Digital Personal Data Protection Act, 2023 — End-to-End Compliance, Audit & Advisory
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's first comprehensive data protection law, enacted to govern the collection, processing, and storage of personal data of Indian citizens. Notified by MeitY on November 13, 2025, the DPDP Rules bring the law into full force with a phased enforcement timeline running through May 2027.
Under the DPDP Act, every organisation that collects or processes the personal data of individuals in India — whether a startup, an MSME, a large enterprise, or a non-profit — is legally classified as a "Data Fiduciary." As a Data Fiduciary, you carry statutory obligations: you must obtain valid consent before processing data, maintain a transparent privacy notice, ensure data security, manage third-party processors, notify the Data Protection Board of India (DPBI) in the event of a breach, and honour individual rights such as data access, correction, and erasure.
The stakes are high. Non-compliance can attract penalties of up to ₹250 crore per violation. Organisations categorised as Significant Data Fiduciaries (SDFs) — those handling large volumes or sensitive categories of data — face additional obligations including appointing a Data Protection Officer (DPO), conducting Data Protection Impact Assessments (DPIAs), and engaging an independent data auditor annually.
DPDP Enforcement Timeline — The Clock Is Ticking
Phase 1 — Procedural (Active Now) — November 14, 2025 onwards
DPBI constituted with 4 members. Administrative and procedural provisions in force. Organisations must begin internal readiness assessments.
Phase 2 — Consent & Notice Deadline: November 2026
Consent management framework, privacy notices, and Data Principal rights (access, correction, erasure, grievance) become enforceable. Every customer- or employee-facing business must have compliant consent flows in place.
Phase 3 — Full Substantive Compliance Deadline: May 2027
All obligations fully enforceable: data security standards, breach notification, data retention & erasure policies, SDF obligations (DPO, DPIA, independent data audit). Penalties of up to ₹250 crore operative.
Who Needs DPDP Compliance Support?
If your business collects, stores, or uses personal data of any individual in India — through your website, mobile app, CRM, HR system, or payment gateway — you are legally a Data Fiduciary and the DPDP Act applies to you.
Mandatory for:
Significant Data Fiduciaries (SDFs) — Additional Obligations:
DPDP compliance is not just a legal checkbox — it intersects deeply with your financial controls, HR processes, accounting systems, and vendor contracts. VITTAX brings a uniquely integrated perspective: our Chartered Accountants apply the same structured audit methodology used in statutory and internal audits to your data protection framework, ensuring compliance is built into your business processes — not bolted on.
Track A — DPDP Readiness Assessment & Gap Report
A structured, audit-style assessment of your current data practices against every obligation under the DPDP Act and Rules. You receive a detailed Gap Report with prioritised remediation actions — the essential first step for any organisation starting its DPDP journey.
Track A — What We Assess
Track A — Deliverables
Track A — Timeline & Pricing
DPDP Readiness Starter
₹19,999 + GST
Startups & Small Businesses (up to 50 employees)
Ideal for: Freelancers, early-stage startups, small retailers with online presence
DPDP Readiness Pro
₹49,999 + GST
Growing SMEs (50–500 employees)
Ideal for: MSMEs, mid-size firms, EdTech, HealthTech, e-commerce businesses
DPDP Enterprise Assessment
from ₹99,999 + GST
Large Organisations & SDFs
Ideal for: IT/ITES companies, NBFCs, hospitals, large manufacturers, SDFs
Track B — DPDP Compliance Implementation & Policy Setup
Once gaps are identified, VITTAX implements the full compliance framework for your organisation — drafting policies, setting up consent workflows, training your team, and ensuring you are audit-ready for Phase 2 and Phase 3 enforcement deadlines.
Track B — Implementation Scope
Track B — Process
Track B — Pricing
DPDP Compliance Setup — Standard
₹39,999 + GST
Startups & Small Businesses
Ideal for: Early-stage startups, small e-commerce businesses, solo practices
DPDP Compliance Setup — Business
₹79,999 + GST
Growing SMEs with multiple departments
Ideal for: MSMEs, EdTech, HealthTech, HR companies, mid-size manufacturers
DPDP Compliance Setup — Enterprise
from ₹1,39,999 + GST
Large Organisations & Significant Data Fiduciaries
Ideal for: IT/ITES exporters, NBFCs, hospitals, SDFs, listed companies
Track C — DPDP Ongoing Compliance Retainer & DPO-as-a-Service
DPDP compliance is not a one-time project. As your business grows, adds new products, onboards new vendors, or faces new regulatory guidance, your compliance programme must evolve. VITTAX's retainer service gives you a dedicated compliance partner on a monthly basis — including the option to appoint VITTAX as your outsourced Data Protection Officer (DPO).
