DPDPA readiness in 90 days: a plan for mid-market enterprises

The short answer Full obligations under India's Digital Personal Data Protection Act take effect on 13 May 2027. Discovery and remediation usually take 6–9 months. A mid-market enterprise can reach a defensible baseline in about 90 days by working in four phases: baseline, plan, approved execution, and continuous proof.

Most enterprises with 200–1,000 employees have no dedicated privacy engineering team. Compliance falls to a CISO, CTO or General Counsel who already has other responsibilities. Global GRC suites are priced for larger organisations, and a consulting spreadsheet goes out of date the next time engineering ships a schema change. The regulator will ask for evidence, not intentions.

What is at stake

• Security safeguards (Section 8(5)): penalties of up to ₹250 crore per contravention.
• Breach notification (Section 8(6)): notify the Data Protection Board and affected principals. Plan your operations around a 72-hour clock.
• Children's data (Section 9): verifiable parental consent, with penalties of up to ₹200 crore.
• Significant Data Fiduciaries (Section 10): additional duties, including periodic assessments.
• Notice, consent, erasure and grievance rights (Sections 5, 6, 8(7), 11–13).

Days 1–14: baseline and discovery

• Run a structured gap assessment against a versioned control library.
• Build a live inventory of the systems that hold personal data, including SaaS tools and cloud storage.
• Classify fields by category: identity, financial, health, children's and biometric.
• Deliver a Board-level readiness summary with estimated exposure.

Days 15–45: remediation planning

• Turn findings into specific, typed actions, each with a blast-radius limit.
• Produce a dry-run, before-and-after diff for every action that changes data.
• Write and validate a rollback plan for each action before anything is approved.
• Have the DPO or CISO review the plan in a single approval queue.

Days 46–75: approved execution

Execute only what a named person has approved, one action at a time. Retention purges, consent changes and data-subject request workflows go live in this phase. After each action, reconcile what actually happened against what was approved.

Days 76–90+: closure and continuous proof

• Seal evidence in write-once storage with content hashes.
• Keep an append-only, hash-chained audit ledger an auditor can verify independently.
• Watch MeitY notifications and Board orders, and map each change to the affected controls.
• Report posture to the Board monthly.

The principle underneath

Speed does not have to cost accountability. Agents can do the discovery, classification and planning, which is the slow, manual part. A person still signs every change, and that signature is what makes the evidence defensible.

This guide is general information, not legal advice. Confirm obligations with your counsel.

See where you stand in 5 minutes. Axiom Proof's free gap-scan scores you against the same 46-control library a paid engagement uses.