DPDP Act 2023 · DPDP Rules 2025 · for companies in India
DPDP compliance for Indian companies, from the team that responds when it goes wrong.
Reviewed by the Codesnag cyber team and the VirtualVakil legal team · Last reviewed:
Short answer
Codesnag helps Indian companies meet the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. We start with a free readiness check: our agents crawl your public website the way a visitor sees it and show what loads before consent, then fifteen questions cover what a crawl cannot see. We then draft the notices, set up consent, contracts, breach runbook and DPO support, and re-scan weekly. The main duties start on 13 May 2027; our team of cyber experts and advocates also responds if a breach happens first.
The check is free and shows your report on screen with no email needed. To talk to us, use the form: we reply by email.
Why us
India's best incident responders, working on your DPDP compliance.
Our claim, and what it rests on: Codesnag has responded to corporate cyber incidents since 2019 (clients are under NDA and none is named here), and Codesnag trains and advises UNODC, NCFTA, Delhi Police, Haryana Police STF and the Bureau of Police Research and Development. 'Best' is our own assessment, not an independent ranking.
DPDP fines follow failures: no safeguards, a late or missing breach notice, a notice nobody read. The company that has handled real breaches knows which of those fail first. So our assessors are the people who contain the incident, preserve the evidence and write the notices, and our advocates sit on the same file.
Adv. Mahir Gupta
Co-founder, Codesnag. Advocate, Delhi High Court
A practising advocate at the Delhi High Court and an ethical hacker, with a research partnership with the National Cyber-Forensics and Training Alliance (NCFTA, USA) on cyber crime. He has assisted Indian law enforcement and provided incident response to large enterprises, and his depth is in data privacy and localisation regulation. He is why the legal track runs alongside containment rather than after it.
Dr. Rakshit Tandon
Co-founder, Codesnag. Founder, Hackershala
A cyber security evangelist with over a decade in the field, cyber security consultant to the Internet and Mobile Association of India (IAMAI), adviser to police cyber crime units in Uttar Pradesh (Agra), Haryana (Gurugram) and Punjab, and a trainer at police academies across India. He contributed to UNICEF's Child Online Protection in India report.
See our incident response service, our company story and VirtualVakil for organisations.
Covered by
Trains and advises
Our founder is a practising advocate at the Delhi High Court and an ethical hacker — which is why the legal track can run alongside containment rather than after it.
The dates
When the DPDP Rules apply to your company
From Rule 1 of the DPDP Rules, 2025, counted from the Gazette date of 13 November 2025.
13 November 2025
Rules published
G.S.R. 846(E). Rules 1, 2 and 17 to 21, on the Data Protection Board and how it works, applied at once.
13 November 2026
Consent Managers
Rule 4: registration of Consent Managers with the Board applies one year after publication.
13 May 2027
Main duties
Rules 3 and 5 to 16 (with 22 and 23): notice, consent, security safeguards, breach intimation, children's data, rights and retention apply eighteen months after publication.
Rule 1: rules 1, 2 and 17 to 21 took effect on publication; rule 4 (Consent Managers) one year after; rules 3, 5 to 16, 22 and 23 eighteen months after. Counting from the Gazette date of 13 November 2025 gives 13 May 2027. The Act's own S. 1(2) lets the Government bring provisions into force on notified dates, so check the current notifications before fixing a compliance date. Until then, the CERT-In 6-hour reporting direction already applies to specified incidents, including data breach and data leak.
The assessment
What we check, and which provision it relates to
Eight areas, each mapped to the Act or the Rules. Every finding in your report carries its evidence, the provision and a plain-English fix.
Privacy notice
S. 5, S. 6(3), rule 3
Exists, linked on every page, covers the itemised data, purpose, how to withdraw, how to use rights and how to complain to the Board; clear language; English or an Eighth Schedule language.
Consent and trackers
S. 4, S. 6, rule 3
A consent mechanism, and the third-party analytics, advertising and session-replay scripts that fire before anyone has chosen. We list each one with the page it was seen on.
Forms that collect personal data
S. 5(1), S. 6(1)
Email, phone, name, Aadhaar and PAN fields: is a notice or consent shown at the point of collection, is any box pre-ticked, is more asked than needed.
Grievance and contact
S. 8(9), S. 8(10), S. 13, rules 9 and 14
A published contact or DPO, how to make a rights request, and a response period of no more than ninety days.
Children's data
S. 9, rules 10 and 12
Age fields and kids, school or edtech wording, which flag the need for verifiable parental consent and the ban on tracking and targeted ads aimed at children.
Retention, sharing and transfers
S. 8(7), S. 11(1)(b), S. 16, rule 8
Retention and erasure statements, disclosure of processors and third parties, and cross-border hints.