Track C — Monthly Retainer Includes
Track C — DPO-as-a-Service (Add-on)
Significant Data Fiduciaries are required by law to appoint a Data Protection Officer. VITTAX offers DPO-as-a-Service — a qualified professional who acts as your appointed DPO, interfaces with the DPBI on your behalf, and provides the statutory oversight required by the DPDP Act. This eliminates the cost of a full-time internal hire while fully meeting regulatory requirements.
Track C — Pricing
DPDP Retainer — Starter
₹7,999/month + GST
Small businesses post-compliance setup
Ideal for: Small businesses that have completed initial compliance setup
DPDP Retainer — Business
₹14,999/month + GST
Growing SMEs with evolving data activities
Ideal for: MSMEs, EdTech, HealthTech, e-commerce platforms
DPDP Retainer + DPO-as-a-Service
₹24,999/month + GST
Significant Data Fiduciaries requiring statutory DPO
Ideal for: Significant Data Fiduciaries (IT/ITES, NBFCs, hospitals, listed cos)
DPDP Compliance Combo Packages
📦 DPDP Starter Pack
Assess + Implement for Small Businesses
Best For: Startups, small e-commerce & service businesses handling customer data
📦 DPDP Business Compliance Pack
Full Assess + Implement + Monitor for SMEs
Best For: Growing MSMEs, EdTech, HealthTech, HR companies — complete Phase 2 & 3 readiness
📦 DPDP Enterprise + DPO Pack
Complete SDF Compliance Programme
Best For: Significant Data Fiduciaries, IT/ITES exporters, NBFCs, large hospitals, listed companies
Information Required to Start
🏢 Business Information
💻 Data & Technology
📋 Existing Compliance Documents
Frequently Asked Questions — DPDP Act
Does the DPDP Act apply to my small business or startup?
Yes. If you collect even basic personal data — names, email addresses, phone numbers, or payment details — through your website, app, or offline process, you are a Data Fiduciary under the DPDP Act. Size is not an exemption criterion. However, smaller organisations face fewer obligations than Significant Data Fiduciaries, and our Starter tier is specifically designed to be affordable for SMEs and startups.
When do I need to be compliant by?
Phase 2 obligations — consent management, privacy notices, and Data Principal rights — become enforceable from November 2026. Phase 3 full compliance (data security, breach notification, SDF obligations) applies from May 2027. We recommend starting your compliance journey now: a proper implementation takes 4–6 weeks, and internal process changes take time to embed.
What are the penalties for non-compliance?
The DPDP Act provides for penalties of up to ₹250 crore per violation by the Data Protection Board of India. Different violations carry different penalty caps — for example, failure to implement reasonable data security safeguards can attract up to ₹250 crore, while breach of obligations concerning children's data can attract up to ₹60 crore. These are per-incident penalties, not annual caps.
What is a Significant Data Fiduciary (SDF) and am I one?
The government will notify specific categories and volume thresholds for SDFs separately. However, organisations that process large volumes of personal data, handle sensitive data (financial, health, biometric), serve children, or pose significant risk to data principals are likely candidates. VITTAX's Enterprise Assessment includes a full SDF obligation check to help you determine your category.
We already have a privacy policy on our website. Are we compliant?
Almost certainly not — most existing privacy policies were written for general purposes and do not meet the specific requirements of the DPDP Rules (prescribed format, itemised disclosures, rights procedures, contact details of Data Fiduciary and DPO). A privacy policy gap check is one of the first steps in our Readiness Assessment.
We are an IT company serving EU clients. Do we need GDPR too?
If you process personal data of EU residents as a processor on behalf of an EU controller, GDPR obligations apply to your processing under Article 28. VITTAX's Enterprise pack includes a GDPR alignment module to help you meet both DPDP and GDPR obligations efficiently — avoiding duplication of effort.
What does DPO-as-a-Service mean and is it mandatory?
Significant Data Fiduciaries are legally required to appoint a Data Protection Officer under the DPDP Rules. DPO-as-a-Service means VITTAX provides a named, qualified professional to fulfil this statutory role on your behalf — interfacing with the DPBI, overseeing your compliance programme, and providing expert oversight. It eliminates the cost and complexity of an in-house hire.
How is VITTAX different from a law firm or IT security firm for DPDP?
DPDP compliance sits at the intersection of legal obligations, financial controls, HR processes, IT security, and accounting systems. Law firms focus on legal advice; IT firms on technical controls; VITTAX brings the CA's structured audit lens — identifying, documenting, and controlling risks across all these dimensions simultaneously. We also offer ongoing compliance retainers at a fraction of the cost of a dedicated in-house compliance team.
⚡ Three Service Tracks
⚡ Children's Data Penalty
Breach of obligations concerning children's data can attract up to ₹60 crore per incident.
CA-led gap assessment, policy drafting, DPO-as-a-Service — complete DPDP compliance before Phase 2 & Phase 3 deadlines