Clear notice
Tell people, in plain language, what data you collect, why, and how to withdraw consent or complain.
Guides · checklist · answers
The DPDP Act in plain language.
The eight duties, a ten-point self-check and straight answers to common questions. No legal jargon, and no signup.
Facts come from published summaries, not the Gazette. Confirm dates, fines and wording with your legal adviser.
The eight dutiesWhat the law asks of a business
Ten-point self-checkTick what you already have
Common questionsPlain answers
01 The eight duties01 02 03 04 05 06 07 08
What the law asks of a business
Every finding in a Privacy Saathi report maps to one of these.
Valid consent
Ask for consent that is free, specific, informed and clear, and make it as easy to withdraw as to give.
Collect only what you need
Use personal data only for the purpose you stated, and keep it only as long as that purpose needs.
Reasonable security
Protect data with safeguards such as encryption, access control, logging and backups, so a breach is prevented or contained.
Breach response
Tell the Data Protection Board and affected people about a breach, and send a detailed report to the Board within 72 hours.
Children’s data
Get verifiable parental consent for anyone under 18, and avoid tracking or targeted advertising aimed at children.
People’s rights
Let people see a summary of their data, correct it, have it erased, nominate someone, and complain to you first.
Logs and erasure
Keep traffic data and processing logs for at least one year, then erase data you no longer need.
02 Self-check
Ten things to have in place
Tick what your business already does. Your ticks stay in this browser only.
0 of 10 in place
Your ticks stay in this browser only. This is a self-check, not an audit.
Does the DPDP Act apply to a small business?
Yes. The Act applies to any organisation that handles personal data of people in India, whatever its size. Some duties are heavier for large or high-risk organisations, called Significant Data Fiduciaries.
Does it apply to a company outside India?
It can. The Act covers processing outside India when it relates to offering goods or services to people in India.
What counts as personal data?
Any data about an identifiable person: name, phone number, email, address, account details, location and similar. It covers digital data, and paper records that are later digitised.
When do I have to be ready?
Most duties for businesses start about 18 months after the Rules were published in November 2025, which is around May 2027. Confirm the exact dates with your legal adviser.
What is a data fiduciary?
The organisation that decides why and how personal data is processed. That is usually you, the business. Vendors that process data for you are called data processors.
Can personal data be sent outside India?
Generally yes, except to countries the government restricts. Check the current notifications and your sector rules, which can be stricter.
What does Bedre actually do?
We help with the technical and operational side: data mapping, forms and consent flows, security controls, logging, backups and breach readiness. We are not a law firm, so we do not give legal advice or certify compliance. Your legal adviser confirms what the law requires.
04 Sources
Where these facts come from
Published law-firm and advisory summaries. Always confirm against the Gazette and with your own adviser.
Turn the checklist into a real score
Free, read-only and done in about five minutes.