Commencement matters: the Digital Personal Data Protection Rules, 2025 use phased commencement. Not every operational provision took effect on the notification date. The applicable commencement position must be checked when advice or implementation is given.
DPDP Readiness for Kolkata Businesses: Eight-Step Review
- Build a data inventory. List customer, employee, applicant, vendor, visitor and digital-service data, including where it enters and where it is stored.
- Identify roles and purposes. Record which entity decides why and how data is processed and which vendors act on instructions.
- Review collection notices. Compare website forms, apps, contracts, HR forms and offline collection against the real purpose and contact channel.
- Examine consent and other statutory conditions. Do not assume one website checkbox covers every processing activity.
- Review processors and contracts. Map hosting, CRM, payroll, analytics, communications, support and other vendors; allocate security, assistance, deletion and incident duties.
- Test safeguards and incidents. Align legal responsibility with access controls, backups, logs, escalation, investigation and communication.
- Design rights and grievance handling. Route requests to a responsible team, verify identity appropriately and retain an auditable response trail.
- Set retention and deletion rules. Connect retention to purpose, legal obligations, disputes and system capability rather than retaining everything indefinitely.
Records to collect for the review
- data-flow maps and system or spreadsheet inventories;
- privacy notices, consent wording and customer or employee forms;
- website, app, recruitment and marketing collection points;
- processor, SaaS, cloud, payroll and support contracts;
- information-security, access, backup and incident procedures;
- retention schedules, deletion workflows and legal-hold practices; and
- grievance records, responsibility matrix and training material.
Contract review is part of privacy readiness
A privacy policy alone does not allocate operational responsibility. Vendor and customer contracts should reflect the real data flow, security expectations, permitted instructions, incident cooperation, subcontracting, return or deletion and exit assistance. The drafting should remain consistent with the Act, notified Rules and the commencement provisions actually in force.
Frequently asked questions
Are all DPDP Rules already operational?
No blanket assumption should be made. The 2025 notification provides different commencement dates for different rules, so the current legal position must be verified.Is a privacy policy enough?
No. Readiness also involves actual collection practices, notices, vendors, safeguards, incident handling, request workflows and retention.Does the law apply only to technology companies?
Businesses in many sectors handle digital personal data. Applicability and duties depend on the actual processing and statutory framework, not the company’s label.Should every record be deleted immediately?
Retention and erasure require a reasoned schedule that considers purpose, statutory obligations, disputes and technical implementation.Can a legal review certify compliance?
A review can identify gaps and recommend actions, but it should not be described as a guarantee or universal certification. Compliance depends on continuing legal, technical and organisational practice.Can DPDP readiness be handled remotely?
Initial policy, contract and workflow review can often be handled remotely from organised records, but implementation may require coordination with management, IT, HR, vendors and operational teams.Related Increeda services
See business law services, corporate compliance and due diligence, commercial contract review and data-theft legal response.Official sources
- Digital Personal Data Protection Act, 2023 — India Code;
- Digital Personal Data Protection Rules, 2025 — MeitY; and
- official Gazette notification and commencement provisions.
