{"id":33128,"date":"2026-09-13T23:48:53","date_gmt":"2026-09-13T18:18:53","guid":{"rendered":"https:\/\/carajput.com\/blog\/?p=33128"},"modified":"2026-09-14T01:03:34","modified_gmt":"2026-09-13T19:33:34","slug":"indias-dpdp-act-2023","status":"publish","type":"post","link":"https:\/\/carajput.com\/blog\/indias-dpdp-act-2023\/","title":{"rendered":"Practical Roadmap for complying with India&#8217;s DPDP Act 2023"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_58 counter-hierarchy ez-toc-counter ez-toc-light-blue ez-toc-container-direction\">\n<p class=\"ez-toc-title\">Page Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6aa711fd65097\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #000000;color:#000000\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #000000;color:#000000\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6aa711fd65097\"  aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/carajput.com\/blog\/indias-dpdp-act-2023\/#Practical_Roadmap_for_complying_with_Indias_Digital_Personal_Data_Protection_DPDP_Act_2023\" title=\"Practical Roadmap for complying with India&#8217;s Digital Personal Data Protection (DPDP) Act, 2023\">Practical Roadmap for complying with India&#8217;s Digital Personal Data Protection (DPDP) Act, 2023<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/carajput.com\/blog\/indias-dpdp-act-2023\/#Step-by-step_blueprint_for_becoming_DPDP-compliant\" title=\"Step-by-step blueprint for becoming DPDP-compliant, \">Step-by-step blueprint for becoming DPDP-compliant, <\/a><ul class='ez-toc-list-level-3'><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/carajput.com\/blog\/indias-dpdp-act-2023\/#Data_Discovery_Classification\" title=\" Data Discovery &amp; Classification:\"> Data Discovery &amp; Classification:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/carajput.com\/blog\/indias-dpdp-act-2023\/#Purpose_Processing_Mapping\" title=\" Purpose &amp; Processing Mapping\"> Purpose &amp; Processing Mapping<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/carajput.com\/blog\/indias-dpdp-act-2023\/#Consent_Notice_Management\" title=\" Consent &amp; Notice Management\"> Consent &amp; Notice Management<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/carajput.com\/blog\/indias-dpdp-act-2023\/#Data_Principal_Rights_Management\" title=\" Data Principal Rights Management\"> Data Principal Rights Management<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/carajput.com\/blog\/indias-dpdp-act-2023\/#Data_Governance_Protection\" title=\" Data Governance &amp; Protection\"> Data Governance &amp; Protection<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/carajput.com\/blog\/indias-dpdp-act-2023\/#Audit_Evidence_Continuous_Compliance\" title=\" Audit, Evidence &amp; Continuous Compliance\"> Audit, Evidence &amp; Continuous Compliance<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/carajput.com\/blog\/indias-dpdp-act-2023\/#Compliance_Journey_Circular_Framework\" title=\"Compliance Journey (Circular Framework): \">Compliance Journey (Circular Framework): <\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/carajput.com\/blog\/indias-dpdp-act-2023\/#Key_Deliverables_Mentioned\" title=\"Key Deliverables Mentioned: \">Key Deliverables Mentioned: <\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/carajput.com\/blog\/indias-dpdp-act-2023\/#Benefits_of_DPDP_Compliance\" title=\"Benefits of DPDP Compliance\">Benefits of DPDP Compliance<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/carajput.com\/blog\/indias-dpdp-act-2023\/#For_Insolvency_Professionals_IPs_RPs_and_Liquidators\" title=\"For Insolvency Professionals (IPs), RPs, and Liquidators\">For Insolvency Professionals (IPs), RPs, and Liquidators<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n<h2><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-33132\" src=\"https:\/\/carajput.com\/blog\/wp-content\/uploads\/2026\/09\/WhatsApp-Image-2026-09-10-at-1.41.32-AM.jpeg\" alt=\"India's Digital Personal Data Protection (DPDP) Act, 2023\" width=\"1536\" height=\"1024\" srcset=\"https:\/\/carajput.com\/blog\/wp-content\/uploads\/2026\/09\/WhatsApp-Image-2026-09-10-at-1.41.32-AM.jpeg 1536w, https:\/\/carajput.com\/blog\/wp-content\/uploads\/2026\/09\/WhatsApp-Image-2026-09-10-at-1.41.32-AM-300x200.jpeg 300w, https:\/\/carajput.com\/blog\/wp-content\/uploads\/2026\/09\/WhatsApp-Image-2026-09-10-at-1.41.32-AM-1024x683.jpeg 