Rules notified · obligations start 13 May 2027

India's privacy law is here. Is your clinic ready?

The Digital Personal Data Protection Act, 2023 changes how every business collects, stores and shares personal data. We make it simple, in plain English and Telugu.

Does it apply to me? → Learn the basics
₹0 Crmax penalty per instance
—days to the deadline
0size exemptions for small businesses
01 · What is DPDPA

India's first full law on personal data.

The Digital Personal Data Protection Act, 2023 sets the rules for how organisations handle the personal data of people in India. It gives people rights over their data and puts clear duties on the businesses that use it.

Personal data is anything that identifies a person: a name, phone number, Aadhaar, test report, photo, fee receipt or WhatsApp chat.

👤A

Data Principal

The person the data is about: your patient, student, customer or employee.

🏢B

Data Fiduciary

You. The business that decides why and how personal data is used.

⚙️C

Data Processor

Any vendor that handles data for you: software, lab, billing or IT partner.

⚖️D

Data Protection Board

The body that inquires into breaches and complaints, and imposes penalties.

02 · Why it matters

One careless WhatsApp
can cost crores.

A normal day at the front desk
🏥
City DiagnosticsFront desk phone
📄 Lakshmi_Thyroid_Report.pdf→ Staff group (14 members) Report shared in a staff group · Section 8(5)Sent only to the patient, via secure link
Sir, we saved your Aadhaar copy for next time 👍 No notice, no consent · Sections 5 & 6Notice given, consent recorded
Please delete my old records.
Sorry sir, not possible. Erasure request ignored · Section 12Erased on time, logged
Front-desk phone lost at the bus stand 😱 Breach not reported · Section 8(6)Board & patients informed, 72-hour report

4 risks · in one ordinary day4 fixes · every day

The Act's Schedule sets penalties per instance. The Data Protection Board decides the amount based on how serious the breach is.

No reasonable security safeguardsup to ₹250 Cr
Not reporting a personal data breachup to ₹200 Cr
Breaking the rules on children's dataup to ₹200 Cr
Significant Data Fiduciary dutiesup to ₹150 Cr
Any other provision of the Actup to ₹50 Cr
Trust

People now know their rights. A leak or misuse travels faster than any ad.

Rights

People can ask to see, correct or erase their data, and complain if you don't reply.

Vendors

You stay responsible even when your software or lab partner makes the mistake.

03 · Who must comply

If you handle people's data digitally, it's you.

There is no exemption for small businesses. The Act covers digital personal data, and paper data that is later digitised, used in the course of business.

🏥 Hospitals & clinics🧪 Diagnostic labs🏫 Schools & colleges 💻 Training institutes🛍️ Retail & e-commerce🚀 Startups & SaaS 🏨 Hotels & travel🏢 Real estate🤝 NGOs & trusts 💼 CA & law firms🏋️ Gyms & salons🏦 Finance & insurance
30-second check 1 / 3

Do you collect details of people — patients, students, customers or staff?

Is any of it stored or shared digitally? Excel, software, WhatsApp, email, phone photos…

Is it used for your business or profession, not just personal or family use?

A quick guide, not legal advice.

04 · Key deadlines

The clock is already running.

Aug 2023

Act passed

Parliament passes the DPDP Act, 2023.

13 Nov 2025

Rules notified

DPDP Rules, 2025 published. Data Protection Board provisions come into force.

Nov 2026

Consent Managers

Registration of Consent Managers opens. We are here.

13 May 2027

Full obligations

Notice, consent, security, breach reporting and rights apply to everyone.

000Days
00Hours
00Minutes
00Seconds

Getting ready takes months, not days. Start early.

05 · How to comply

Eight steps to DPDP-ready.

You don't need a legal team. You need a clear plan, simple tools and someone to guide you. Tap a step to see what it involves.

0/8 steps explored

  1. List what personal data you collect, why, where it's kept and who can see it. This is the base for everything else.

  2. Tell people, in plain language, what data you take and why. Notices can be in English or any of the 22 Eighth Schedule languages, including Telugu.

