DPDP rules are now in force – is your organisation ready?

India’s DPDP Rules, 2025 turn data protection from high-level principles into clear, enforceable and evidence-backed obligations. Organisations must now demonstrate real compliance through stronger safeguards, transparent consent flows, structured rights handling, and verifiable governance.

Why it matters

The Rules significantly elevate what is expected from businesses by defining exactly how to protect, process, store, and respond to personal data. They make privacy operational, requiring measurable controls across technology, customer experience, cybersecurity, operations, and vendor ecosystems.

DPDP compliance is no longer policy paperwork — it is a provable, organisation-wide capability.

What organisations need to focus on

• End-to-end data mapping & classification
• Purpose-specific notices and consent flows
• Mandatory security safeguards (encryption, masking, logging, retention controls)
• Structured breach response protocols
• Rights handling workflows (access, correction, erasure, nomination)
• Children’s data verification mechanisms
• Stronger governance and accountability frameworks

These requirements demand coordinated action, leadership alignment, and clarity on processes, roles, and technology choices.

Forvis Mazars in India: Your partner for DPDP readiness

We help organisations move from intent to implementation with a practical, audit-ready approach:

• Data discovery & Significant Data Fiduciary assessments
• Governance and operating model setup
• Redesign of notices, consent journeys & digital touchpoints
• Advisory on safeguards, logging, verification & supporting technologies
• Breach response and Data Principal rights workflows
• Readiness assessments, DPIAs & contract updates

Our approach brings clarity, operational confidence, and global best practices to your DPDP journey.

Begin your DPDP readiness with trusted guidance from our Cyber & Digital teams.

Contact us to get started.