Rules 1, 2 and 17–21
01 A practical DPDP guide for business teams
Turn DPDP requirements into a plan your team can own.
Work out where customer data goes, what needs to change and who will do it. Choose your business context for practical tasks, system guides and a suggested 90-day plan.
For product, operations, security and privacy teams.
How it works A guided workspace you use in your browser. It helps organise the work; it cannot certify compliance.
Phased legal status · checked 2026-08-30: most operational provisions mapped here are notified for 2027-05-13. “Notified” is not the same as “in force”—inspect all three cohorts.
- 01 / STARTThe systemStart with the customer record
Check the CRM, billing tool and any spreadsheet copies.
- 02 / DECIDEThe taskDecide who will check
Ask the person who manages each tool to confirm where the number is used.
- 03 / RETRIEVEThe recordKeep the findings together
Record the systems checked, the owner and any copies still unaccounted for.
You do the review. The guide helps you organise it.
Review official sources03 Choose your starting point
Which part of the business are you working on?
Choose a context to see a recommended system guide and your first task. You can change this choice at any time.
Your starting point You can change this selection
Start with Zoho CRM
See how data moves through this system. Then review Inventory and note which records your team can provide.
- 01 / STARTThe systemZoho CRM
Collect · form · import · manual
- 02 / DECIDEThe taskDecide who will check
Trace one recent lead or customer journey from collection to every destination.
- 03 / RETRIEVEThe recordOwned register
Which edition and data centre does the organisation use?
MAP-01 · Inventory · Notified for 13 May 2027; not yet in force · Checked 27 Sept 2026
DPDP Act commencement notification · G.S.R. 843(E)Using another system? Salesforce · Freshworks / Freshsales · HubSpot
Choosing here only changes this panel in memory. It creates no network request and writes nothing to browser storage.
Your starting point You can change this selection
Start with Google Workspace
See how data moves through this system. Then review Processors and note which records your team can provide.
- 01 / STARTThe systemGoogle Workspace
Collect · form · email · file
- 02 / DECIDEThe taskDecide who will check
Compare the last three purchased software services with the processor register.
- 03 / RETRIEVEThe recordService register
Which repositories are systems of record?
PROC-01 · Processors · Notified for 13 May 2027; not yet in force · Checked 27 Sept 2026
DPDP Act commencement notification · G.S.R. 843(E)Using another system? Microsoft 365
Choosing here only changes this panel in memory. It creates no network request and writes nothing to browser storage.
Your starting point You can change this selection
Start with WhatsApp Business / Meta messaging
See how data moves through this system. Then review Choice and note which records your team can provide.
- 01 / STARTThe systemWhatsApp Business / Meta messaging
Entry · QR · link · inbound
- 02 / DECIDEThe taskDecide who will check
Select one optional purpose and trace consent and withdrawal through every connected channel.
- 03 / RETRIEVEThe recordChoice event
Which WhatsApp product and provider are used?
CONSENT-02 · Choice · Notified for 13 May 2027; not yet in force · Checked 27 Sept 2026
DPDP Act commencement notification · G.S.R. 843(E)Choosing here only changes this panel in memory. It creates no network request and writes nothing to browser storage.
Your starting point You can change this selection
Start with Shopify / WooCommerce
See how data moves through this system. Then review Notice and note which records your team can provide.
- 01 / STARTThe systemShopify / WooCommerce
Storefront · account · cart · checkout
- 02 / DECIDEThe taskDecide who will check
Choose the busiest form and archive its exact notice, version and destination links.
- 03 / RETRIEVEThe recordVersioned notice
Which platform and extensions are active?
NOTICE-01 · Notice · Notified for 13 May 2027; not yet in force · Checked 27 Sept 2026
DPDP Act commencement notification · G.S.R. 843(E)Using another system? Razorpay
Choosing here only changes this panel in memory. It creates no network request and writes nothing to browser storage.
Your starting point You can change this selection
Start with Tally / spreadsheet hand-offs
See how data moves through this system. Then review Retention and note which records your team can provide.
