DPDP compliance means meeting the duties that the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 place on every business handling digital personal data of people in India: notice and consent, security safeguards, breach reporting, individual rights and erasure. There is no turnover or headcount exemption, and most duties apply from 13 May 2027. Regi Tom Antony & Associates, Chartered Accountants in Kochi since 1997, helps businesses across India get ready online and documents the evidence.
By Regi Tom Antony, FCA, MBA (Australia), ACMA (UK), CGMA (USA), CISA (USA) · Law as at 1 November 2026
Gap assessment, data mapping, notices and consent, vendor contracts, security controls, a 72-hour breach plan and a documented evidence file, delivered online for businesses in any state.
Led by Regi Tom Antony, FCA, MBA (Australia), ACMA (UK), CGMA (USA), CISA (USA), former Data Privacy Officer at OSRAM and Westcon Group. Chartered Accountants since 1997.
The Act applies to personal data collected in digital form, or collected on paper and later digitised (s.3). It also applies outside India when goods or services are offered to people in India. One "yes" below is enough.
Most businesses answer yes to at least two. Scope: s.3 · Exemptions only by notification: s.17.
A business that decides why and how personal data is processed is a Data Fiduciary. These duties apply whatever its size; Significant Data Fiduciaries notified under s.10 carry more.
An itemised notice in clear language, in English or an Eighth Schedule language, and consent that is as easy to withdraw as to give.
Encryption or masking, access control, logs kept for at least a year, backups, and the same safeguards written into processor contracts.
Tell affected people without delay and file a detailed report with the Data Protection Board within 72 hours. CERT-In 6-hour reporting still applies.
Access, correction, erasure and nomination requests, with grievances resolved within 90 days and a published contact for data questions.
Erase data once its purpose is served, unless another law requires it to be kept. Some classes need 48 hours' notice before erasure.
Verifiable parental consent before processing data of anyone under 18; no tracking, behavioural monitoring or targeted advertising at children.
The Schedule to the Act sets maximum penalties per instance. The Data Protection Board decides the actual amount.
| Breach of | Provision | Maximum penalty |
|---|---|---|
| Failure to take reasonable security safeguards | s.8(5) | ₹250 crore |
| Failure to notify a personal data breach | s.8(6) | ₹200 crore |
| Breach of children's data obligations | s.9 | ₹200 crore |
| Breach of Significant Data Fiduciary obligations | s.10 | ₹150 crore |
| Breach of any other provision of the Act or Rules | Residual | ₹50 crore |
A privacy notice states what a business does with personal data. The Act also requires that systems, records and contracts match that notice, so a complete review covers three areas.
Each service can be taken on its own. Most SMEs start with the gap assessment and take the rest as a fixed-scope project.
Data inventory, gap report against the Act and Rules, a prioritised roadmap and a management readout.
What personal data you hold, where it sits, who can see it, which vendors receive it and how long you keep it.
Itemised notices in English and your customers' languages, form-level consent, banner settings and a withdrawal flow.
Data processing terms for payroll, CRM, cloud, BPO and marketing vendors, reviewed with our legal associates.
Access rights, encryption and masking, log retention, backups and admin console settings, tested over screen-share.
A 72-hour Board reporting playbook aligned with the CERT-In 6-hour direction, with a tabletop exercise.
Record-by-record retention periods reconciled with tax, GST, company law and labour law requirements.
Request intake, identity checks, response templates and a 90-day tracking log.
Ongoing monitoring, change reviews and an annual compliance health check.
Data protection impact assessment and preparation for the periodic independent data audit.
A clinic, a CA firm and an e-commerce brand hold very different personal data. We scope the work to the data you actually have, the systems it sits in and the vendors who touch it, rather than an enterprise template.
Regi Tom Antony served as Data Privacy Officer at OSRAM and at Westcon Group, and is a Certified Information Systems Auditor (CISA).
No government body or regulator issues a "DPDP certificate". What demonstrates compliance is documentation. We index it the way we index an audit file, so anyone reviewing it can trace each obligation to its evidence.
FCA, MBA (Australia), ACMA (UK), CGMA (USA), CISA (USA)
Data Privacy Officer at OSRAM and at Westcon Group. Former Group CFO and COO roles at OSRAM/Siemens, Westcon and Comstor across the Middle East and Africa. Information systems audit, internal controls and regulatory reporting.
Regi Tom Antony & Associates, Chartered Accountants, Kakkanad, Kochi, since 1997 · DPDP engagements delivered online for businesses in any state
24 questions across eight areas of the Act and Rules, each with its statutory reference, scored out of 48. It takes about 20 minutes and shows where to start.
If you would also like a 15-minute scoping call, choose that option and you can pick a time straight away.
Or write to us: letstalk@rtaandassociates.com