DPDP Act and IT Act: What a Business Should Review

What changes for a business?

• The DPDP Act deals with digital personal data. The IT Act covers wider areas, including electronic records and cyber offences.
• Your review should link each applicable rule to the data, documents and systems it affects. Keep useful privacy and security work already in place.

Three points to check with your adviser

Use the current legal text

• Read the DPDP Act and commencement schedule with your legal owner. The schedule gives different start dates for different provisions.
• Ask for a short list of applicable rules, start dates and business actions. Include any sector-specific requirements.

Bring these records to the review

• Data map: where personal data is collected, stored and shared, and why each use happens.
• Notices and contracts: what people and vendors have been told.
• System evidence: access settings, deletion tests and records of incidents or customer requests.
• Owners: who can approve changes to each document and system.

Turn the findings into tasks

• For each gap, name the document or system that needs a change. Assign an owner and date.
• Separate a wording change from a software change so the right team can estimate the work.
• Use the legal start dates, supplier availability and internal release dates to plan the sequence.

Sources and related guides

• budget worksheet
• four-week assessment and delivery stages