With the DPDP Rules, 2025 notified and core obligations enforceable by 14 May 2027, the worst move is to freeze. You don't need everything at once — you need momentum in the right order. Here is a realistic 90-day plan.
Days 1–30: See the ground
- Run a gap assessment and build a first-pass data map.
- Estimate your SDF likelihood.
- Name an owner (a DPO or a responsible contact) and publish a grievance route.
Days 30–60: Fix the front door
- Rewrite notices (English + key Indian languages) from the data map.
- Implement consent capture and a compliant cookie banner.
- Stand up a rights and grievance workflow.
Days 60–90: Lock the back door
- Implement Rule 6 security — encryption, access control, one-year logs.
- Write a breach-response plan and drill it.
- Set retention schedules and sign processor contracts.
Then: keep it alive
Review the data map, re-run DPIAs (every 12 months for SDFs), test breach response, and keep records you can show the Board. Compliance is a programme, not a project.
The one rule
Do the highest-risk, most-visible things first — notice, consent, security, breach. Perfect later; defensible now.
How DPDP Bridge helps
DPDP Bridge gives you the assessment, the plan and the tooling to run this 90-day journey — and the records to prove it. Take the free assessment to see exactly where you stand and what to do next.
This article is general information about the DPDP Act and is not legal advice. For guidance specific to your organisation, take the free assessment or speak to our team.