two things, on two clocks, from 13 May 2027. Notify the Data Protection Board and every affected Data Principal without delay. Then file a detailed report with the Board within 72 hours of becoming aware. Failing to notify carries a maximum penalty of ₹200 crore in its own right, separate from any penalty for the security failure that caused it. The hard part is rarely the paperwork: you cannot report inside 72 hours if your logging and monitoring will not tell you inside 72 hours, so breach readiness usually starts in the detection stack.

Those are the statutory maximums in the Act’s Schedule, not typical outcomes: ₹250 crore for failing to take reasonable security safeguards, ₹200 crore for failing to notify a breach, ₹200 crore for breaching children’s-data obligations, ₹150 crore for breaching Significant Data Fiduciary duties, ₹50 crore for any other provision, and up to ₹10,000 against an individual who breaches their own duties. The Board sets the figure by weighing gravity, duration, harm and mitigation. Documented readiness is the lever you control over where in that range you land.

Usually not, but it will be a smaller engagement. The Act has no headcount exemption, and a forty-person SaaS company with Indian users has the same core obligations as a large one — notice, consent, rights, breach reporting — across fewer systems. What changes is scope and therefore price. If we think you genuinely do not need this yet, we will say so on the scoping call, because a bad-fit engagement costs us more than it earns.