The DPDP Compliance Handbook

What's inside

• What is the DPDP Act? — what it covers and the new Data Protection Board of India.
• Who must comply — every business in India, foreign companies handling Indian residents' data, sensitive sectors, and Significant Data Fiduciaries.
• Key Obligations & Enforcement Timeline — every major obligation mapped to its section and maximum penalty, plus the dates that matter.
• The 15 Domains We Assess — a map of everything the full self-assessment covers, domain by domain.
• Penalty Quick Reference — what non-compliance can actually cost, by violation category, and how the Board decides where within each ceiling a penalty lands.
• Applicability Flowcharts — does the DPDP Act apply to your organisation, and could you be treated as a Significant Data Fiduciary?
• Breach Response Runbook — the litmus test, escalation path, and 72-hour timeline for handling a personal data breach under Rule 7.
• Retention & Erasure Schedule — when DPDP requires erasure, cross-referenced against the Income Tax Act, CGST Act, and Companies Act.

Reference tool, not legal advice — for a binding view on your specific obligations, consult qualified legal counsel.