1024w, https:\/\/carajput.com\/blog\/wp-content\/uploads\/2026\/09\/WhatsApp-Image-2026-09-10-at-1.41.32-AM-768x512.jpeg 768w, https:\/\/carajput.com\/blog\/wp-content\/uploads\/2026\/09\/WhatsApp-Image-2026-09-10-at-1.41.32-AM-800x533.jpeg 800w\" sizes=\"(max-width: 1536px) 100vw, 1536px\" \/><\/h2>\n<h2><span class=\"ez-toc-section\" id=\"Practical_Roadmap_for_complying_with_Indias_Digital_Personal_Data_Protection_DPDP_Act_2023\"><\/span><span style=\"color: #000080;\"><strong>Practical Roadmap for complying with India&#8217;s Digital Personal Data Protection (DPDP) Act, 2023<\/strong><\/span><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Practical roadmap for complying with India&#8217;s Digital Personal Data Protection (DPDP) Act, 2023. The DPDP Act governs how organizations collect, use, store, and protect personal data of individuals (called Data Principals). You should ensure Data is accessed only by authorized persons, and consent and notices are appropriately managed where required. Personal information shared in CIRP\/Liquidation is limited to what is legally necessary; adequate cybersecurity safeguards are maintained. And data retention and deletion practices are documented.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Step-by-step_blueprint_for_becoming_DPDP-compliant\"><\/span><span style=\"color: #000080;\"><strong>Step-by-step blueprint for becoming DPDP-compliant, <\/strong><\/span><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Step-by-step blueprint for becoming DPDP-compliant, starting from identifying personal data to continuously auditing and improving privacy controls. The DPDP Act: The Digital Personal Data Protection (DPDP) Act, 2023, is India&#8217;s privacy law designed to protect personal data of individuals. Ensure organizations use data lawfully, Give individuals control over their personal information. Impose penalties for non-compliance. Examples of personal data name, mobile number, email address, Aadhaar details, PAN details, employee records, and customer information. The framework divides DPDP compliance into six key stages.<\/p>\n<ol>\n<li>\n<h3><span class=\"ez-toc-section\" id=\"Data_Discovery_Classification\"><\/span><span style=\"color: #000080;\"><strong> Data Discovery &amp; Classification:<\/strong><\/span><span class=\"ez-toc-section-end\"><\/span><\/h3>\n<\/li>\n<\/ol>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>Objective: Know what personal data your organization possesses.<\/li>\n<li>Activities: Discover data across systems, applications, emails, and files; identify data belonging to Customers, employees, vendors, and business partners. Classify data based on sensitivity<\/li>\n<li>Understand: Where data is stored, who can access it, how it moves within the organization<\/li>\n<li>Why Important? You cannot protect data unless you know what data exists, where it is located, and who uses it.<\/li>\n<li>Output: Data Inventory and Classification Register<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ol start=\"2\">\n<li>\n<h3><span class=\"ez-toc-section\" id=\"Purpose_Processing_Mapping\"><\/span><span style=\"color: #000080;\"><strong> Purpose &amp; Processing Mapping<\/strong><\/span><span class=\"ez-toc-section-end\"><\/span><\/h3>\n<\/li>\n<\/ol>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>Objective: Understand why personal data is being processed.<\/li>\n<li>Activities: Map data to business purposes. Identify legal basis for processing. Document: Departments handling data, systems processing data and third-party sharing arrangements. Example:<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<table width=\"792\">\n<tbody>\n<tr>\n<td>Data<\/td>\n<td>Purpose<\/td>\n<\/tr>\n<tr>\n<td>Employee PAN<\/td>\n<td>Salary processing<\/td>\n<\/tr>\n<tr>\n<td>Customer Mobile Number<\/td>\n<td>Order delivery<\/td>\n<\/tr>\n<tr>\n<td>Vendor Details<\/td>\n<td>Payment processing<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>Why Important: DPDP allows data processing only for lawful and specific purposes.<\/li>\n<li>Output: Processing Maps and Purpose Registry<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ol start=\"3\">\n<li>\n<h3><span class=\"ez-toc-section\" id=\"Consent_Notice_Management\"><\/span><span style=\"color: #000080;\"><strong> Consent &amp; Notice Management<\/strong><\/span><span class=\"ez-toc-section-end\"><\/span><\/h3>\n<\/li>\n<\/ol>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>Objective: Ensure transparent communication and valid consent.