  3. Take consent that is free, specific and informed, keep a record of it, and make withdrawing as easy as giving it.

  4. Use reasonable safeguards: access control, encryption or masking, backups and access logs kept for at least a year.

  5. Put written terms in place with every processor: your software, lab, billing or IT partner.

  6. Let people access, correct, erase or nominate, and answer grievances within the time the Rules allow (up to 90 days).

  7. Inform the Board and affected people without delay, and file a detailed report within 72 hours. Practise it before you need it.

  8. Delete data once its purpose is served, take extra care with children's data (verifiable parental consent), and train the front desk.

06 · Our services

Everything you need, under one roof.

Start here

DPDP Readiness Assessment

We visit, map your data flows and hand you a clear gap report with a step-by-step fix plan, ranked by risk.

Book an assessment →
📝

Notices & Consent

Plain-language notices and consent flows in English and Telugu.

📑

Policies & Contracts

Privacy policy, retention policy and processor agreements.

🚨

Breach Readiness

A breach playbook and a 72-hour drill, so your team knows exactly what to do.

🎓

Staff Training

Short, practical sessions for front desk, teachers and staff, in Telugu or English.

🛎️

Rights & Grievance Desk

We help you run access, correction, erasure and complaint requests on time.

🤝

Ongoing Support

A privacy officer-style partner on call, with quarterly reviews and updates as the law evolves.

⚖️

Legal guidance, when you need it

For legal advice, we connect you with independent, enrolled advocates who act in their own name. You pay them directly.

07 · Our platform

Meet DPDPA Vault.

Our software that does the daily DPDP work for you: consent at the counter, safe report sharing, rights requests and a one-tap breach plan. Built for clinics, schools and institutes. Works in Telugu.

  • Digital consent with a full record
  • Reports shared only with the right person
  • Rights and grievance requests tracked to closure
  • Breach clock and ready-to-send notices
Visit dpdpavault.in ↗ Free pilot
08 · Resources

Learn it in minutes, not months.

Guide

The DPDP Act in 10 minutes

The whole law, in plain words.

Coming soon Checklist

Is your consent notice valid?

Quick checks before you print.

Coming soon Playbook

The 72-hour breach plan

Who to call, what to send, when.

Coming soon Sector

DPDP for clinics & labs

Reports, WhatsApp and consent.

Coming soon

Frequently asked

Does the DPDP Act apply to small businesses?

Yes. There is no exemption based on size or turnover. If you process digital personal data in the course of business, the core duties apply. Only some startup relaxations may be notified by the Government.

Is paper data covered?

The Act covers personal data collected digitally, and data collected on paper that is later digitised, for example scanned forms or typed registers.

When do I need to be ready?

Most obligations apply from 13 May 2027, 18 months after the DPDP Rules were notified on 13 November 2025.

Is sending reports on WhatsApp allowed?

The Act doesn't ban any app. What matters is consent, sending data only to the right person, and reasonable security. We help you set this up safely.

What about children's data?

For anyone under 18, you need verifiable consent from a parent or lawful guardian, and you must not track or target them with ads.

Is DPDPA Office a government body?

No. DPDPA Office is an independent, private advisory. We are not affiliated with the Government of India or the Data Protection Board of India.

09 · About us

Built by an engineer who studied law.

DPDPA Office brings technology and law together, so data protection is practical, affordable and in your language. We work out of Bengaluru and Rajahmundry and serve businesses across Andhra Pradesh, Telangana and beyond.

Plain wordsNo jargon. Just what to do.
Your languageTelugu and English.
Tech + lawTools, not just advice.

Giridhar

Founder
  • 18+ years in enterprise software and AI automation
  • B.Sc. (CS), M.Sc. (IT), LL.B.
  • Two published patent applications in AI-assisted legal drafting
  • Founder of Laasya Labs, Rajahmundry (since 2015)
10 · Contact

Let's get you DPDP-ready.

A free 15-minute call, in Telugu or English. No obligation.

📞
Call+91 XXXXX XXXXX
 💬
WhatsAppChat with us
 ✉️
Emailhello@dpdpaoffice.com
📍
OfficesRajahmundry · Bengaluru
QR code to dpdpaoffice.com contact form
Scan with your phoneBook your free call right here.
Free readiness call15 min

Used only to reply to your enquiry. See our privacy notice.

💬