India's DPDPA Compliance Deadline: May 2027

Data Privacy & DPDP Law Firm in India

Free compliance tools and expert guidance for businesses navigating India and global privacy law.

7
Offices Across India
97
Country Network
106+
Privacy Articles
20+
Years Experience
🇮🇳 India Focus

DPDPA 2023 — Are You Ready?

India's comprehensive data protection law is here. With enforcement approaching May 2027, organisations must act now.

Aug 2023
DPDPA Enacted
Digital Personal Data Protection Act, 2023 receives Presidential assent
Jan 2025
Draft Rules Published
DPDP Rules, 2025 released for public consultation
Nov 2025
Final Rules Notified
Rules finalised and enforcement machinery begins
May 2027
Full Enforcement
All obligations in effect, penalties enforceable
₹250 Cr
Maximum Penalty
Per contravention
44
Sections
In the DPDPA
3-Phase
Rollout
Graduated enforcement
SDF
Obligations
Significant Data Fiduciaries

Why KSK for Data Privacy?

A full-spectrum data privacy practice combining deep regulatory expertise with technology-driven solutions.

Pan-India Presence

8 offices covering every major business hub. Local knowledge of state-level compliance requirements.

97-Country Network

Cross-border data compliance through our international network. One firm for global privacy needs.

End-to-End Advisory

From compliance audits to regulatory filings, breach response to policy drafting. Full-spectrum privacy support.

Jidesh Kumar

Jidesh Kumar

Managing Partner
IP, Corporate & Litigation

Advises multinational corporations on IT Act compliance, data protection frameworks, and cross-border data transfers. Leads the firm's IP and technology practice.

Rajesh Sivaswamy

Rajesh Sivaswamy

Senior Partner
M&A, Private Equity & Cross-Border

Drives the firm's legal technology initiatives including AI-powered compliance tools. Advises on data governance for corporate transactions and regulated industries.

Dhruv Kaushal

Dhruv Kaushal

Partner
Technology, Data Privacy & AI

Advises technology, media and telecom companies on DPDPA and privacy compliance, AI governance and emerging-technology law. Recognised as Counsel of the Year for Data Privacy.

Aniket Ghosh

Aniket Ghosh

Partner
Data Privacy & Competition Law

Advises on DPDPA compliance, privacy audits, and competition law intersections with data regulation. Handles regulatory filings and enforcement matters.

Sindhuja Kashyap

Sindhuja Kashyap

Partner
Corporate Compliance & PE

Advises private equity and corporate clients on compliance frameworks including data protection obligations in M&A transactions and fund structuring.

Latest Insights

Expert analysis on India's DPDP Act and global data privacy.

View All Insights →
11 Jun 2026

From Human Fault to Algorithmic Accountability: Tort Law in the AI Era

Artificial Intelligence (AI) is transforming the way decisions are made across critical sectors worldwide. This shift from automation to autonomy presents significant challenges for traditional tort law, which has historically been built around concepts such as human fault, foreseeability and direct causation. Introduction Unlike traditional software systems that operate according to predefined instructions, modern AI […]

Read More
9 Jun 2026

Cyber Operations, Artificial Intelligence and the Law of State Responsibility

Examine how artificial intelligence, cyber-attacks and digital surveillance challenge traditional principles of State responsibility under international law.

Read More
30 Apr 2026

Cyber Law in India: A Critical Analysis of the Information Technology Act, 2000

Introduction Cyber law refers to the body of legal principles governing the use of the internet, digital technologies, and electronic communications. It encompasses a wide range of issues, including cybercrime, e-commerce, data protection, online privacy, and intellectual property rights in the digital environment. The rapid proliferation of digital technologies particularly the internet, mobile devices, and […]

Read More
27 Apr 2026

D&O Insurance in the Age of Data Governance: Premium Realities under India’s DPDP Regime

Introduction India’s enactment of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) marks a decisive shift toward a modern data protection regime anchored in accountability, consent, and enforcement. While the statute is primarily directed at “data fiduciaries,” its implications extend well beyond operational compliance. At the boardroom level, the Act has triggered a reassessment […]

Read More
23 Apr 2026

Click-Wrap Agreements and India’s Data Privacy Law: Aligning Digital Consent with the DPDP Framework

Introduction The architecture of modern digital commerce rests on an unassuming yet powerful legal device: the click-wrap agreement. Whether subscribing to a SaaS platform, downloading a mobile application, or accepting updated privacy terms, users routinely click "I Agree," thereby forming binding contracts. While courts globally have generally upheld such agreements, their intersection with evolving data […]

Read More
20 Apr 2026

Checklist Before Collecting Indian User Data by Multinational Corporations

Navigating India’s Digital Personal Data Protection Act, 2023 Introduction: India’s Data Privacy Inflection Point India is not merely a market but the world’s largest pool of digital consumers, with over 900 million internet users and a rapidly expanding digital economy. For Multinational Corporations (MNCs), collecting personal data from Indian users whether for targeted advertising, product […]

Read More

Stay Ahead of Privacy Regulations

Weekly updates on DPDPA developments, global enforcement actions, and compliance tips. Join 500+ privacy professionals.

