About DPDPConsentKit
Making DPDP readiness easier to understand and act on
India’s Digital Personal Data Protection Act introduces responsibilities for organisations that handle digital personal data. DPDPConsentKit is building practical tools to make those responsibilities clearer and preparation easier to manage.
Why we are building this
Privacy work should be understandable in day-to-day business
DPDP readiness can involve many connected tasks: explaining why personal data is collected, recording choices, responding to requests, managing vendors, protecting information and deciding when it should be deleted. For a small team, it can be difficult to know where to begin.
Our goal is to turn complex requirements into clear explanations, useful checks and practical workflows. We want organisations to understand what they need to review, identify gaps and take the next step with better information.
We create resources for organisations across sectors, including education, healthcare, financial services, hospitality, housing, e-commerce and software. The details differ by organisation; a website check or general guide cannot determine whether a business is legally compliant.
What we are building
A practical toolkit for DPDP work
We have products for consent management, data principal rights requests, breach records, retention and erasure, parental consent, and WordPress. We are preparing these products for public release soon.
We are developing the toolkit to help organisations bring related privacy tasks into clear, manageable workflows as they prepare for the DPDP Act.
- Consent management
- Data rights portal
- Breach register
- Retention and erasure
- Parental consent
- WordPress plugin
How we approach the work
Clear information. Practical preparation. Honest limits.
-
Explain the requirement
We aim to describe DPDP concepts in plain language and connect practical guidance to the relevant Act or Rules where possible.
-
Help find the next step
Our resources and tools are intended to help teams review their current practices and organise the work needed to improve them.
-
Be clear about what a tool can do
Software can support a compliance programme, but it cannot replace an organisation’s decisions, internal processes or advice from a qualified lawyer.
The law and its timeline
Preparation is happening in phases
The Digital Personal Data Protection Act was enacted in 2023. The Government notified the DPDP Rules and the Act’s commencement schedule on 13 November 2025. Different provisions take effect on different dates; most of the Act’s core duties are scheduled to commence 18 months after notification, on 13 May 2027.
That staged timeline gives organisations time to understand how the law applies to their activities and prepare their processes. The right steps will depend on the personal data an organisation handles and the purposes for which it handles it.
Read the official commencement notification and the DPDP Rules, 2025.
Start where you are
Take a first look at your website’s readiness
The readiness check reviews publicly visible website signals and provides a starting point for further review. It is not a legal audit or a certification of compliance.