18 Months and Counting: A Practical DPDP Compliance Roadmap

For CISOs, DPOs & IT leaders  ·  ~6 min read  ·  Suggested publish: 26 Aug 2026

With full DPDP compliance due by 13 May 2027 and penalty powers switching on in November 2026, ‘we’ll deal with it later’ has stopped being a plan — especially as most enterprise programmes need 9–12 months to reach audit-readiness. The good news: compliance is a project you can scope and sequence. Here is a five-step DPDP compliance roadmap you can start this quarter.

1. Know your data (mapping & discovery)

You cannot protect — or account for — what you cannot see. Map what personal data you hold, where it lives, who can touch it, and which vendors process it. Data discovery and mapping is the foundation everything else stands on, and it is usually the step organisations most underestimate.

2. Fix consent and notice

Move to clear, purpose-specific consent and plain-language notices, with easy withdrawal. Build the plumbing to record and honour consent at scale, and prepare for Consent Manager registration, which opens from November 2026.

3. Engineer the safeguards

Encryption, access control, logging and sensible retention limits are table stakes — and, critically, so is the ability to detect and report a breach quickly. India’s record breach costs trace back to three avoidable failures: patching delays, unvetted vendor access, and digital hoarding of data you no longer need. Fix those three, and you remove most of your exposure. Under DPDP, strong security isn’t optional; it’s a legal requirement.

4. Contract your processors

DPDP obligations flow down to the vendors who handle data for you. Update contracts, verify their controls, and make their compliance auditable — their gap is your liability, and regulators will not accept ‘our vendor did it’ as a defence.

5. Operationalise rights and grievances

Stand up workflows for access, correction and erasure requests, appoint a grievance officer, and keep audit trails. Rights you can’t service on time become complaints — and complaints now have somewhere to go, in front of a Board that is already active.

The AI & security connection

Here’s the strategic bit: private AI keeps personal data inside your perimeter, and robust cyber-security is literally a DPDP requirement. Treat data protection and cyber-resilience as one programme, and you satisfy the regulator while genuinely strengthening the business — rather than bolting on compliance as a cost.