- 01 / STARTThe systemTally / spreadsheet hand-offs
Enter · master · voucher · import
- 02 / DECIDEThe taskDecide who will check
Define one deletion event in operational terms and test whether the system can detect it.
- 03 / RETRIEVEThe recordEvent-based schedule
Where are company files and backups stored?
RET-01 · Retention · Notified for 13 May 2027; not yet in force · Checked 27 Sept 2026
DPDP Act commencement notification · G.S.R. 843(E)Choosing here only changes this panel in memory. It creates no network request and writes nothing to browser storage.
Your starting point You can change this selection
Start with Amazon Web Services
See how data moves through this system. Then review Safeguards and note which records your team can provide.
- 01 / STARTThe systemAmazon Web Services
Application · API · event · upload
- 02 / DECIDEThe taskDecide who will check
Choose the highest-impact system and verify three stated safeguards through current evidence.
- 03 / RETRIEVEThe recordSystem control record
Which accounts, services and regions hold each data class?
SEC-02 · Safeguards · Notified for 13 May 2027; not yet in force · Checked 27 Sept 2026
DPDP Act commencement notification · G.S.R. 843(E)Using another system? Microsoft Azure
Choosing here only changes this panel in memory. It creates no network request and writes nothing to browser storage.
02 HOW THE WORKSPACE HELPS
Give each task an owner and a record.
- 01Choose a system
Start with the billing, customer or workplace tool your team already uses.
- 02Assign the work
Decide what needs to change and who will take it forward.
- 03Keep a record
Save what you can show, and flag the questions you still need to answer.
04 Professional depth, when you need it
Keep going without losing the evidence trail.
No single score proves compliance. The workspace helps teams see what they can retrieve, what is partial, what is unknown and what is missing.
Readiness assessment
Answer ten evidence questions, review a balanced result and export a portable JSON record without giving us an email address.
Open the evidence map →B / DetailedControl catalogue
Filter 32 implementation topics. Open each record to see the mapped provision, source status, artefacts, owners and a practical test.
Browse controls →C / Sequenced90-day route
Sequence inventory, decisions, workflow design, rollout and exercises into five accountable phases.
Open the route →05 Start with a system your team knows
Follow the data before answering the assessment.
Each guide separates operating questions, evidence to save and official vendor sources. Admin paths are deliberately marked for live-console verification.
Recommended first journey
Zoho CRM
Trace a lead from collection to module fields, automations, exports and eventual deletion.Work + storage
Google Workspace
Separate authoritative records from inboxes, forms, shared drives and unmanaged copies.Messaging
WhatsApp Business / Meta messaging
Map the entry point, phone identifier, conversation, template, webhook and CRM hand-off.06 Field notes + review record
Go deeper without losing the legal-status boundary.
Eight long-form notes connect official pinpoints to product, security and operating decisions. Every note shows what is operative, what is notified for later and what is only preparation.
The seven evidence artefacts every Data Fiduciary should be able to retrieve
A DPDP notice is a product surface, not a legal footer
What the 72-hour breach detail window changes in incident response
07 Evidence beats confidence
Seven records your operating team should be able to find.
These are implementation artefacts, not a government-prescribed pack and not proof of a legal conclusion.
- 01Notice version
What was shown, where, when and for which purpose.
↗ - 02Purpose + data map
The field, reason, destination and accountable owner.
↗ - 03Choice evidence
Affirmative action and withdrawal where consent is relied on.
↗ - 04Processor record
Service, role assessment, contract, access and exit path.
↗ - 05Rights workflow
Intake, verification, search, action and response evidence.
↗ - 06Retention logic
Start event, end event, exception and system action.
↗ - 07Safeguard record
Access, protection, logs, monitoring and incident evidence.
↗
08 Provision-aware planning
“Notified” and “in force” are not interchangeable.
The Act commencement notification and final Rules place provisions into three cohorts. Every legal-topic control in this workspace shows the mapped provision’s status separately from the implementation aid.
Inspect the status ledgerRule 4
Rules 3, 5–16, 22 and 23
Dates derived from the Gazette publication date. Recheck later notifications before relying on them.