What the DPDPA rules notification means for your compliance timeline

Once rules are notified, the Act's obligations stop being aspirational. The compliance work splits cleanly into two buckets: things that apply from day one, and things phased in on a schedule tied to entity size and data sensitivity.

Immediate obligations

• Notice requirements for any new collection of personal data
• Consent Manager registration groundwork if you route consent through one
• Breach notification readiness — the 72-hour clock doesn't wait for your DPO to be hired
• Grievance redressal channel — a working one, not a placeholder inbox

Where teams are furthest behind

In every audit we've run this quarter, the same gap shows up: processing activity records exist as a spreadsheet someone updated once, six months ago. That's not a records-of-processing failure on paper — it's a failure the moment a Data Protection Board asks for a current one.

The fix isn't a bigger spreadsheet. It's treating your processing activities as a living record tied to actual system changes, so the document is never more than one deploy behind reality.