Playbook · PDF
The DPDPA Readiness Playbook
From “where is our data?” to “here is our evidence” in 90 days. A working document for the people who will do the job.
Who it is for
Compliance heads, CISOs, DPOs, legal and IT leads at Indian organisations preparing for 13 May 2027.
What is inside
- 1. What changes and when
- The phased timeline and what applies on which date
- The ten duties in one page
- Penalty tiers and how the Board weighs them
- 2. Who owns what
- A responsibility chart for the board, DPO or contact, IT, HR, marketing, procurement and legal
- What to ask your vendors
- 3. The 12-point readiness checklist
- Data, notice, consent, safeguards, breaches, vendors, rights, children, retention and evidence
- A scoring guide so you can brief the board
- 4. The 90-day plan
- Week-by-week actions for Find, Fix and Prove
- Where teams usually slip, and how to avoid it
- 5. The evidence pack
- The 15 records a regulator, auditor or enterprise customer will ask to see
- How to file them so you can find them in minutes
- 6. Templates
- Notice checklist and consent record fields
- Breach response runbook with a 72-hour clock
- Rights-request tracker with due dates
A look inside
Most organisations do not fail the DPDPA because they did not care. They fail because nobody could say, on a given day, where a customer's data was, who could see it and what they had agreed to. The first job is therefore not a policy. It is a list.
Start with systems and vendors, not data fields. Ask each team three questions: what personal data do you hold, why do you hold it and who else sees it? Write the answers in one place.
The rest unlocks when you enter your details.