India · Digital Personal Data Protection Act, 2023

DPDP compliance templates for Indian small businesses

Most duties under the DPDP Act and the DPDP Rules 2025 apply from 13 May 2027. Start with two free tools: a 15-question readiness check that scores you and lists your gaps, and a privacy-notice generator that writes the notice Rule 3 asks for, in English or Hindi.

Take the free readiness check (5 minutes) Generate a privacy notice (free)

No sign-up for the free tools. Your answers stay in your browser.

Real generator output (excerpt)

Privacy notice: Nilgiri Tea Traders

Nilgiri Tea Traders ("we", "us") decides why and how your personal data is processed, so we are a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (the DPDP Act). This notice explains what we collect, why we collect it, and how you can withdraw consent, use your rights and complain.

1. Personal data we collect

Name
Mobile number
Postal or delivery address
Order, booking and payment history (we do not store full card or UPI details; our payment gateway handles them)

2. Why we use it, and what it lets us do for you

to process your orders or bookings and deliver our goods or services to you
to send you service messages such as OTPs, invoices, appointment reminders and delivery updates
to collect payments and issue refunds

…

What applies, and from when

The Rules were notified on 13 November 2025 and bring the Act into force in three steps:

Date	What starts	Who it affects
13 Nov 2025	Definitions, the Data Protection Board of India and its procedures (sections 1(2), 2, 18 to 26, 35, 38 to 43, 44(1) and 44(3); Rules 1, 2 and 17 to 21)	Mostly the government and the Board
13 Nov 2026	Registration of Consent Managers (section 6(9), section 27(1)(d), Rule 4, First Schedule)	Companies that want to become Consent Managers
13 May 2027	Notice, consent, legitimate uses, security safeguards, breach reporting, erasure, children's data, rights of Data Principals, the Board's powers and penalties (sections 3 to 5, 6 except 6(9), 7 to 17, 27 to 34, 36, 37 and 44(2); Rules 3, 5 to 16, 22 and 23)	Every business that handles personal data of people in India in digital form

Our reading of notification G.S.R. 843(E) and rule 1 of the Rules ("eighteen months after the date of publication"). The Gazette is dated 13 November 2025 but was signed on 14 November 2025, so some advisers count from the 14th; plan for 13 May 2027. Until that date, section 43A of the IT Act 2000 and the SPDI Rules 2011 still apply (section 44(2) removes them on 13 May 2027). We have not found any later amendment to these dates, but check the sources below before relying on them.

Who this is for

Shops and D2C brands with a website or WhatsApp catalogue, clinics, coaching centres and schools, small software firms, agencies and CA practices that keep client data. If you collect names and phone numbers in a Google Sheet, the Act applies to you.

The penalties in the Schedule to the Act go up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for not reporting a breach or for breaching the duties on children's data, and up to ₹50 crore for other breaches such as a missing notice or invalid consent. The Board imposes them only after an inquiry, and decides the amount considering the nature of the breach and the business (section 33).

Who this is not for

If the government notifies you as a Significant Data Fiduciary, you need a Data Protection Officer in India, an independent audit and impact assessments (section 10). Templates will not cover that; talk to a law firm.

Banks, insurers and listed companies also have sector rules (RBI, IRDAI, SEBI) that this kit does not cover.

Section 17(3) lets the government exempt some businesses, including DPIIT-recognised startups, from the notice, erasure and access duties. We could not confirm whether any such notification has been issued; check before relying on it.

The full kit: ₹4,999 one-off, in early access

The free tools find your gaps and write one notice. The kit gives you the documents to close the rest:

Notice templates in the 22 Eighth Schedule languages, from Assamese to Urdu, matching the English generator output, because section 5(3) gives your customers the right to read the notice in any of them. Translations are machine-assisted with a review flag for each language.
Consent records register (Google Sheets and Excel) with the columns you need to meet the burden of proof in section 6(10).
Breach-response playbook: who does what in the first hour, the first 24 hours and by the 72-hour report to the Board, with message templates (Rule 7).
Data-processor clause to add to vendor contracts (section 8(2)).
Children's data checklist for schools, coaching and kids' brands (section 9, Rules 10 and 11).
Retention schedule with the erasure duty of section 8(7) and the Third Schedule periods.

See the kit and join early access Price shown: ₹4,999 one-off, or Pro at ₹999 per month. No payment today.

How this site was made

Octave, the AI agent of READ FRANCE SAS, a small software company in Paris, read the Act and the Rules as published by the Ministry of Electronics and Information Technology and wrote each question and each line of the generator against a section or rule. We have done similar work for French and EU rules (GDPR, the EU product safety regulation). No lawyer has reviewed this site, and we say so on every page. If you find a mistake, write to octave@vread.fr and we will correct it and credit the fix on this page.