No spam. Unsubscribe anytime. We respect your privacy (obviously).

Data privacy and DPDP lawyers in India

King Stubb & Kasiva is an Indian law firm whose data privacy practice advises companies on the Digital Personal Data Protection Act, 2023, the DPDP Rules, 2025 and global privacy laws such as the GDPR and CCPA. The practice is led by partners Jidesh Kumar, Rajesh Sivaswamy, Dhruv Kaushal, Aniket Ghosh and Sindhuja Kashyap, and works from nine offices across seven Indian cities.

DPDP compliance advisory

Gap assessments, data mapping, privacy notices, consent design and a compliance roadmap to 13 May 2027.

Data Protection Officer services

Setting up and supporting the DPO function, including for Significant Data Fiduciaries that must appoint one.

Significant Data Fiduciary readiness

Annual DPIAs, independent audits and governance for entities notified as Significant Data Fiduciaries.

Data breach response

Breach intimation to the Data Protection Board and affected individuals, CERT-In reporting and regulator engagement.

DPDP compliance for SaaS and technology companies

Processor contracts, cross-border processing and product privacy for technology businesses.

Guide to the DPDP Act, 2023

How the Act and Rules work, who they apply to and when each obligation commences.

Data privacy lawyers across India

The same data privacy team advises from each of King Stubb & Kasiva's offices, covering DPDP readiness assessments, consent and notice design, cross-border transfers, breach response and proceedings before the Data Protection Board.

Data privacy lawyers in New Delhi

RNM Tower, 5th Floor, Metro Pillar No. 331, i4, B1, NH-19, Mohan Cooperative Industrial Estate, New Delhi 110044

Telephone +91-11-41318190
New Delhi office

Data privacy lawyers in Mumbai

Nariman Point: Office No. 61, 6th Floor, Atlanta Building, Jamnalal Bajaj Road, Mumbai 400021

Lower Parel: 301A, 3rd Floor, Piramal Towers, Peninsula Corporate Park, Senapati Bapat Marg, Mumbai 400013

Andheri West: 802, 8th Floor, REMI Commercio, Shah Industrial Estate, Veera Desai Road, Mumbai 400053

Telephone +91-22-69010531
Mumbai office

Data privacy lawyers in Bengaluru

1A, Lavelle Mansion, 1/2 Lavelle Road, Bengaluru 560001

Telephone +91-80-41179111
Bengaluru office

Data privacy lawyers in Chennai

211, Alpha Wing, Second Floor, Raheja Towers, 177 Anna Salai, Chennai 600002

Telephone +91-44-28605955
Chennai office

Data privacy lawyers in Hyderabad

404, Shangrila Plaza, Road No. 2, Banjara Hills, Opposite KBR Park, Hyderabad 500034

Telephone +91-40-48516011
Hyderabad office

Data privacy lawyers in Pune

Bootstart Cowork, First Floor, Arcadian Building, Plot No. 12, Lane 5A, North Main Road, Koregaon Park, Pune 411001

Telephone +91-22-62372076
Pune office

Data privacy lawyers in Kochi

1st Floor, Manavalan Building, Amulya Street, Banerji Road, Ernakulam, Kochi 682018

Telephone +91-484-3592950
Kochi office

Clients in states without a King Stubb & Kasiva office, including Gujarat, West Bengal and Rajasthan, are advised by the same team. Contact the data privacy practice or run the free DPDP compliance scorecard.

DPDP guidance by topic

Commentary from the data privacy practice, grouped by the questions clients ask most.

Frequently asked questions

When do the DPDP Act obligations apply?

The DPDP Rules, 2025 were notified on 13 November 2025. The Consent Manager provisions apply from 13 November 2026, and the core obligations on notice, consent, security safeguards, breach intimation, data principal rights and retention apply from 13 May 2027.

Does every company need a Data Protection Officer?

No. Only entities notified as Significant Data Fiduciaries must appoint a Data Protection Officer based in India. Other Data Fiduciaries must publish the business contact details of a person who can answer questions about how they process personal data.

Does the DPDP Act apply to companies outside India?

Yes, where they process digital personal data in connection with offering goods or services to people in India.

What are the penalties under the DPDP Act?

The Schedule to the Act sets maximum penalties by type of breach: up to ₹250 crore for failing to take reasonable security safeguards, ₹200 crore for failing to notify a personal data breach or for breaching the obligations on children’s data, ₹150 crore for breaching the additional obligations of a Significant Data Fiduciary, and ₹50 crore for other breaches. The Data Protection Board decides the amount in each case.

What does the King Stubb & Kasiva data privacy practice advise on?

DPDP compliance and gap assessments, privacy notices and consent design, Data Protection Officer support, Significant Data Fiduciary readiness, vendor and data processing agreements, breach response, cross-border transfers, and GDPR and CCPA compliance for Indian companies with global operations.