DPDPA 2023 Readiness in 90 Days

DPDPA has no certificate and no fixed audit date, which makes it easy to deprioritize and expensive to ignore. Here's a realistic 90-day plan that gets the highest-risk gaps closed first.

Days 1-30: Know what you actually have

You can't protect data you haven't inventoried. This phase is unglamorous and non-negotiable.

• Map every system that collects, stores, or processes digital personal data
• Document the purpose for each processing activity, "we might need it later" isn't a purpose
• Identify every third party that receives or processes that data on your behalf
• Do a first-pass assessment of whether you're likely a Significant Data Fiduciary

Days 31-60: Fix consent and rights

This is the most customer-visible part of DPDPA, and the part most companies get wrong first.

• Rebuild consent notices to be itemized per purpose, not one blanket checkbox
• Make withdrawal as easy as giving consent, not buried three menus deep
• Stand up an intake path for access, correction, and erasure requests
• Assign an owner and a tracked timeline for every rights request, don't let it live in a shared inbox

Days 61-90: Safeguards and breach readiness

The part that only matters on the worst day, which is exactly why it needs to be ready before that day arrives.

• Document reasonable security safeguards and verify they're actually operating, not just written down
• Build a grievance redressal process with a tracked timeline
• Write the breach notification runbook, who tells the Board, who tells affected individuals, and by when
• Actually rehearse it once, tabletop exercises surface gaps a document review never will

What "done" actually looks like

DPDPA doesn't hand you a certificate at the end of 90 days. What you get is a defensible position: a current data inventory, consent that would survive scrutiny, a working rights process, and a breach response you've actually tested. That's the bar, and it's a moving one, since the accompanying rules are still phasing in. Treat this as the start of an operating discipline, not a project with a finish line.

← Back to Resources