Learn a practical DPDP compliance timeline for startups and businesses. Follow this 90-day roadmap to prepare your organization for India's data protection law.
One of the biggest questions founders ask is:
"How long does DPDP compliance take?"
The honest answer: it depends on your business.
A startup with one product and ten employees can usually establish a basic privacy program much faster than an enterprise with multiple departments, legacy systems, and thousands of customers.
The good news: you don't need to finish everything in one week. DPDP compliance works best as a structured project with clear milestones — and you have until 13 May 2027 for full compliance under the Act and DPDP Rules notified 13 November 2025.
This guide provides a practical 90-day implementation roadmap you can adapt. It mirrors the week-by-week plan in DPDPKit's compliance workbook.
Related guides: Compliance checklist · Ultimate guide (2026) · DPDP Rules explained · Free readiness check · DPDPKit
Many companies fail because they try to "be compliant" without a plan. Instead, break the work into manageable phases:
A roadmap makes the project measurable and easier to manage — and gives you a defensible answer when investors or enterprise buyers ask about your privacy posture.
Start here: Take the free 50-question readiness check to baseline your gaps before Week 1.
Before creating your timeline, collect information about:
You'll use this throughout the project. DPDPKit's Data Inventory tab is built to capture exactly this.
The first step is understanding your current situation — not writing policies.
DPDPKit template: Data Inventory tab + Gap Assessment tab
Once you know what data you process, document your privacy program.
DPDPKit templates: All 11 Word documents + workbook registers
Put policies into practice across product, website, and operations.
Review and update:
Review registration, permissions, consent flows, profile management, and account deletion.
Review CRM, HR software, payroll, customer support, and marketing automation for data handling alignment.
For each processor (AWS, GCP, Azure, Razorpay, Stripe, HubSpot, Freshdesk, etc.):
Test your processes before you consider implementation complete.
Verify someone can:
Log each test in the Rights Request Register.
Review MFA, backups, encryption in transit, password policies, role-based access, and log retention.
Run a 1-hour tabletop exercise. Example scenario:
"A vulnerable dependency exposes customer emails. No evidence of exploitation yet."
Ask: Who detects it? Who investigates? When do you notify users? When do you intimate the Board? Where is the 72-hour report template?
Log the drill in your Breach Register — including near-misses.
Privacy is ongoing — not a one-time project before May 2027.
Summary view. For week-by-week tasks with owners and status columns, use the 90-Day Roadmap tab in DPDPKit.
| Week | Goal | Key deliverable |
|---|---|---|
| 1 | Data discovery | Data Inventory v1 |
| 2 | Gap assessment | Scored gap list + priorities |
| 3 | Core documentation | Draft Privacy Policy + notices |
| 4 | Governance | Grievance Officer live |
| 5 | Consent implementation | Live consent flow + logging |
| 6 | Rights handling | Export + erase runbook tested |
| 7 | Security | Top gap items → Done |
| 8 | Vendors | DPAs ≥ 80% signed |
| 9 | Breach readiness | Tabletop drill completed |
| 10 | HR and children | Employee notice + under-18 decision |
| 11 | Training and SDF | Team trained; assessment recorded |
| 12 | Review | Gap ≥ 80%; quarterly calendar set |
DPDP compliance is cross-functional.
| Role | Responsibility |
|---|---|
| Founder / CEO | Owns strategy, resources, Grievance Officer appointment |
| Product | Customer journeys, consent flows, account deletion |
| Engineering | Consent logging, deletion APIs, access controls, security |
| HR | Employee data, privacy notice, offboarding deletion |
| Operations | Workbook tracking, vendor chase, register maintenance |
| Legal / CA | Policy review and sign-off (recommended before publishing) |
You do not need a dedicated compliance team at startup stage — you need a named owner and a workbook.
By the end of 90 days you should have:
Get the workbook and templates →
Many businesses:
A phased roadmap reduces these issues. See also: Common mistakes in our pillar guide.
You may draft initial documents quickly, but implementing governance, reviewing systems, and embedding processes usually takes several weeks.
For many startups, a focused 90-day project provides a practical foundation. Larger or more complex organisations may need 8–12 weeks or longer — but should still finish before 13 May 2027.
Many startups self-implement using templates and a workbook, with counsel or CA review at the end. Consulting firms often quote ₹3–5 lakh for full implementation; DPDPKit starts at ₹4,999 for the document and workbook layer.
Yes. Products, vendors, and processing activities change. Schedule quarterly reviews through May 2027 and at least annually after that.
Yes. Many startups begin with structured spreadsheets and registers. DPDPKit's 8-tab workbook is designed for this stage and tracks % complete on the dashboard.
Building all of this manually takes time. DPDPKit includes the templates and workbook this timeline references:
₹4,999 — instant download after payment.
Not sure where to start on the timeline?
Our free DPDP readiness check — 50 questions, about 2 minutes — tells you which phase to prioritise and names your top three gaps.
A successful DPDP compliance program isn't built in a day. It develops through well-planned steps: understand your data, document your practices, implement controls, test them, and review regularly until 13 May 2027 and beyond.
For startups, aim for progress over perfection — but aim for 80%+ on your gap assessment before the deadline. A structured 90-day timeline reduces risk, improves operational discipline, and builds customer trust without overwhelming your team.
Next steps:
This guide is for informational purposes only and does not constitute legal advice. Have your counsel or CA review your customised documents before you rely on them.
Written by
Founder, UXLaunch Lab
11+ years across fintech, Web3, and SaaS. Shipped RoleGrowth — an AI-powered career platform — end-to-end in 8 weeks.
Frequently asked questions
Learn everything about India's Digital Personal Data Protection (DPDP) Act, including key concepts, compliance requirements, penalties, FAQs, and a practical checklist.
Read articleUnderstand the DPDP Rules 2025 with this practical guide for Indian startups and businesses. Learn key requirements, compliance steps, FAQs, and best practices.
Read articleLearn about DPDP Act penalties, how financial penalties are determined, common compliance mistakes, and practical steps businesses can take to reduce privacy risks.
Read article