The State of DPDP Readiness in India

What the scan covers

ComplyDP checked the public websites of 1,680 companies against disclosure checks drawn from the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. A visitor can see the same items the scan records: privacy notices, consent banners, grievance contacts, and rights information. The scan is automated and external. It is not an audit, and the companies are not a random sample of all Indian businesses.

Where public sites fall short

73.7% had no consent banner. Without one, non-essential tracking runs without the free, specific, informed, unconditional, and unambiguous consent the Act requires.

63.3% showed no parental consent mechanism. Children's data obligations under s.9 carry a penalty of up to ₹200 crore.

33.2% offered no language option on the privacy notice. s.5(3) lets a person read the notice in English or in any language in the Eighth Schedule.

19.8% had no privacy notice link. 17.2% did not disclose the right to nominate another person to exercise rights. 5.2% named no grievance officer or privacy contact. That last item is the one most companies have started.

No large industry is clear

The consent-banner gap is above 60% in every large industry group in the study. Retail is at 92.3%, food and beverages at 87.3%, and financial services at 82.4%. Hospitals and health care have the lowest consent gap, at 61.9%, and the highest share of notices with no language option, at 44.4%.

In the published benchmark of sector leaders, no company passed all 41 checks. 11 of the 26 top-three scores passed fewer than 40% of them.

What the dates mean

The DPDP Rules were notified on 13 November 2025, when the Data Protection Board of India was constituted. Notice, consent, Data Principal rights, security safeguards, breach reporting, and children's data obligations apply from 13 May 2027. The government has discussed bringing some of those dates forward. Penalties under the Act go up to ₹250 crore.

How a finding should be read

The public website is where a regulator, a customer, or a journalist looks first. A missing banner or notice is the easiest obligation to check and the easiest to fix. Dispute a finding through the published methodology if a result is wrong or out of date.

Expanded implementation notes for compliance leads

This article focuses on regulatory timing and market readiness under India's Digital Personal Data Protection Act, 2023 and the 2025 Rules. Use it alongside your RoPA, notice library, and breach playbook when preparing for Data Protection Board scrutiny.

Distinct questions your board should ask this quarter

Does The State of DPDP Readiness in India change how we document consent, respond to grievances within prescribed timelines, or prove erasure? If not yet, schedule a cross-functional review with legal, security, and product owners.

Keep this page fresh after each release

Revisit the guidance whenever you add a new data collection field, SDK, processor, or India-facing marketing channel so crawlers and customers always see current practice—not stale 2024 assumptions.