<\/li>\n<li>Activities: Create privacy notices. Inform individuals: What data is collected, why it is collected, How it will be used, obtain consent where required, maintain consent records, and provide easy withdrawal mechanisms. Example: Before collecting a customer&#8217;s email address: &#8220;Your email will be used for order updates and promotional offers. You may withdraw consent anytime.&#8221;<\/li>\n<li>Why Important? Consent is one of the central principles of the DPDP Act.<\/li>\n<li>Output: Privacy Notices and Consent Repository<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ol start=\"4\">\n<li>\n<h3><span class=\"ez-toc-section\" id=\"Data_Principal_Rights_Management\"><\/span><span style=\"color: #000080;\"><strong> Data Principal Rights Management<\/strong><\/span><span class=\"ez-toc-section-end\"><\/span><\/h3>\n<\/li>\n<\/ol>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>Objective: Enable individuals to exercise their legal rights.<\/li>\n<li>Under DPDP, individuals have the right to access: know what personal data the organization holds.<\/li>\n<li>Right to Correction: Correct inaccurate information.<\/li>\n<li>Right to Update: Update personal records.<\/li>\n<li>Right to Erasure: Request deletion when permitted.<\/li>\n<li>Right to Grievance Redressal: Raise privacy-related complaints.<\/li>\n<li>Activities: Establish request-handling processes, create online portals or help desks. And respond within prescribed timelines.<\/li>\n<li>Why Important? DPDP emphasizes individual control over personal data.<\/li>\n<li>Output: Rights Request Management System<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ol start=\"5\">\n<li>\n<h3><span class=\"ez-toc-section\" id=\"Data_Governance_Protection\"><\/span><span style=\"color: #000080;\"><strong> Data Governance &amp; Protection<\/strong><\/span><span class=\"ez-toc-section-end\"><\/span><\/h3>\n<\/li>\n<\/ol>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>Objective: Put governance and security controls in place.<\/li>\n<li>Activities: Policies &amp; SOPs<\/li>\n<li>Development: Privacy Policy, Data Retention Policy, Information Security Policy and Incident Response Plan.<\/li>\n<li>Roles &amp; Responsibilities: Assign accountability to Management, Legal teams, IT teams and Compliance officers<\/li>\n<li>Data Retention: Keep data only as long as necessary and securely delete obsolete data.<\/li>\n<li>Vendor Management: Ensure third parties comply with privacy requirements.<\/li>\n<li>Security Controls: Implement encryption, Access controls, multi-factor authentication (MFA), backup mechanisms, and monitoring systems<\/li>\n<li>Why Important? The DPDP Act requires organizations to implement reasonable security safeguards.<\/li>\n<li>Output: Policies, SOPs, Security Controls, Vendor Governance Framework<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ol start=\"6\">\n<li>\n<h3><span class=\"ez-toc-section\" id=\"Audit_Evidence_Continuous_Compliance\"><\/span><span style=\"color: #000080;\"><strong> Audit, Evidence &amp; Continuous Compliance<\/strong><\/span><span class=\"ez-toc-section-end\"><\/span><\/h3>\n<\/li>\n<\/ol>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>Objective: Continuously monitor and improve compliance.<\/li>\n<li>Activities: Conduct internal audits, perform gap assessments, maintain records of processing activities (RoPA), carry out data protection impact assessments (DPIA) where necessary, prepare for regulatory inspections, train employees, monitor compliance performance.<\/li>\n<li>Why Important? Compliance is not a one-time project; it is an ongoing process.<\/li>\n<li>Output: Audit Reports, Compliance Dashboards, Risk Assessments, Regulatory Readiness Documentation<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h3><span class=\"ez-toc-section\" id=\"Compliance_Journey_Circular_Framework\"><\/span><span style=\"color: #000080;\"><strong>Compliance Journey (Circular Framework): <\/strong><\/span><span class=\"ez-toc-section-end\"><\/span><\/h3>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>&#8220;Compliant &#8211; Confident &#8211; Future Ready&#8221; This means DPDP compliance requires continual improvement involving<\/li>\n<li>People: Employee awareness and defined responsibilities.