Is Your Business
Ready for ₹850+ Cr
in Penalties?
The Digital Personal Data Protection Act, 2023 is enforceable. Non-compliance carries penalties up to ₹250 Crore per violation. Know your exposure in 15 minutes completely free.
Is Your Business
Ready for ₹850+ Cr
in Penalties?
The Digital Personal Data Protection Act, 2023 is enforceable. Non-compliance carries penalties up to ₹250 Crore per violation. Know your exposure in 15 minutes completely free.
Is Your Business
Ready for ₹850+ Cr
in Penalties?
The Digital Personal Data Protection Act, 2023 is enforceable. Non-compliance carries penalties up to ₹250 Crore per violation. Know your exposure in 15 minutes completely free.
Time Until Final Deadline - Phase 3
May 13, 2027 - All substantive DPDP obligations become enforceable
May 13, 2027 - All substantive DPDP obligations become enforceable
Time Until Final Deadline - Phase 3
The Cost of Non-Compliance
The Cost of
Non-Compliance
The DPDP Act & Rules 2025 impose severe financial penalties on organizations that fail to comply.
The DPDP Act & Rules 2025 impose severe financial penalties on organizations that fail to comply.
Up to ₹250 Cr
Up to ₹250 Cr
Failure to implement reasonable security safeguards (Section 8(5))
Failure to implement reasonable security safeguards (Section 8(5))
Inadequate technical/organisational measures
Purpose-built to understand
laws, not just language.
Inadequate technical/organisational measures
up to ₹200 Cr
up to ₹200 Cr
Failure to notify Board/Data Principals of breach (Section 8(6))
Failure to notify Board/Data Principals of breach (Section 8(6))
Failure to notify Data Protection Board of India
Purpose-built to understand
laws, not just language.
Failure to notify Data Protection Board of India
up to ₹200 Cr
up to ₹200 Cr
Non-compliance with children's data provisions (Section 9)
Non-compliance with children's data provisions (Section 9)
Failure to notify each affected individual
Purpose-built to understand
laws, not just language.
Failure to notify each affected individual
₹150 Cr
Failure to fulfil SDF obligations (Section 10)
Processing without verifiable parental consent
₹50 Cr
Other non-compliance
DPO, DPIA, independent audit non-compliance
Up to ₹150 Cr
Failure to fulfil SDF obligations (Section 10)
Processing without verifiable parental consent
Purpose-built to understand
laws, not just language.
Up to ₹50 Cr
Other non-compliance
DPO, DPIA, independent audit non-compliance
Purpose-built to understand
laws, not just language.
₹850+ Cr
₹850+ Cr
₹850+ Cr
Total Maximum Exposure
Total Maximum Exposure
Total Maximum Exposure
If fully non-compliant
If fully non-compliant
If fully non-compliant
Compliance Timeline
Compliance Timeline
Three critical phases.
Where does your organization stand?
Three critical phases.
Where does your organization stand?
Active Now
Nov 13, 2025
Board Established
Board Established
Data Protection Board of India constituted. Formal regulatory body in place to receive complaints and issue directions.
2
Upcoming
Nov 13, 2026
Consent Manager
Consent Manager
Consent Manager provisions (Rule 4) take effect. Organisations must integrate with registered Consent Managers for bundled and third-party consent flows.
3
Final Deadline
May 13, 2027
Full Enforcement
Full Enforcement
All substantive DPDP obligations become enforceable penalties, SDF requirements, cross-border restrictions, and Data Principal rights are fully active.
9 compliance areas,
organized for fast decisions.
Rapid coverage of the DPDP Act and
Rules 2025- 45 weighted questions
Entity Profile
Entity type & processing scope
Consent & Notice
Rule 3, Section 5/6
Security Safeguards
Rule 6 — ₹250 Cr risk
Breach Management
Rule 7 — ₹200 Cr risk
Data Retention
Rule 8 and Section 8(7)
Data Principal Rights
Section 11–14
Processor Management
Section 8(2)
Children's Data
Section 9 -
₹200 Cr risk
Governance & Cross-Border
Section 10/16, Rule 13/15
Frequently
Asked Questions
What is the DPDP Act, and is it actually in force?
The Digital Personal Data Protection Act, 2023 is India's data protection law, now operational alongside the DPDP Rules, 2025. It's being enforced in phases: the Data Protection Board of India was constituted in November 2025, the Consent Manager framework follows in November 2026, and all substantive obligations become fully enforceable by May 13, 2027.
How much can non-compliance actually cost?
What's the difference between the Rapid and Full assessments?
What does the assessment actually evaluate?
Is the assessment result legal advice?
Don't wait until the regulator calls.
Get a compliance score, penalty exposure estimate, and a clear view of where to focus next.
9 compliance areas,
organized for fast decisions.
Rapid coverage of the DPDP Act and Rules 2025- 45 weighted questions
Rapid coverage of the DPDP Act and Rules 2025- 45 weighted questions
Entity Profile
Entity type & processing scope
Consent & Notice
Rule 3, Section 5/6
Security Safeguards
Rule 6 — ₹250 Cr risk
Breach Management
Rule 7 — ₹200 Cr risk
Data Retention
Rule 8 and Section 8(7)
Data Principal Rights
Section 11–14
Processor Management
Section 8(2)
Children's Data
Section 9 — ₹200 Cr risk
Governance & Cross-Border
Section 10/16, Rule 13/15
Frequently Asked Questions
What is the DPDP Act, and is it actually in force?
The Digital Personal Data Protection Act, 2023 is India's data protection law, now operational alongside the DPDP Rules, 2025. It's being enforced in phases: the Data Protection Board of India was constituted in November 2025, the Consent Manager framework follows in November 2026, and all substantive obligations become fully enforceable by May 13, 2027.
How much can non-compliance actually cost?
What's the difference between the Rapid and Full assessments?
What does the assessment actually evaluate?
Is the assessment result legal advice?
Don't wait until the regulator calls.
Get a compliance score, penalty exposure estimate, and a clear view of where to focus next.
Don't wait until the regulator calls.
Get a compliance score, penalty exposure estimate, and a clear view of where to focus next.