Imagine a May 2027 morning when your inbox shows a breach you didn’t know about, under a law you meant to read “next quarter.” The clock is already running, and you’d have 72 hours to respond.
This guide covers the deadlines, what a “DPDP certificate” really is, what to do after you get one, and what ignoring the law costs.
What Is the DPDP Act, and Why 2027?
The Digital Personal Data Protection Act, 2023 is India’s first dedicated law on how digital personal data is collected, stored, used, and shared. There is no “DPDP Act 2027.” The 2027 is when the main obligations start, because the rollout is phased.
- 13 November 2025: Definitions and Data Protection Board provisions came into force, without an immediate general compliance burden for businesses.
- 13 November 2026 (this week): The Consent Manager framework becomes operational, with registration requiring a ₹2 crore minimum net worth and an independently certified platform.
- 13 May 2027: The remaining substantial provisions on consent, notices, data fiduciary duties, and data principal rights take effect. Sources differ by a day or two, so call it mid-May 2027.
Is There a DPDP Certificate? The Honest Answer
No. The DPDP Act is a law, not a standard like ISO 27001. The Data Protection Board judges compliance against what you actually do, not against a certificate you hold.
When a vendor says “DPDP certified,” it usually means one of these:
- A readiness assessment: a consultant reviewed your practices against the Act and Rules
- An independent audit or attestation: a third party examined your controls and issued a report
- A related certification: ISO 27001 or ISO 27701, genuine standards whose controls overlap with DPDP’s security requirements
All three are useful evidence of effort. None is a legal shield.
Red flags in a “DPDP certificate” offer:
- It’s called “government-approved” or “official”
- It’s issued in days with no review of your systems
- It promises protection from penalties
Why Teams Still Pursue an Assessment
Enterprise buyers and banks increasingly ask vendors about data protection. In Singapore, early privacy certification became a commercial differentiator in B2B procurement. A credible report helps you answer security questionnaires faster, win trust with enterprise and BFSI clients, and show the Board you acted in good faith.
What Real Compliance Looks Like
Whatever badge you hold, the Board will look at your practice. From May 2027 you need:
- A data inventory: what you collect, why, where it sits, who sees it
- Clear notices and consent: plain language, specific purpose, easy withdrawal
- Reasonable security safeguards: encryption, access control, logging, monitoring
- A 72-hour breach process: detect, assess, escalate, and notify within the prescribed period rmaindia
- A rights-handling system: access, correction, erasure, and grievances
- Retention and deletion rules: don’t keep data longer than needed
- Verifiable parental consent for children’s data
- Vendor contracts that bind processors to the same standards
Larger or higher-risk organisations may be designated Significant Data Fiduciaries. They must appoint a Data Protection Officer, run impact assessments, and undergo audits.
After You Get an Assessment or Certification: What the Organisation Must Do
A report is the starting line, not the finish.
- Close every gap it lists, with owners and deadlines
- Run a breach drill, because the 72-hour clock won’t wait while you find the playbook
- Name a grievance contact, and a DPO if you’re an SDF
- Review annually and after major product, vendor, or data-flow changes
- Keep evidence: logs, consent records, training attendance, audit trails
- Train staff continuously, since most breaches begin with human error
What Happens If You Don’t Act?
1. Heavy penalties. The Act’s Schedule sets fixed-rupee ceilings, not turnover percentages, applied per instance of non-compliance. The main tiers are:
- Failing to maintain reasonable security safeguards: up to ₹250 crore
- Failing to notify a breach: up to ₹200 crore
- Breaching children’s data obligations: up to ₹200 crore
- Significant Data Fiduciary obligations: up to ₹150 crore
- Other violations: up to ₹50 crore
These are ceilings, and the Board decides each case. A single incident can trigger more than one violation.
2. Lost contracts. Enterprise clients are adding DPDP clauses to vendor agreements. Without a documented programme, you can be dropped from procurement lists before any regulator calls.
3. The breach spiral. Without a tested process, you miss the 72-hour window, and one incident becomes two violations.
4. Reputation damage. Trust takes years to build and one headline to lose.
5. Investor and board scrutiny. Weak privacy practices can lower valuations or delay funding rounds during due diligence.
6. Last-minute chaos. Rewriting consent flows, renegotiating vendor contracts, and re-engineering systems at once costs far more than doing it over months.
Special Note for Banks, NBFCs, and Fintechs
Financial institutions have the most complex data journeys: onboarding, KYC, AML, credit scoring, fraud detection, marketing, and third-party processors. They must reconcile DPDP requirements with RBI and SEBI rules, especially for cross-border payment data. For BFSI, this is an operational-risk programme, not just a legal checklist. rmaindia
Your 30-Day Action Plan
Week 1, Discover: Map all personal data and flows. Check whether you could qualify as an SDF.
Week 2, Assess: Run a gap analysis against the Act and Rules. List every vendor that touches your data.
Week 3, Build: Draft plain-language notices and consent flows. Write a breach playbook with a 72-hour timeline.
Week 4, Assign: Name a compliance owner and grievance contact. Brief leadership and schedule training.
Want a head start? Download our free 25-point DPDP Readiness Checklist, covering data mapping, consent, breach response, and vendor contracts, and get your personalised gap score.
Frequently Asked Questions
1. Is there an official DPDP certificate?
No. The government doesn’t issue one, and no official body can award it. Compliance is judged by the Data Protection Board against what you actually do. Private assessments, audits, and certifications like ISO 27001 or ISO 27701 can support your case, but they aren’t legal proof.
2. When does the DPDP Act come into force?
In phases. Consent Manager provisions apply from 13 November 2026, and the remaining substantial provisions from 13 May 2027. Some sources cite 12 or 14 May, so treat it as mid-May 2027.
3. What are the penalties for DPDP non-compliance?
The Act sets fixed-rupee ceilings, applied per instance. The highest is ₹250 crore for failing to maintain reasonable security safeguards. Failing to notify a breach and breaching children’s data obligations can each draw up to ₹200 crore. These are maximums, and the Board decides each case.
4. What is the breach reporting timeline under the DPDP Rules?
Organisations need processes to detect, assess, escalate, and notify within a 72-hour period. Build and rehearse your breach playbook well before May 2027.
5. Does the DPDP Act apply to small businesses and startups?
Yes. It applies to organisations handling digital personal data regardless of size. The government can exempt certain notified Data Fiduciaries, including startups, from parts of the Act, but don’t plan around an exemption that may not cover you.
The Bottom Line
A “DPDP certificate” is a marketing phrase, not a legal status. What counts is a living programme you can evidence at any moment. Companies that build one early earn something money can’t easily buy: customer trust. You have months, not years, so start this week with a data audit, a consent review, or a team briefing.
Ready to start? Talk to the experts at Evvo Technology for a DPDP readiness review and a clear, practical roadmap for your business.
Worried about what compliance will cost? Before you sign any quotation, read why DPDP quotations run into lakhs and what you should actually be paying for.
