How to Achieve India’s DPDP Compliance for Non-Production Data & AI Workflows

Like many other countries, India has made moves to protect consumers’ data. Comparable to the European Union’s General Data Protection Regulation (GDPR), India’s Digital Personal Data Protection  (DPDP) Act establishes new, higher standards for data privacy, timely breach notification, and consent management.  

I’ve heard from many big banks and other financial institutions that need to meet DPDPA compliance requirements, and these organisations are concerned about having the available time and support for their infrastructure necessary for DPDP.

So how can you manage the workload that comes with maintaining DPDP compliance? Let’s take a look at DPDP rules, best practices, and ways your enterprise can make meeting its requirements easier.  

What is the DPDPA?  

The Digital Personal Data Protection Act (DPDPA) is India’s first comprehensive data protection law. Enacted by the Parliament of India in August 2023, the law’s draft rules were not published until January 2025.  

The DPDPA includes new parameters surrounding: 

• Consumer Rights: Individuals have control over their personal information and must give their consent for data processing. They can access their data, see how it’s being used, correct information, and revoke consent if desired. 
• Data Protection Roles: The DPDPA requires dedicated positions, including a Data Protection Officer and Data Protection Board. 
• Breach Notification: Organisations must notify affected individuals and their board about data breaches in a timely manner. 

When Does the India Digital Personal Data Protection Act Take Effect?  

Due to the delay between its enactment in 2023 and publication in January 2025, the DPDPA won’t be in full effect until May 2027. As of this writing, Rules 1, 2, and 17–21 are the only active requirements for DPDP compliance.  

The regulation is being implemented over a 12–18-month timeline with certain rules taking effect in the coming months: 

• Rules 1, 2, and 17-21: Already in effect. 
• Rule 4: 13 November 2026
• Rules 3, 5–16, 22 and 23 — 13: May 2027 

Despite the final rules coming into effect later, it’s essential that organizations operating in India get ready now. DPDP compliance can be time-intensive, so you should prepare while there’s no threat of fines or legal action due to non-compliance.  

Organisations & Info Subject to the India Digital Personal Data Protection Act 

Take a look at which organisations and what information (such as personally identifiable information) is subject to DPDPA:  

The 4 Main Things You Need to Know to Ensure DPDP Compliance

Keep in mind these 4 requirements for the DPDPA — and how automating data compliance processes can simplify them. 

1. Breach Notification 

If a breach occurs, the organisation must notify affected individuals right away and follow up with a detailed report to the Data Protection Board within 72 hours. The organisations must detect and investigate these breaches quickly and retain logs for at least one year. 

Perforce Delphix — with its near-real-time sync, ransomware recovery, and integrated data masking — can make enterprises more resilient. By masking data in advance, you can mitigate the repercussions and risk associated with a data breach. And if one does occur, you can sync data fast into an immutable vault for recovery point objectives.  

2. Security Safeguards 

DPDP compliance requires security safeguards (such as data encryption, obfuscation, masking, or virtual tokens) that provide an added layer of data privacy and protection.  

To avoid slowing down data provisioning for use cases like testing and QA, Delphix will identify sensitive data and automate the masking process. By leveraging Delphix, enterprises have masked and protected 77.2% more data and data environments and achieved 58% faster time to develop an application.* 

Read more >> The Technical Guide to Data Masking with Perforce Delphix

3. Access Controls 

As part of DPDP compliance, organisations must keep access logs, conduct regular reviews, and maintain strict access controls over personal data. With Delphix, you can choose who has access to what data and keep logs tracking that access.  

4. Data Minimisation 

The DPDPA encourages organisations to limit the personal data they retain, and Delphix can create ephemeral, virtual data copies that you can set to automically dispose after a certain amount of time. That way, you only keep necessary data and minimize exposure in non-production environments — all while using 10x less storage.  

How Does the DPDPA Apply to AI & Agentic Workflows? 

While there are emerging regulations (like the EU AI Act) that regulate AI, the DPDPA does not specifically call it out. It does, however, set parameters for how organisations process personal data, including within AI workflows and systems. No matter how they process the data, these organisations must consider the principles of DPDPA: purpose limitation, data minimisation, etc. 

Consequences of DPDP Non-Compliance  

With the May 2027 compliance deadline looming, DPDPA non-compliance is becoming a greater concern to enterprises who are subject to it.  

 If an organisation is non-compliant, they can face a variety of consequences including: 

• Rs 50 crore to Rs 250 crore fine (approximately $5.2 million to $26.1 million USD). 
• Reputational damage among customers. 
• Legal repercussions. 

That’s why it’s important for organizations to prepare for DPDPA now. Don’t let the deadline catch you off guard and compromise the well-being of your enterprise.   

Preparing for DPDPA: Case Studies on Successful Compliance 

While DPDPA is a new regulation to India, much of what it regulates isn’t new. DPDP compliance best practices resemble GDPR’s, and Delphix has helped numerous organizations stay compliant with regulations they’re subject to. Take these case studies for example: 

• Because of GDPR, The University of Manchester has experienced greater complexity with data collection and data sharing. But with Delphix, the institution was able to slash data refresh times from 16 days down to 40 minutes while still meeting regulatory standards. 

• Sky Italia was under a tight data privacy compliance deadline: It needed to achieve GDPR compliance in just five months. Delphix helped the European media company mask production data with full referential integrity and slash operational costs by 30%.

   

*IDC Business Value White Paper, sponsored by Delphix, by Perforce, The Business Value of Delphix, #US52560824, December 2024