India's Digital Personal Data Protection Act, 2023 (DPDP Act) changes how every organisation that handles digital personal data must think about privacy and security. With the DPDP Rules, 2025 notified in November 2025 and most obligations phasing in over roughly 18 months, many businesses are asking the same question: where do we start?
This guide focuses on the practical, technology and operational side of readiness—the part Peritas helps with every day. It is not legal advice; for your specific obligations, speak to a qualified legal or privacy adviser.
1. Understand what counts as personal data
Personal data is any data about an individual who can be identified from it. In a typical business that includes customer names and phone numbers in your CRM, employee and payroll records, email inboxes, website enquiry forms, CCTV footage, support tickets and spreadsheets on laptops. Most organisations hold far more personal data—in far more places—than they realise.
2. Know the obligations that matter most for IT
Several DPDP obligations translate directly into technology controls:
- Reasonable security safeguards to prevent personal-data breaches. Failure here carries the highest penalty under the Act—up to ₹250 crore.
- Breach intimation to affected individuals and to the Data Protection Board of India when a personal-data breach occurs.
- Purpose and retention limits, which require you to know where data is and to delete it when it is no longer needed.
- Responding to data principals who ask to access, correct or erase their data—which is only possible if you can find it.
3. Map where your personal data lives
You cannot protect data you cannot find. Build an inventory of systems, applications and cloud services, and mark which ones store personal data. Include shadow IT such as personal cloud drives and messaging apps used for work.
4. Put the core safeguards in place
For most organisations, a small number of controls deliver most of the protection:
- Multi-factor authentication on email, VPN, cloud apps and admin accounts.
- Managed endpoint protection and patching on every laptop, desktop and server.
- A properly configured firewall and secure remote access.
- Encryption of laptops and sensitive databases.
- Backups with an isolated copy and regular restore tests.
- Logging and monitoring so you can detect and investigate incidents.
5. Prepare for a breach before it happens
Write a short incident response plan: who decides, who investigates, how you contain an incident, how you preserve evidence and how you gather the facts needed to notify affected people and the Board. Rehearse it once a year with a tabletop exercise.
6. Measure, improve and repeat
Readiness is not a one-time project. Score your readiness, fix the biggest gaps first and re-assess annually as your systems, vendors and threats change.
A simple 90-day plan
- Days 1–15: Take a readiness assessment and build your data and asset inventory.
- Days 16–45: Enable MFA everywhere, fix endpoint and patch gaps, review firewall and backups.
- Days 46–75: Tighten access to personal data, deploy encryption and start log collection.
- Days 76–90: Document your incident response plan, brief management and schedule your next review.
Where do you stand today? Take the free Peritas DPDP Readiness Scorecard—25 questions, about 10 minutes—or explore our DPDP Ready™ services.
