Technology and Data
DPDP Act Readiness: A Checklist for Small and Medium Businesses
By ATTPL Consultancy Marketplace Editorial Team · · 2 min read
India's data protection rules are being phased in through May 2027. Use this checklist to map data, fix consent and prepare vendors.
The timeline in brief
Reports based on the DPDP Rules notified on 13 November 2025 describe a phased rollout: a consent-manager framework is expected around 13 November 2026 and full obligations on businesses by about 13 May 2027. Confirm these dates against the MeitY notification and the Gazette.
Why start in 2026
Consent flows, data inventories, vendor contracts and breach processes take months to build. Penalties under the Act can be very large, so a late start carries real risk.
Readiness checklist
- List every place you collect personal data: forms, WhatsApp, CRM, payroll, CCTV, cookies.
- Record why you collect each item and how long you keep it.
- Rewrite notices and consent requests in clear language, in English and Hindi where relevant.
- Create a way for people to withdraw consent and request correction or erasure.
- Add data protection clauses to vendor and cloud contracts.
- Prepare a breach response plan with named owners.
- Train staff who handle customer or employee data.
Building a simple data inventory
Start with a spreadsheet listing each system or process that handles personal data, what data it holds, why you collect it, who can access it, where it is stored and how long you keep it. Include less obvious places such as WhatsApp groups, email attachments, CCTV, biometric attendance and ad platforms. This inventory becomes the foundation for notices, consent, vendor contracts and deletion schedules.
Assign an owner to every line. Data without an owner is the usual source of breaches and forgotten obligations.
Consent, notices and withdrawal
Notices should explain in plain language what data you collect, for which purpose and how a person can exercise rights or complain. Consent requests should be specific, not bundled with unrelated terms, and withdrawing consent should be as easy as giving it. Keep records showing when and how consent was obtained, so that you can demonstrate compliance if asked.
Vendors, breaches and training
Review contracts with software providers, payroll processors, marketing agencies and cloud services. Ask how they secure data, where it is hosted and how they will notify you of an incident. Prepare a breach response plan with named contacts and a template for notifying the right parties. Train staff, especially front-desk, sales and HR, since mistakes there are common.
Practical help
ATTPL Consultancy's digital transformation and compliance teams can help you inventory data, draft policies and plan technology changes without slowing the business.
Frequently asked questions
Does the DPDP Act apply to small companies?
It applies to entities that process digital personal data under its scope; certain classes may get exemptions. Check your position with counsel.
Is a privacy policy enough?
No. You also need consent, purpose limits, security safeguards and a process for people's rights.
Sources and further reading
This article is general information for businesses and is not legal, tax or financial advice. Rules and dates change, so confirm them on the official websites listed above or with a qualified professional before acting.
