DPDP readiness

There is no DPDP certification. Compliance is demonstrated to the Data Protection Board of India if it inquires into a breach or complaint; penalties reach ₹250 crore for failing to take reasonable security safeguards. Significant Data Fiduciaries must also appoint a Data Protection Officer, an independent data auditor and run periodic data protection impact assessments.

Every data fiduciary processing digital personal data in India, and processing outside India connected with offering goods or services to people in India. The DPDP Rules, 2025 were notified on 13 November 2025: consent-manager rules apply after 12 months and most obligations — notice, security safeguards, breach intimation, retention, children's data — after 18 months, around 13 May 2027.

• Notice and consent (s.5, s.6). Itemised notice in clear language and consent that is free, specific, informed, unconditional and unambiguous, as easy to withdraw as to give.
• Security safeguards (s.8(5), Rule 6). Encryption, obfuscation, masking or virtual tokens; access control; logs and monitoring kept for one year; backups; security terms in processor contracts.
• Breach intimation (s.8(6), Rule 7). Inform the Board and each affected person without delay, with a detailed report to the Board within 72 hours.
• Retention and erasure (s.8(7), Rule 8). Erase data when the purpose is served or consent is withdrawn, with prescribed periods for some classes of fiduciary and advance notice before erasure.
• Rights and grievances (s.11–14). Access, correction, completion, erasure and nomination, with a grievance redressal mechanism.
• Children's data (s.9, Rule 10). Verifiable parental consent; no tracking, behavioural monitoring or targeted advertising directed at children.

6 RuleFix rules run when DPDP is selected on a project. 3 of the framework's controls have at least one rule mapped to them. The table is generated from the rule catalogue, so it always matches what the scanner runs.

A mapping means the rule checks part of that control in application code or configuration. Passing every rule does not satisfy a control: each one also needs process, people and infrastructure work that no code scanner can see.

Most of an audit is organisational. You need these in place regardless of what any scan finds:

• Notice content and consent records. The wording of notices and the consent ledger (RuleFix's website scanner checks that a privacy notice and cookie consent exist, not what they say).
• Rights handling. Request intake, identity verification, response timelines and grievance officer contact.
• Breach response. Detection, the 72-hour report to the Board and notices to affected people.
• Retention schedules. Erasure jobs, retention periods and the 48-hour advance notice before erasure where the Rules require it.
• Contracts and transfers. Processor agreements and transfers outside India (s.16).
• Children and Significant Data Fiduciary duties. Age and parental verification, DPO, data audits and DPIAs.

Select DPDP on each project in scope. Every scan then records findings with stable fingerprints. An issue becomes Fixed when a complete scan no longer finds it, when your agent resolves it with a confirming re-scan, or when a person marks it — and every status change is written to the audit log with who made it. The evidence report (print to PDF or JSON) collects the latest scan, score history, open and resolved findings and triage decisions per framework.

• Rule 6 lists encryption, masking, access control and logs. RuleFix findings for Aadhaar, PAN, bank identifiers, unencrypted personal-data columns and personal data in logs, fixed and re-verified, are evidence of those safeguards in code.
• Keep monthly evidence reports with DPDP selected; if the Board inquires after a breach, a history of safeguards checked and fixed before the incident is what "reasonable security safeguards" will be judged against.
• Personal data in logs matters twice: Rule 6 expects logs for one year, so whatever personal data you log is retained that long.

• Map the personal data you collect, why, where it is stored and who processes it.
• Rewrite notices to the DPDP standard and record consent with timestamp, notice version and purpose.
• Turn on RuleFix with DPDP selected; fix Aadhaar, identifier, unencrypted-column and personal-data-in-logs findings.
• Encrypt or tokenise identifiers at rest and mask them on display and in logs.
• Set up access logging, keep logs for one year and review access to personal data.
• Write the breach runbook: who decides, who notifies, and the 72-hour report to the Board.
• Build request handling for access, correction and erasure, and publish the grievance contact.
• Add security and erasure clauses to every processor contract.