A 44-instrument DPDP Act 2023 compliance framework, in seven layers.
JurisTatva's framework maps the obligations in the DPDP Act, 2023 and the DPDP Rules, 2025 to 44 deliverables across seven layers: resolutions, registers, notices, consent forms, policies, agreements and SOPs. Some are statutory requirements and others are recommended practice. Most obligations apply from 13 May 2027.
From data map to board adoption, in four stages.
Each stage closes with a reviewable deliverable, not a status update — so your compliance file grows in fixed, verifiable increments.
Diagnostic & Data Mapping
Inventory every personal-data flow — collection point, purpose, retention need — and confirm your Data Fiduciary obligations under Chapter II.
Notices & Consent Architecture
Draft the itemised notice-cum-consent framework, website and employee notices, and the rights & grievance intake forms.
Policies, Agreements & SOPs
Master privacy policy, retention & breach policies, vendor DPAs, and the step-by-step SOPs that keep every deadline auditable.
Board Adoption & Handover
Consolidate review comments, finalise every instrument, and walk your team through the resolution for formal adoption.
Non-compliance is priced in crores, not notices.
Maximum penalties under the Schedule to the DPDP Act, 2023. The Data Protection Board decides the actual amount after an inquiry.
Let's map your exposure before we scope a fee.
A diagnostic call tells you precisely which of the 44 instruments apply to your data flows.
DPDP framework and deadlines: common questions.
What is the maximum penalty under the DPDP Act, 2023?
The Data Protection Board can impose penalties of up to ₹250 crore for failing to take reasonable security safeguards. Other bands in the Schedule are up to ₹200 crore (breach notification and children's data), ₹150 crore (Significant Data Fiduciary obligations) and ₹50 crore (other violations by a Data Fiduciary).
What are the key DPDP deadlines?
A Data Fiduciary must inform the Board and affected Data Principals of a breach without delay and give the Board a detailed report within 72 hours of becoming aware (or a longer period the Board allows). Grievances must be answered within a maximum of 90 days. Where Rule 8 applies to specified classes of fiduciaries, 48 hours' prior notice is owed before scheduled erasure.
How many documents does JurisTatva's DPDP framework include?
JurisTatva's framework organises 44 instruments across 7 layers: governance resolutions, registers, notices, consent forms, policies, agreements and standard operating procedures. Some are statutory requirements and others are recommended practice.
When do the DPDP obligations apply?
The DPDP Rules, 2025 were notified on 13 November 2025. Data Protection Board provisions took effect immediately, Consent Manager provisions apply from 13 November 2026, and most other obligations apply from 13 May 2027, subject to any later MeitY amendments.