Who it concerns
Any business that handles personal data in digital form
The Act applies to personal data of individuals collected online, or collected offline and later digitised. A website enquiry form, an online order, a customer app, a payroll file or a WhatsApp list of customers can all bring a business within it.
The business that decides why and how the data is used — the data fiduciary — is responsible for it, including what its software vendors and service providers do with that data on its behalf.
Where things stand
- Aug 2023Digital Personal Data Protection Act, 2023 enacted.
- 13 Nov 2025DPDP Rules, 2025 notified; Data Protection Board provisions in force.
- Nov 2026Registration of consent managers opens.
- May 2027Main obligations apply: notice and consent, security safeguards, breach reporting, individuals' rights, and deletion of data no longer needed.
Dates as notified; confirm against the Gazette for your own planning.
What the firm does
Review, documents and software
The work can stop at advice and documents, or go on to building the changes into your website or app.
Review and advice
- A record of what personal data you collect, where it is kept, who can see it and why you hold it
- A gap review of your forms, apps, records and vendors against the Act and the Rules
- Privacy notice in plain language, and consent wording for each purpose
- Retention and deletion schedule, keeping in view what tax and company law require you to keep
- Data-processing terms for software vendors and service providers
- A breach response plan: who decides, who informs the Board and affected persons, and when
- Procedures for requests to access, correct or erase data, and for grievances
- Extra steps where children's data is involved
Building it into your website or app
- Notice and consent screens that record what each person agreed to, and when
- Withdrawing consent made as easy as giving it
- Forms that ask only for what the purpose needs
- Self-service or staff screens for access, correction and erasure requests
- Automatic deletion when data is no longer needed
- Access control and logs showing who viewed or changed personal data
- A breach register, and alerts for unusual access
- For new software: these built in from the start rather than added later
How an engagement runs
Four steps
Understand
A walk-through of your website, apps, forms, records and the vendors that handle data for you.
Gap report
What is missing against the Act and Rules, in order of importance, with what each fix involves.
Fix
Documents drafted, processes set up, and — if you choose — changes made to the website or app.
Keep current
A periodic review as the business, its software or the rules change.
Please note
- This is compliance and implementation support. Where a formal legal opinion is needed, for example on a dispute or a proceeding before the Data Protection Board, it should be obtained from an advocate.
- This website follows the same approach: a plain-language privacy notice, a consent checkbox on the contact form, and no tracking or advertising cookies.
Contact the office
Opp. NRI Sabha, Court Road, Civil Lines, Jalandhar 144001, Punjab · Monday to Saturday, 10:00 AM – 7:00 PM