DPDP Niyam
Log in Create account

May 2027 Core DPDP duties become enforceable

Find out where your website falls short of the DPDP Act.

Paste your URL. Niyam reads your public pages, shows what is missing or risky, and tells you what to fix first, in plain language.

  • Free, no card
  • Reads public pages only
  • Results in about a minute
example-store.in · sample report
58

Partly ready

4 gaps to close before May 2027

  • ✓Privacy notice found Pass
  • !Ad tracker loads before consent High
  • !Rights request channel unclear Medium
  • !No grievance contact published High
  • ✓Site served over HTTPS Pass

What non-compliance can cost

The Act sets penalty caps by type of failure. The largest applies to weak security safeguards.

₹250 crore

Maximum penalty per breach of duty

Applies when reasonable security safeguards are not in place. Failure to report a breach or to protect children’s data can cost up to ₹200 crore.

See every penalty tier
Consent

Consent has to be a clear action

Pre-ticked boxes and trackers that fire before a visitor agrees are the first things a scan finds.

Breach

72 hours to report in detail

You tell the Board and affected people without delay, then send full details within 72 hours.

From scan to a plan you can act on

Four steps. You can stop after the first one and still get a useful report.

Scan your site

Paste your URL. Niyam reads your public pages and checks for privacy policy, consent, trackers, forms, rights and grievance details.

Read your report

You get a readiness score, the exact gaps found, and a plain-language explanation of each one.

Take the assessment

Answer a short guided questionnaire about consent, notices, rights, security, vendors and children’s data.

Fix with an action plan

Get a prioritised list of what to fix first, written for your business and checked against the Act.

Ask a question. Get an answer you can use.

Niyam AI explains the Act in everyday language. It also turns your scan and assessment results into a prioritised fix list.

Ask Niyam AI

AI answers are guidance, not legal advice.

My shop collects phone numbers at checkout. What do I need to add?
You need three things before May 2027: a notice at the point of collection that says what you collect and why, a clear consent action that is not pre-ticked, and a published contact for data questions. If you only use the number for the order, you can rely on that stated purpose and avoid reusing it for marketing without fresh consent.

Where the rollout stands

The Act is already in force in stages. The date that matters most for most businesses is next May.

Read the full timeline

  1. Nov 2025

    DPDP Rules notified

    The Rules are published and the Data Protection Board is set up. Rollout is phased over 18 months.

  2. Mid-Nov 2026

    Consent Manager framework

    Registration of Consent Managers begins. This is the next milestone on the calendar.

Common questions

Does the DPDP Act apply to my business?
It applies if you process digital personal data in India, or outside India when you offer goods or services to people in India. Size does not exempt you, although the Government can notify relaxations for some start-ups.
What counts as personal data?
Any data about an individual who can be identified from it. Names, phone numbers, emails, addresses, device IDs and account data all count when they are in digital form.
When do I have to be compliant?
The Rules roll out in phases. Core duties such as notice, consent, safeguards and breach reporting become enforceable around mid-May 2027. Starting early is cheaper than fixing under pressure.

All questions

Start with a free scan

One URL, about a minute, no account needed.

Scan my website