Security safeguard signals
S. 8(5), rule 6
HTTPS, certificate, HSTS, security headers and cookie flags, as signals only: rule 6 is about what is inside your systems.
Breach readiness
S. 8(6), rule 7
A published security or incident contact, and whether the notice says what happens after a breach.
How we work
Assess, fix, then keep it fixed
1. Assess
The free readiness check, then a review with a cyber expert and an advocate: what the crawl saw, what you told us, what neither can see, and a ranked fix list.
2. Fix
We provide the work in the next section: notices, consent, contracts, breach runbook, DPO support and training, each tied to the provision it answers.
3. Enforce
Compliance drifts when a marketing tool is added or a page is redesigned. We re-scan your site every week and alert you by email when something slips.
Remediation
What we provide to close the gaps
Scoped and quoted after the assessment, so you pay only for the gaps you have.
Consent notice drafting
A privacy notice and point-of-collection notices in plain English, and in an Eighth Schedule language your customers use, with the itemised data and purposes from your data map.
Consent set-up
A consent banner and preference centre that holds non-essential scripts until a choice is made, a consent log (notice version, purposes, time), and a tested withdrawal route. Ready to connect to a Consent Manager once registration opens on 13 November 2026.
Processor contracts
Data-protection and deletion terms for every cloud, payment, messaging and CRM vendor, and a vendor register, so S. 8(2) and rule 6(1)(f) are met on paper and in practice.
Breach response runbook
Who decides, who tells the Board and the affected people, the 72-hour Board report, and the CERT-In 6-hour report in force today. Templates, roles and one rehearsal.
DPO-as-a-service
A named data protection contact for rule 9, and for companies that may be notified as Significant Data Fiduciaries, support for the India-based DPO, independent audit and annual DPIA that S. 10 and rule 13 require.
Staff training
Short role-based sessions for the people who handle data, with attendance records, so the 'technical and organisational measures' in S. 8(4) include people.
Enforce compliance
Weekly re-scans, and an email when something slips
Under an ongoing engagement our agents re-crawl your public website every week, the same passive way, and compare it with the last scan. We email you when:
- A new tracker starts firing before consent
- The privacy notice is removed or can no longer be found
- The consent banner disappears
- A new gap appears, for example a form without a notice
- The score falls by ten points or more
The weekly crawl sees only your public website. Internal controls are reviewed in the periodic assessment, not by the crawl.
If a breach happens first
One team for the breach and the DPDP notices
Today, CERT-In requires specified incidents, including data breach and data leak, to be reported within 6 hours of noticing them. From the commencement of rule 7, a Data Fiduciary must also tell each affected person and the Board without delay and give the Board detailed information within 72 hours of becoming aware. Our incident response team contains the incident and preserves the evidence while our advocates handle the reports and notices. Read who to tell, what and when.
Maximum penalties in the Schedule to the Act
| Failure to take reasonable security safeguards to prevent a personal data breach (S. 8(5)) | up to ₹250 crore |
| Failure to give the Board or affected Data Principals notice of a personal data breach (S. 8(6)) | up to ₹200 crore |
| Breach of the additional obligations in relation to children (S. 9) | up to ₹200 crore |
| Breach of the additional obligations of a Significant Data Fiduciary (S. 10) | up to ₹150 crore |
| Breach of the duties of a Data Principal (S. 15) | up to ₹10,000 |
| Breach of any other provision of the Act or the Rules | up to ₹50 crore |
These are ceilings (“may extend to”), imposed by the Data Protection Board after an inquiry, not fixed fines. Under S. 37, after penalties in two or more instances, the Government may on the Board’s reference direct blocking of public access to the Data Fiduciary’s service.
Why this check
A checklist asks. Our agents look.
| A typical online self-assessment | Codesnag readiness check | |
|---|---|---|
| Evidence | Your own yes and no answers | Your own answers plus what our agents observe on your site: the URL, script or cookie behind each finding |
| Trackers | Asks if you use cookies | Lists the third-party trackers that fire before consent, with the page each was seen on |
| Legal basis | A score and general next steps | Each finding names its section or rule, checked against the Gazette text, with a plain-English fix |
| Honesty | Often silent on what it cannot judge | Says on the report what a website crawl cannot see |
| If it goes wrong | Refers you onward | The same team responds to incidents and files the CERT-In and DPDP notices |
How it works
From a free check to a compliant, monitored site
- 1
Run the free readiness check
Enter your company website and confirm you are authorised. Our agents crawl the public site while you answer fifteen questions about your internal practice.
- 2
Read your report
A score out of 100, a red, amber or green status for each area, every finding with its evidence and its DPDP provision, and a plain-English fix. It is on the page; no email is needed.
