In this guide 7 sections
Readiness is the engineering and records a business can show: a data map, consent records, access roles, retention jobs and a breach plan. Compliance is a legal conclusion the business reaches with its lawyer. GullySystem’s data protection service covers readiness and leaves the legal reading of the Act to your lawyer.
What the official sources say is in place
The Press Information Bureau backgrounder says the DPDP Rules were notified on 14 November 2025. It describes an eighteen-month period for phased compliance.
The Rules as published in the Gazette list security safeguards. They include encryption or masking, access control, logs with monitoring and backups. Your lawyer can confirm which duties apply to your business and from when.
What readiness work produces
Readiness is concrete. It is a set of controls inside the software and documents that describe them. Each item can be shown to an auditor, a client or a lawyer.
The work starts with a map of what is held. Every other item follows from it.
- A personal data map across systems, sheets and inboxes
- A list of fields to stop collecting
- Consent records with purpose, date and source
- Roles, field masking and logged exports
- Retention jobs that archive or delete on schedule
- A breach runbook naming who does what
What stays with your lawyer
Several decisions are legal, not technical. Engineers can describe what each option means for the systems. They should not choose the option.
A good readiness report marks these as legal questions and hands them over. The lawyer’s answers then become settings, schedules and wording in the software.
- The purposes stated for each kind of data
- Retention periods and conflicts with other laws
- Terms in contracts with vendors that process data
- Whether and how to notify after an incident
- Whether any stronger duties apply to the business
Why a package or certificate does not settle it
No software, template or certificate makes a business compliant by itself. A privacy policy copied from another website describes someone else’s data.
What holds up is evidence. Controls that work, a map that is current and a record of decisions someone can explain.
How the two sides work together
Engineering maps the data and reports what is exposed. The lawyer reads that report and takes the legal positions. Engineering then builds the controls those positions require.
Keep one internal owner for the whole effort. That person receives requests, keeps the map current and books the next review.
Readiness and legal split sheet
Two columns: items engineering will build and questions the lawyer will answer. Each row has an owner and a due date. Items move from the legal column to the build column once a decision is recorded.
Open a blank worksheet to printQuestions owners ask
Can a software vendor make us DPDP compliant?
No. Compliance is a legal conclusion about a business, drawn with its lawyer. A vendor can build consent records, roles, retention and logging, and document them as evidence.
When do the duties start for us?
The Rules’ own commencement clause brings most rules into force eighteen months after publication, with some earlier. Confirm the dates that apply to you with your lawyer, not a vendor website.
Is a privacy policy from our lawyer enough?
Not on its own. A notice describes what the business does with data. The systems still need controls that match it, such as roles, retention jobs and a working withdrawal path.
Do we need a Data Protection Officer?
Ask your lawyer how the law classifies your business. Either way, name one person who receives requests, keeps the data map and is called first when something goes wrong.
Sources
- Press Information Bureau backgrounder: DPDP Rules, 2025 Notified (17 November 2025) — verified 6 Oct 2026
- Digital Personal Data Protection Rules, 2025, Gazette of India notification G.S.R. 846(E) — verified 6 Oct 2026