DPDP compliance software for Indian businesses
The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, turned into the work a business has to do, and the software Perimattic is building to help do it.
Last updated 22 October 2026
What is DPDP compliance software?
DPDP compliance software helps an Indian business meet the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025: map the personal data it holds, give compliant notices, record consent, answer rights requests, report breaches and erase data on time. Those duties apply from 13 May 2027.
Where the DPDP Compliance Suite is today
The Perimattic DPDP Compliance Suite is in development. It is not yet live or for sale, and the features on this page are planned, not shipped.
Sign upWhat does DPDP compliance mean for a business?
The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) sets the rules for handling personal data in digital form, or collected on paper and digitised later (section 3). A business that decides why and how personal data is processed is a Data Fiduciary (section 2(i)); the person the data is about is the Data Principal (section 2(j)). The DPDP Rules, 2025 fill in how each duty is done.
In practice, DPDP compliance comes down to a handful of jobs:
- Process personal data only with valid consent or for one of the “certain legitimate uses” in section 7 (section 4).
- Give a clear, itemised notice before asking for consent (section 5 and Rule 3).
- Let people withdraw consent as easily as they gave it (section 6(4)).
- Protect the data with reasonable security safeguards (section 8(5) and Rule 6).
- Tell the Data Protection Board and affected people about a personal data breach (section 8(6) and Rule 7).
- Erase data once its purpose is served, unless a law requires keeping it (section 8(7) and Rule 8).
- Answer requests for access, correction, erasure and grievance redressal (sections 11 to 13 and Rule 14).
- Get verifiable parental consent before processing a child’s data (section 9 and Rule 10).
These duties, and the penalties for breaking them, apply from 13 May 2027. The highest penalty is up to ₹250 crore, for failing to take reasonable security safeguards, under section 33 and the Schedule to the Act.
What will the Perimattic DPDP Compliance Suite do?
Each feature of the DPDP Compliance Suite maps to a specific duty in the Act or the Rules.
| Feature | What it is meant to do | DPDP basis |
|---|---|---|
| Personal-data inventory | Map what personal data you collect, where it lives and why you hold it | Sections 5, 8(7) and 11 |
| Notice builder | Draft privacy notices with the Rule 3 items, in English and languages of the Eighth Schedule to the Constitution | Section 5, Rule 3 |
| Consent records | Capture consent, keep the record and make withdrawal as easy as giving consent | Sections 6(4) and 6(10) |
| Rights requests | Handle access, correction, erasure, nomination and grievances, with response-time tracking | Sections 11 to 14, Rule 14 |
| Breach response | Run intimations to affected Data Principals and the reports to the Data Protection Board | Section 8(6), Rule 7 |
| Retention and erasure | Set erasure schedules and send the 48-hour pre-erasure intimation | Section 8(7), Rule 8 |
| Children’s data | Run a verifiable parental consent workflow | Section 9, Rule 10 |
| Processor register | List vendors who process personal data for you and track their contracts | Sections 8(1) and 8(2), Rule 6(1)(f) |
When do the DPDP duties apply?
On 13 November 2025 the Government published two Gazette notifications: G.S.R. 843(E), which brings the Act’s sections into force (Act commencement notification), and G.S.R. 846(E), the DPDP Rules, 2025, whose Rule 1 sets their own dates (DPDP Rules, 2025; PIB release). Both follow the same three steps:
| Date | Act sections in force | Rules in force | What they bring |
|---|---|---|---|
| 13 November 2025 | Sections 1(2), 2, 18 to 26, 35, 38 to 43, 44(1) and 44(3) | Rules 1, 2 and 17 to 21 | Definitions and the set-up of the Data Protection Board: appointment of its Chairperson and Members, their terms, its meetings, its working as a digital office and its staff |
| 13 November 2026 | Sections 6(9) and 27(1)(d) | Rule 4 | Registration and obligations of Consent Managers, with the conditions in the First Schedule, and the Board’s power to act on breaches of registration conditions |
| 13 May 2027 (eighteen months after publication) | Sections 3 to 5, 6(1) to 6(8) and 6(10), 7 to 17, 27 (except 27(1)(d)), 28 to 34, 36, 37 and 44(2) | Rules 3, 5 to 16, 22 and 23 | Every duty on a business, every Data Principal right and the penalties: notice, consent, security safeguards, breach intimation, retention and erasure, children’s data, Significant Data Fiduciaries, transfers outside India, appeals and calls for information |
The 13 May 2027 date carries the work for a typical business: the Act’s duties and penalties apply from then. Building a data inventory, rewriting notices and setting up a breach drill all take time, so most businesses will want to start well before then.