- 3
Book a DPDP assessment
Email us through the form. A cyber expert and an advocate review the report with you and scope the fixes.
- 4
Fix, then keep it fixed
We draft the notices, set up consent, contracts, breach runbook and DPO support, then re-scan weekly and alert you if something drifts.
Read more
The DPDP guides, on both sites
FAQs
Section 3 applies the Act to digital personal data processed within India, and to processing outside India if it is connected with offering goods or services to people in India. It does not apply to personal data processed by an individual for a personal or domestic purpose. If you collect names, phone numbers or emails through a website, an app or a form, you almost certainly process digital personal data and are a Data Fiduciary.
The Rules were published on 13 November 2025 (G.S.R. 846(E)). Rules 1, 2 and 17 to 21, which cover the Data Protection Board, applied at once. Rule 4, the registration of Consent Managers, applies one year after publication (13 November 2026). Rules 3 and 5 to 16, with 22 and 23, which carry the notice, consent, security, breach, children's and rights duties, apply eighteen months after publication, counted from the Gazette date as 13 May 2027. Check current notifications before fixing an internal deadline.
Our agents crawl your public website like a visitor: up to 25 public pages, one at a time, robots.txt respected, no form submitted, no login. In a real browser we record which third-party scripts and cookies load before any consent choice. We check for a privacy notice, a grievance contact, forms that collect personal data, signs of children's data, retention and sharing statements, security headers and a breach contact. Fifteen questions cover what a crawl cannot see. You get a score, a red-amber-green status per area, the evidence and a fix.
Internal processes, contracts with processors, logs and backups, consent records, mobile apps and anything behind a login, how a parent is verified for a child's data, whether a DPO is appointed, and whether you have been or may be notified as a Significant Data Fiduciary. The report says this on every page, and a good website score is not a compliance certificate.
It is passive. It fetches public pages a normal visitor can open, identifies itself as CodesnagDPDPCheck, obeys robots.txt and any crawl delay, waits at least a second between pages, stops at 25 pages, never submits a form or logs in and sends no attack traffic. You must confirm that you own the site or are authorised to check it. If a site blocks us with a bot wall we report that and do not work around it.
A DPO is required of a Significant Data Fiduciary (S. 10(2)(a)): based in India and responsible to the board. Other Data Fiduciaries must still publish, under rule 9, the business contact of the DPO if applicable or of a person who can answer questions about the processing. Many companies name a data protection contact, and some use a DPO-as-a-service arrangement.
The Schedule to the Act sets maximum penalties, which the Data Protection Board decides after an inquiry: up to ₹250 crore for failing to take reasonable security safeguards; up to ₹200 crore for failing to notify a personal data breach; up to ₹200 crore for breaching the obligations on children's data; up to ₹150 crore for breaching the additional duties of a Significant Data Fiduciary; up to ₹50 crore for any other breach of the Act or Rules. These are ceilings, not fixed fines.
Today, CERT-In's Directions of 28 April 2022 already require specified incidents, including data breach and data leak, to be reported within 6 hours of noticing them. From the commencement of rule 7, you must also tell each affected person and the Board without delay, and give the Board detailed information within 72 hours of becoming aware. Our incident response team contains the incident and preserves the evidence while our advocates handle the reports and notices.
It depends on how many systems, vendors, products and data flows you have, and whether you need DPO support or an audit. We do not publish a fixed price. The readiness check is free; tell us about your company through the form and we quote by email after a scoping conversation.
No. A Consent Manager is a separate entity that must be registered with the Data Protection Board under rule 4, with registration provisions applying from 13 November 2026. We set up consent collection, consent records and withdrawal inside your own systems, and can connect them to a registered Consent Manager when you choose one.
You do, on screen, as soon as it is ready. Nothing is sent to us unless you choose to email us. If you do, your report travels with the request so you need not repeat it, and we reply by email.
Primary sources
Where these rules come from
- Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), Gazette of India, 13 November 2025 (rules 1, 3, 4, 6 to 10, 13, 14)
- Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, 11 August 2023 (S. 3, 4, 5, 6, 8, 9, 10, 13, 16, 37 and the Schedule)
- CERT-In Directions No. 20(3)/2022-CERT-In, 28 April 2022, under IT Act S. 70B(6)
- Co-founder background: Dr. Rakshit Tandon, jury profile (collins.in)
- Co-founder background: Dr. Rakshit Tandon, CIA Conference speaker profile
- Co-founder background: Cyber security workshop by Dr. Rakshit Tandon (Damodar College)
- Co-founder background: Cyber security with Rakshit Tandon (FICCI FLO)
Last reviewed 20 Oct 2026. General information, not legal advice for your organisation. If anything here differs from the official text, the official text prevails. codesnag.ai is a unit of Cyber Legal Intelligence Partners.