Rules 1, 2 and 17–21
01 A field guide for the tools you already use
Less legalese. More next steps.
Turn a privacy question into work someone can own—and evidence someone can check. Start with one familiar system, follow the record, then write down what your team can actually retrieve.
For product, operations, security and privacy teams.
Boundary educational and browser-only; no score, certification, submission or legal conclusion.
Phased legal status · checked 2026-08-30: most operational provisions mapped here are notified for 2027-05-13. “Notified” is not the same as “in force”—inspect all three cohorts.
- 01 / STARTSystem + touchpointOne system you use
Find where a personal-data record first enters or changes.
- 02 / DECIDEOwner + next actionOwner to assign
Name the person who can check the configuration and decide the next change.
- 03 / RETRIEVEEvidence + open questionAn artefact you can find
Write down what the team still needs to verify.
A practical route sheet; no account, upload or connection required.
Review official sources02 One simple loop
Understand. Act. Evidence.
- 01Understand
Start with one familiar system journey and the people who operate it.
- 02Act
Choose a practical change, a responsible owner and the next decision to verify.
- 03Evidence
Record what exists, what is partial, what is unknown and what is a gap.
03 Choose your operating context
Start with a system journey your team can recognise.
Choose a broad, non-identifying context. The workspace suggests one existing guide and readiness path; the choice stays only in this panel and is not saved.
Suggested first route Local choice · not saved
Start with Zoho CRM
Follow its six-stage data journey, then answer the Inventory readiness question using evidence you can retrieve now.
- 01 / STARTSystem + touchpointZoho CRM
Collect · form · import · manual
- 02 / DECIDEOwner + next actionOwner to assign
Trace one recent lead or customer journey from collection to every destination.
- 03 / RETRIEVEEvidence + open questionOwned register
Which edition and data centre does the organisation use?
MAP-01 · Inventory · Notified for 13 May 2027; not yet in force · Checked 27 Sept 2026
DPDP Act commencement notification · G.S.R. 843(E)Using another system? Salesforce · Freshworks / Freshsales · HubSpot
Choosing here only changes this panel in memory. It creates no network request and writes nothing to browser storage.
Suggested first route Local choice · not saved
Start with Google Workspace
Follow its six-stage data journey, then answer the Processors readiness question using evidence you can retrieve now.
- 01 / STARTSystem + touchpointGoogle Workspace
Collect · form · email · file
- 02 / DECIDEOwner + next actionOwner to assign
Compare the last three purchased software services with the processor register.
- 03 / RETRIEVEEvidence + open questionService register
Which repositories are systems of record?
PROC-01 · Processors · Notified for 13 May 2027; not yet in force · Checked 27 Sept 2026
DPDP Act commencement notification · G.S.R. 843(E)Using another system? Microsoft 365
Choosing here only changes this panel in memory. It creates no network request and writes nothing to browser storage.
Suggested first route Local choice · not saved
Start with WhatsApp Business / Meta messaging
Follow its six-stage data journey, then answer the Choice readiness question using evidence you can retrieve now.
- 01 / STARTSystem + touchpointWhatsApp Business / Meta messaging
Entry · QR · link · inbound
- 02 / DECIDEOwner + next actionOwner to assign
Select one optional purpose and trace consent and withdrawal through every connected channel.
- 03 / RETRIEVEEvidence + open questionChoice event
Which WhatsApp product and provider are used?
CONSENT-02 · Choice · Notified for 13 May 2027; not yet in force · Checked 27 Sept 2026
DPDP Act commencement notification · G.S.R. 843(E)Choosing here only changes this panel in memory. It creates no network request and writes nothing to browser storage.
Suggested first route Local choice · not saved
Start with Shopify / WooCommerce
Follow its six-stage data journey, then answer the Notice readiness question using evidence you can retrieve now.
- 01 / STARTSystem + touchpointShopify / WooCommerce
Storefront · account · cart · checkout
- 02 / DECIDEOwner + next actionOwner to assign
Choose the busiest form and archive its exact notice, version and destination links.
- 03 / RETRIEVEEvidence + open questionVersioned notice
Which platform and extensions are active?
