A customer signs up on your website right now. Where does their phone number go next?
Think about it for a second. Into your CRM, sure. Probably your email tool too. An analytics script may have recorded their whole session. A support agent may have pasted it into a ticket last month, and that ticket still sits in a tool nobody has opened since.
Most businesses can’t trace that path. Under India’s new data protection law, not knowing is no longer a harmless gap.
The clock is already running
The Digital Personal Data Protection Act, 2023 governs how organizations collect and use digital personal data in India. It also reaches businesses outside India if they offer goods or services to people here.
The government notified the DPDP Rules in November 2025 and is switching them on in phases. Two dates matter:
- 13 November 2026: consent manager provisions take effect. That’s next month.
- 13 May 2027: the core obligations land for every business handling personal data. Notices, consent, security safeguards, breach reporting, deletion, and handling people’s requests about their data.
The penalties are not symbolic. Failing to take reasonable security safeguards can cost up to ₹250 crone. Failing to report a breach to the Data Protection Board and the people affected can cost up to ₹200 crone.
Seven months sounds like plenty. It isn’t, once you count how many teams this touches. And MeitY has already asked industry for views on cutting the timeline from 18 months to 12.
Why your privacy policy won’t save you
Here’s the trap. Companies update the privacy policy, publish it, and consider the job done.
A privacy policy is a promise. The DPDP Act asks whether you keep it.
Try these on your own business:
- Can your team list every type of personal data you collect, and say why you need each one?
- Does your consent screen match what your product actually does with the data?
- If a customer asks you to delete their data tomorrow, who receives that request? Does the data really disappear, including from vendor tools?
- Which vendors hold your customers’ data right now?
- If you found a breach at 2am on a Saturday, who would you call first?
If you hesitated on two or more, you’re in the same spot as most Indian companies. And every hesitation is a gap.
These answers don’t live in one place. Product knows some. Engineering knows some. Operations and legal hold the rest. A website scanner can confirm your privacy page loads. It can’t tell you whether a deletion request ever reaches someone who can act on it.
The gaps that will hurt you are the ones nobody can see from the outside.
So where do you actually start?
This is where most teams freeze. The Act is long, the Rules are dense, and nobody owns the full picture. Hiring consultants feels premature when you don’t yet know how big the problem is.
You don’t need every answer yet. You need an honest look at where you stand today. That’s exactly what Aspheric’s free DPDP readiness check is built for.
Ten minutes to see your real exposure
The check asks plain-language questions about how your organization handles personal data. When you finish, you see the areas that may need action, the practices you report already having, and the answers that deserve a closer look.
It takes about 10 minutes. No account, no card, and your answers stay in your browser.
Be clear about what it is: the result reflects your answers. It can’t audit your systems or declare you compliant. What it does is turn a vague worry into a specific list you can take to your team on Monday.
And if you answer “We’re not sure” a few times, good. That tells you where to dig, who to pull in, and what evidence you’ll need.
Find out before someone else does
The businesses in trouble in May 2027 won’t be the ones with imperfect answers today. They’ll be the ones who never asked the questions.
Start with what your team knows. Mark what it can’t confirm. Then fix the riskiest gap first.
