Before moving into the practical fundamentals, here’s a short, honest self-check.
1. Could you list every place personal data lives in your organisation, right now, without a scramble?
2. For each of those, could you say whether it’s processed under consent or a specific legitimate use?
3. Does your current notice actually meet the Rules’ content requirements — or is it a generic paragraph?
4. If someone exercised a right today — access, correction, erasure — is there a real process to handle it?
5. If a breach happened tomorrow, does anyone know what the first hour looks like?
2. For each of those, could you say whether it’s processed under consent or a specific legitimate use?
3. Does your current notice actually meet the Rules’ content requirements — or is it a generic paragraph?
4. If someone exercised a right today — access, correction, erasure — is there a real process to handle it?
5. If a breach happened tomorrow, does anyone know what the first hour looks like?
Most organisations answer “yes” confidently to one or two of these and honestly to none of the rest. That’s a normal starting point, not a failing one — lets works through each of these fundamentals individually, in enough practical detail to close the gap.
Readiness isn’t a single yes-or-no answer. It’s five separate questions, and most organisations are further along on some than others.
SOURCES The DPDP Rules, 2025 — official text, MeitY — https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf