1
It is a law about people's data.
If you keep information about people, such as names, phone numbers, salaries or health records, the DPDP Act applies to you. Even if your company is small.
Who does the Act apply to?/India's Digital Personal Data Protection Act, 2023
DPDP compliance, made simple.
India's new data law applies to almost every business. The main duties start on 13 May 2027. MYND's compliance team helps you get ready, step by step, in plain English.
25 years of compliance work1,000+ clientsReply within one working day
Free30-minute first call
25years
of payroll, finance and compliance work1,000+clients
across 50+ countries trust MYND6M+payslips
a year, full of personal data, kept safe99%accuracy
on compliance across our engagements/DPDP in 60 seconds
What is this law, in plain words?
DPDP stands for Digital Personal Data Protection. Three things to know.
2
It gives people rights.
People can ask what data you hold about them, ask you to fix or delete it, and complain if you do not. You need a way to answer them, on time.
The rights people get
3
It has big penalties.
Up to 250 crore rupees for weak security. Up to 200 crore rupees for not reporting a breach. The Data Protection Board already exists.
See every penalty/Key dates
Three dates to remember.
The law arrives in phases. The next one is 13 November 2026, 65 days from today.
The law wakes up.
The Rules are notified. The Data Protection Board exists. Definitions and the Board's powers are live.
19 sections of the Act · 7 rules
Consent Managers arrive.
Consent Managers can register with the Board under rule 4. Section 6(9) and section 27(1)(d) start.
2 sections of the Act · 1 rule
Everything else starts.
Notices, consent, people's rights, security duties, breach reporting and penalties all apply from this day. This is the date to plan for.
23 sections of the Act · 15 rules
246 days until the main duties apply.
Most companies need three to six months to get ready. Start now and the deadline is comfortable. Start late and it is not.
/What we do
Nine services. One partner. Pick what you need.
Start with an assessment if you are new to this. Or go straight to the service you need.
DPDP Assessment & Alignment
We check where you stand today and give you a clear plan to get compliant.
Learn more
Data Protection & Privacy Advisory
A privacy expert on call. Ask us anything about DPDP, any time.
Learn more
Product & Platform Privacy Review
Building an app, website or platform? We review it for privacy before it goes live.
Learn more
Privacy, Data Use & Governance Policies
Clear policies for your website, your staff and your vendors. Written so people actually read them.
Learn more
Cross-Border Data Flow Advisory
Sending data outside India? We tell you what is allowed and how to do it safely.
Learn more
Regulatory Support
A data breach, a complaint or a notice from the Board? We stand with you.
Learn more
Data Protection Audits & Compliance
Regular checks that your policies, controls and people are still doing what they should.
Learn more
Privacy Risk Assessment & Mitigation
New technology, new cloud, new AI tool? We assess the privacy risk first and help you reduce it.
Learn more
DPDP & Privacy Training
Short, practical training so your people know what to do with personal data.
Learn more/Who we help
Sound like you?
DPDP touches every team that keeps information about people. These are the people who call us most.
Chief Financial Officer
Vendor data, payment data, audits. You want one clean answer for the board.
Head of HR
Employee files, payroll, background checks. You hold more personal data than anyone.
CIO or CTO
Systems, access, backups, cloud. Security safeguards land on your desk.
Founder
You are growing fast. You want to get this right without a big team.
Compliance Officer
You need a map, a plan and proof that it all works.
Hospital Administrator
Patient records are personal data at its most sensitive.
School Principal
Children's data has extra rules. Consent from parents is a must.
E-commerce Operations Head
Customer data, marketing, delivery partners. Consent and notices everywhere.
/How it works
Five simple steps. No jargon.
You do not need to understand the law to start. That is our job. You need one call.
- 01
Talk
30 minutes, free
A short call. We listen. You tell us about your business, your systems and your worries. We tell you honestly what we see.
- 02
Map
2 to 4 weeks
We map your personal data and compare it with the law. You get a gap report and a roadmap with dates and owners.
- 03
Fix
1 to 3 months
Policies, notices, contracts, controls. We do the writing and the checking. Your team does the approving.
- 04
Train
Half a day
Your people learn what to do with personal data. Short sessions, real examples, a record for your file.
- 05
Keep
Ongoing
Audits, updates when the law changes, and a team to call when something happens. We stay with you.
/Why MYND
A compliance partner, not a consultant who leaves.
We have handled personal data with care for 25 years.
MYND runs payroll for 6 million payslips a year and processes 20 million transactions. Employee and vendor data has flowed through our systems for a quarter of a century. We know what it takes to keep it safe.
We have done compliance for 1,000+ companies.
Statutory filings, labour law, tax, vendor compliance. Across 50+ countries. DPDP is one more law we help you keep, with the same discipline.
We explain things in plain English.
We built the DPDP Wiki: every section, rule and notification, word for word, with simple explanations. It is free. Our advice reads the same way.
One partner for law, process and people.
Most firms give you a legal opinion and leave. We stay to fix the process, train the team and check it stuck.
/Industries
We work across every sector that holds personal data.
Which is every sector. Here are the ones we see most.
Banking & finance
Account data, credit data, KYC records.
Healthcare
Patient records, test results, insurance claims.
Education
Student and parent data, most of it about children.
Retail & e-commerce
Customer profiles, orders, loyalty and marketing.
IT & software
Client data in your systems, often from abroad.
Manufacturing
Thousands of employee and contractor records.
Hospitality
Guest identity documents, bookings, preferences.
Startups
Fast growth, new products, investors asking questions.
/Free resource
Want to read the law yourself? We built the DPDP Wiki for that.
Every section of the Act, every rule and every notification, word for word from the Government of India. With plain-English explanations, key dates, a glossary, free tools and a question box. No sign-up. No cost.
The Act, section by sectionThe Rules, 2025What is in force todayPlain-English guidesPenalty lookupAsk DPDP
Open the DPDP Wiki/FAQ
Questions people ask us
Does the DPDP Act apply to my company?
Almost certainly yes, if you handle personal data in digital form in India, or offer goods or services to people in India. Size does not matter. Use the free checker on the wiki to be sure. Read more on the wiki
When do I need to be ready?
The Data Protection Board has existed since 13 November 2025. Consent Manager rules start on 13 November 2026. The main duties for every business, including notices, consent, rights and penalties, start on 13 May 2027. Read more on the wiki
What are the penalties?
Up to 250 crore rupees for failing to keep reasonable security safeguards. Up to 200 crore rupees for not reporting a breach. Other breaches carry their own limits. The wiki lists every one. Read more on the wiki
What is a Data Fiduciary?
The organisation that decides why and how personal data is used. If you collect data from customers or employees, that is you. Read more on the wiki
How much does this cost?
It depends on your size and how much personal data you handle. The first call is free. After it we give you a fixed quote. No surprises.
Is this legal advice?
No. MYND is a compliance and back-office partner, not a law firm. We work with your lawyers whenever you need a legal opinion. The official text of the law is on the wiki. Read more on the wiki
The deadline is fixed. Your start date is not.
One call is enough to know where you stand. It is free, it takes 30 minutes, and you leave with a clear next step.
/Talk to a person
Tell us where you are. We will tell you what to do next.
Fill in the form. A compliance lead (a real person, not a sales queue) replies within one working day. The first call is free and takes 30 minutes.
- 25 yearsof payroll, finance and statutory compliance
- 1,000+clients across 50+ countries
- 6M+payslips a year, personal data handled with care
- 99%compliance accuracy across engagements