NOTICE-01 · Notice · Notified for 13 May 2027; not yet in force · Checked 27 Sept 2026
DPDP Act commencement notification · G.S.R. 843(E)Using another system? Razorpay
Choosing here only changes this panel in memory. It creates no network request and writes nothing to browser storage.
Suggested first route Local choice · not saved
Start with Tally / spreadsheet hand-offs
Follow its six-stage data journey, then answer the Retention readiness question using evidence you can retrieve now.
- 01 / STARTSystem + touchpointTally / spreadsheet hand-offs
Enter · master · voucher · import
- 02 / DECIDEOwner + next actionOwner to assign
Define one deletion event in operational terms and test whether the system can detect it.
- 03 / RETRIEVEEvidence + open questionEvent-based schedule
Where are company files and backups stored?
RET-01 · Retention · Notified for 13 May 2027; not yet in force · Checked 27 Sept 2026
DPDP Act commencement notification · G.S.R. 843(E)Choosing here only changes this panel in memory. It creates no network request and writes nothing to browser storage.
Suggested first route Local choice · not saved
Start with Amazon Web Services
Follow its six-stage data journey, then answer the Safeguards readiness question using evidence you can retrieve now.
- 01 / STARTSystem + touchpointAmazon Web Services
Application · API · event · upload
- 02 / DECIDEOwner + next actionOwner to assign
Choose the highest-impact system and verify three stated safeguards through current evidence.
- 03 / RETRIEVEEvidence + open questionSystem control record
Which accounts, services and regions hold each data class?
SEC-02 · Safeguards · Notified for 13 May 2027; not yet in force · Checked 27 Sept 2026
DPDP Act commencement notification · G.S.R. 843(E)Using another system? Microsoft Azure
Choosing here only changes this panel in memory. It creates no network request and writes nothing to browser storage.
04 Professional depth, when you need it
Keep going without losing the evidence trail.
No single score proves compliance. The workspace helps teams see what they can retrieve, what is partial, what is unknown and what is missing.
Readiness assessment
Answer ten evidence questions, review a balanced result and export a portable JSON record without giving us an email address.
Open the evidence map →B / DetailedControl catalogue
Filter 32 implementation topics. Open each record to see the mapped provision, source status, artefacts, owners and a practical test.
Browse controls →C / Sequenced90-day route
Sequence inventory, decisions, workflow design, rollout and exercises into five accountable phases.
Open the route →05 Start with a system your team knows
Follow the data before answering the assessment.
Each guide separates operating questions, evidence to save and official vendor sources. Admin paths are deliberately marked for live-console verification.
Recommended first journey
Zoho CRM
Trace a lead from collection to module fields, automations, exports and eventual deletion.Work + storage
Google Workspace
Separate authoritative records from inboxes, forms, shared drives and unmanaged copies.Messaging
WhatsApp Business / Meta messaging
Map the entry point, phone identifier, conversation, template, webhook and CRM hand-off.06 Field notes + review record
Go deeper without losing the legal-status boundary.
Eight long-form notes connect official pinpoints to product, security and operating decisions. Every note shows what is operative, what is notified for later and what is only preparation.
The seven evidence artefacts every Data Fiduciary should be able to retrieve
A DPDP notice is a product surface, not a legal footer
What the 72-hour breach detail window changes in incident response
07 Evidence beats confidence
Seven records your operating team should be able to find.
These are implementation artefacts, not a government-prescribed pack and not proof of a legal conclusion.
- 01Notice version
What was shown, where, when and for which purpose.
↗ - 02Purpose + data map
The field, reason, destination and accountable owner.
↗ - 03Choice evidence
Affirmative action and withdrawal where consent is relied on.
↗ - 04Processor record
Service, role assessment, contract, access and exit path.
↗ - 05Rights workflow
Intake, verification, search, action and response evidence.
↗ - 06Retention logic
Start event, end event, exception and system action.
↗ - 07Safeguard record
Access, protection, logs, monitoring and incident evidence.
↗
08 Provision-aware planning
“Notified” and “in force” are not interchangeable.
The Act commencement notification and final Rules place provisions into three cohorts. Every legal-topic control in this workspace shows the mapped provision’s status separately from the implementation aid.
Inspect the status ledgerRule 4
Rules 3, 5–16, 22 and 23
Dates derived from the Gazette publication date. Recheck later notifications before relying on them.