Data Protection Is Now a Project Plan: A Readiness Guide for the DPDP Rules

Regulatory Landscape: The Phased Implementation Timeline

A Grant Thornton Bharat article by partner Akshay Garkel, published on 14 November 2025, described the schedule for the Digital Personal Data Protection Rules. Under the notification G.S.R. 843(E), foundational duties around notice, consent and basic governance were "already in force", while more complex requirements follow after 12 and 18 months.

The article did not assign each obligation to a phase and gave no calendar dates, so we do not either. Please check the notification itself for the exact dates that apply to you.

High-Priority Sectors and Advanced Obligations

The article listed several heavier obligations: independent audits, classification as a significant data fiduciary, consent and withdrawal mechanisms, data protection impact assessments and procedures for cross-border data transfers.

It said every entity that manages personal data is affected, from social media platforms and online marketplaces to digital services. It named fintech, digital platforms, advertising technology, hospitality and healthcare as sectors with "particular urgency." It did not specify penalty amounts, saying only that companies should prepare for "active oversight, investigations, and potential sanctions."

“Active oversight, investigations, and potential sanctions.”

A Practical Readiness Plan: Steps 1 to 5

This plan is an editorial suggestion drawn from the obligations above. It is not legal advice, and a qualified adviser should confirm what applies to your business.

1. Map the data. List what personal data you hold, where it came from, who sees it, where it is stored and who it is shared with. Most companies discover they hold more than they thought: old spreadsheets, email attachments, vendor portals.

2. Appoint an owner. Someone senior should be accountable for data protection. In a small firm this may be the founder or finance head, with outside advice.

3. Fix the notice and consent. Review the notices you give customers and employees. Are they clear? Is consent recorded? Can a person withdraw it as easily as they gave it?

4. Tighten access. Limit who can open personal data. Use unique logins, remove access when staff leave and keep logs.

5. Review vendors. If a payroll provider, cloud service or marketing tool handles your data, check what they do with it and what your contract says.

A Practical Readiness Plan: Steps 6 to 9

6. Plan for incidents. Write down who does what if data is lost or leaked: whom you tell, how you stop the problem and how you record it.

7. Prepare for assessments and audits. If your business could be classed as a significant data fiduciary, expect impact assessments and independent audits. Start keeping evidence now.

8. Think about cross-border flows. If your data is stored with an overseas provider, understand the legal position and document it.

9. Train staff. Most breaches begin with an employee's mistake. A short annual session pays for itself.

Why Smaller Enterprises Cannot Afford to Wait

A business with a few dozen staff still holds customer names, phone numbers and addresses. Waiting for the last phase means doing all the work at once, probably under pressure and at higher cost. Starting with the data map spreads the effort and often reveals easy savings, such as deleting records you do not need.

Competitive angle: Data protection can also be an asset. Larger customers increasingly ask suppliers how they handle personal data. A small company that can show a clear policy and a record of controls has an advantage in tenders.

Our reading: The shape of the rules, which start with basics and add depth over time, favours businesses that begin early and steadily. The cost of preparation is usually modest; the cost of an incident without preparation is not.

Questions for External Legal Counsel & Low-Cost First Steps

Questions to ask your advisers: Which of our activities would count as processing personal data? Do we have any children's data? Could we be treated as a significant data fiduciary, and what would that involve? What do our cloud and software contracts say about where data is stored? What evidence should we start collecting now to show our controls work? Write the answers down and revisit them every six months, because both the rules and the business will change.

Be wary of anyone who offers a quick certificate. Real readiness comes from changes to how data is handled, not from a document.

A final point on cost: Many owners assume that data protection requires expensive tools. In our view, the first gains come from low-cost steps: deleting data you no longer need, limiting who can see what, and writing down how requests from customers are handled. Specialist software may help later, but it works best when the basic habits are already in place.

Editorial analysis based on one professional-services article; not legal advice. Confirm dates and obligations against the notified rules.