<\/li>\n<li>Process: Policies, procedures, and compliance workflows<\/li>\n<li>Technology: Security tools, data discovery solutions, and consent management platforms<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h3><span class=\"ez-toc-section\" id=\"Key_Deliverables_Mentioned\"><\/span><span style=\"color: #000080;\"><strong>Key Deliverables Mentioned: <\/strong><\/span><span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p style=\"padding-left: 40px;\">By implementing the six stages, an organization should have Data Inventory &amp; Classification, Processing Maps &amp; Purpose Register, Privacy Notices &amp; Consent Records, Rights Request Management System, Policies, SOPs &amp; Vendor Governance, RoPA, DPIA &amp; Risk Assessments, and Audit Reports &amp; Compliance Dashboard.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Benefits_of_DPDP_Compliance\"><\/span><span style=\"color: #000080;\"><strong>Benefits of DPDP Compliance<\/strong><\/span><span class=\"ez-toc-section-end\"><\/span><\/h3>\n<ul>\n<li>Build Trust: Customers and employees trust organizations that protect data.<\/li>\n<li>Reduce Risk: Avoid data breaches and legal penalties.<\/li>\n<li>Improve Efficiency: Better organized data and automated processes.<\/li>\n<li>Enable Growth: Strong privacy practices enhance reputation and business opportunities.<\/li>\n<\/ul>\n<h3><span class=\"ez-toc-section\" id=\"For_Insolvency_Professionals_IPs_RPs_and_Liquidators\"><\/span><span style=\"color: #000080;\"><strong>For Insolvency Professionals (IPs), RPs, and Liquidators<\/strong><\/span><span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-33133\" src=\"https:\/\/carajput.com\/blog\/wp-content\/uploads\/2026\/09\/WhatsApp-Image-2026-09-13-at-4.43.11-PM.jpeg\" alt=\"Digital Personal Data Protection (DPDP) Act, 2023\" width=\"1236\" height=\"1600\" srcset=\"https:\/\/carajput.com\/blog\/wp-content\/uploads\/2026\/09\/WhatsApp-Image-2026-09-13-at-4.43.11-PM.jpeg 1236w, https:\/\/carajput.com\/blog\/wp-content\/uploads\/2026\/09\/WhatsApp-Image-2026-09-13-at-4.43.11-PM-232x300.jpeg 232w, https:\/\/carajput.com\/blog\/wp-content\/uploads\/2026\/09\/WhatsApp-Image-2026-09-13-at-4.43.11-PM-791x1024.jpeg 791w, https:\/\/carajput.com\/blog\/wp-content\/uploads\/2026\/09\/WhatsApp-Image-2026-09-13-at-4.43.11-PM-768x994.jpeg 768w, https:\/\/carajput.com\/blog\/wp-content\/uploads\/2026\/09\/WhatsApp-Image-2026-09-13-at-4.43.11-PM-1187x1536.jpeg 1187w, https:\/\/carajput.com\/blog\/wp-content\/uploads\/2026\/09\/WhatsApp-Image-2026-09-13-at-4.43.11-PM-800x1036.jpeg 800w\" sizes=\"(max-width: 1236px) 100vw, 1236px\" \/><\/p>\n<ul>\n<li>As an IRP\/RP\/Liquidator, DPDP compliance becomes relevant because you handle employee records, creditor information, shareholder details, KYC documents, financial records, and personal contact information<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Practical Roadmap for complying with India&#8217;s Digital Personal Data Protection (DPDP) Act, 2023 Practical roadmap for complying with India&#8217;s Digital Personal Data Protection (DPDP) Act, 2023. The DPDP Act governs how organizations collect, use, store, and protect personal data of individuals (called Data Principals). You should ensure Data is accessed only by authorized persons, and &hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[115],"tags":[10560],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/carajput.com\/blog\/wp-json\/wp\/v2\/posts\/33128"}],"collection":[{"href":"https:\/\/carajput.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/carajput.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/carajput.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/carajput.com\/blog\/wp-json\/wp\/v2\/comments?post=33128"}],"version-history":[{"count":5,"href":"https:\/\/carajput.com\/blog\/wp-json\/wp\/v2\/posts\/33128\/revisions"}],"predecessor-version":[{"id":33144,"href":"https:\/\/carajput.com\/blog\/wp-json\/wp\/v2\/posts\/33128\/revisions\/33144"}],"wp:attachment":[{"href":"https:\/\/carajput.com\/blog\/wp-json\/wp\/v2\/media?parent=33128"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/carajput.com\/blog\/wp-json\/wp\/v2\/categories?post=33128"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/carajput.com\/blog\/wp-json\/wp\/v2\/tags?post=33128"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}