Which businesses is the DPDP Compliance Suite for?
Any business that handles customers’, patients’, students’ or employees’ personal data is a Data Fiduciary. Some sectors meet particular provisions:
| Sector | Where DPDP bites hardest | Guide |
|---|---|---|
| Startups | Every core duty applies; section 17(3) allows notified exemptions for startups, but none is in the Rules | DPDP for startups |
| Hospitals and clinics | Health data, medical-emergency legitimate uses, and the Fourth Schedule carve-out for health services to children | DPDP for hospitals |
| Fintech and lenders | KYC notices, sharing with other Data Fiduciaries, and the section 17(1)(f) exemption for tracing defaulters’ assets | DPDP for fintech |
| E-commerce | Marketing consent, and the Third Schedule three-year erasure rule for platforms with two crore or more registered users in India | DPDP for e-commerce |
| Schools and edtech | Parental consent for students under 18, and the Fourth Schedule carve-out for educational institutions | DPDP for schools |
Which free DPDP tools can you use today?
Two tools are free to use now; a one-time free sign-up shows the results:
- DPDP compliance checker: answer a few questions about your business and see which duties apply and where the gaps are.
- DPDP privacy notice generator: draft a privacy notice that covers the items Rule 3 requires.
Both are starting points, not legal advice. See all DPDP tools.
Where can you read up on the DPDP Act and Rules?
- DPDP Act, 2023 explained: the whole Act in plain English, section by section.
- DPDP Rules, 2025: all 23 rules and seven Schedules, with their start dates.
- DPDP compliance checklist: every duty, its source and when it applies.
- Data Fiduciary: who it is and what it owes Data Principals.
- Data Protection Board of India: how the Board inquires, penalises and hears complaints.
- Consent Manager: registration, obligations and how consent flows through one.
- DPDP vs GDPR: the main differences for businesses that deal with both.
What is Perimattic building for DPDP compliance?
The Perimattic DPDP Compliance Suite is software for Indian businesses to run their DPDP Act and Rules duties in one place. The plan covers a personal-data inventory, a notice builder, consent records, rights requests, a breach response workflow, retention and erasure schedules, a parental consent workflow and a processor register.
Status: The Perimattic DPDP Compliance Suite is in development; none of this is available to use yet. It carries no certification or government approval, Perimattic is not a registered Consent Manager, and using it will not by itself make a business compliant.
General guidance, not legal advice. Checked against the DPDP Act, 2023 and DPDP Rules, 2025 on 22 October 2026.
Start with the law itself
DPDP compliance, answered
Does the DPDP Act apply to small businesses?
Yes. The Act applies to any person that processes digital personal data in India, or processes it abroad in connection with offering goods or services to people in India, and “person” includes individuals, firms and companies of any size. Section 17(3) lets the Central Government exempt notified classes, including startups, from some duties, but the DPDP Rules, 2025 do not themselves contain such an exemption.
Does using DPDP compliance software make a business compliant?
No. Software can keep records, send notices and track deadlines, but under section 8(1) the Data Fiduciary stays responsible for complying with the Act and Rules, including for processing done by its Data Processors. Compliance depends on what the business actually does with personal data, not on the tool it uses.
What is the deadline for DPDP compliance?
13 May 2027. The Act’s commencement notification (G.S.R. 843(E)) and the DPDP Rules, 2025, both published on 13 November 2025, bring the Board into being at once and Consent Manager registration from 13 November 2026, but the duties on businesses, the rights of Data Principals and the penalties all apply from 13 May 2027.
Want DPDP compliance built around how your business handles data?
Sign up to tell us what personal data you handle, follow the build and be first to try the DPDP Compliance Suite when it opens.
Sign up