The DPDP Deadline Is Closer Than You Think: Where Security Testing Fits
The DPDP Deadline Is Closer Than You Think: Where Security Testing Fits
By the SecureRoot team · 19 October 2026 · 7 min read
The short version. Most DPDP duties start applying on 13 May 2027. The Act does not ask you to run a penetration test, but it does expect security safeguards you can prove. A test followed by a retest is the cleanest proof most teams can produce, and if you start this month you have time to do it without panic.
Count forward from today and 13 May 2027 is a little under seven months away. That sounds comfortable until you try to write down what has to be true by then. You need to know where personal data lives, including the spreadsheets nobody mentions in meetings. Your access controls and logs have to hold up. Your vendors need to be bound by something stronger than goodwill. And somebody has to know what to do when a breach alert lands at 2 a.m.
None of this is exotic. It is a lot of ordinary work that tends to get postponed until the deadline is close enough to frighten people. This post is about doing it earlier, and about where security testing fits.
The dates, in plain terms
The DPDP Rules, 2025 were notified in November 2025, and the Data Protection Board of India came into being the same month. So the regulator has existed for almost a year already. The provisions on consent managers start in November 2026, less than four weeks from now. Most of the remaining duties apply from 13 May 2027.
Notifications can move dates, and we are not your lawyers, so confirm the current position with someone who is. For planning, we would treat May 2027 as the day your safeguards, consent flows, rights process and breach response should already be working, not the day you begin building them.
What “reasonable security safeguards” looks like
The Act asks every Data Fiduciary to protect personal data with reasonable security safeguards, and the Rules put some flesh on that phrase. Read in plain English, they point at six things.
Personal data should be encrypted, in storage and in transit. Only the right people should be able to reach it. Where it suits the data, it should be masked. You should keep logs that show who accessed what, and keep them for a year so an incident can be investigated properly. Finally, your processors need contracts that hold them to the same standard.
That last layer catches people out. You stay accountable for personal data even when it sits with a cloud or SaaS provider. In the compliance programmes we run, vendor paperwork is usually the slowest piece, simply because it depends on other companies answering their email. This is a summary of the Rule 6 themes, so read the Rule itself with your legal adviser.
Does the Act require a penetration test?
No. It does not name one, and you should be wary of anyone who says it does. What the Act requires is reasonable safeguards, and if something goes wrong you will be expected to show that yours were reasonable.
That is where testing earns its place. A policy that says “access is restricted” is a claim. A tester trying to get around that restriction, and either failing or succeeding, is evidence. Picture a billing API where changing one number in a request returns somebody else’s invoice. Nobody finds that by reading a policy. A manual test finds it in an afternoon, and the report shows exactly how to reproduce it, what personal data it exposes and how to close it.
Once your developers fix it, we retest, and the finding is marked closed. That pair, the original finding and the verified retest, is something a customer, an investor or a Board member can read in five minutes. Our VAPT services cover web, mobile, API, network and cloud, and our DPDP Act work ties the testing back to the safeguards above.
Get SecureRoot Risk Advisory LLP’s stories in your inbox
Join Medium for free to get updates from this writer.
One caution. Testing does not make you compliant on its own. It sits next to your data map, your consent records, your rights process and your breach playbook, and it only proves one of those things.
What getting it wrong can cost
The Act sets ceilings. Failing to keep reasonable security safeguards can cost up to ₹250 crore. Failing to notify a personal data breach can cost up to ₹200 crore. Other violations of the Act or Rules can cost up to ₹50 crore.
These are maximums, not price tags, and the Board looks at the nature of the breach and what you did about it. Still, the combination to fear is the obvious one: a preventable security failure, followed by a late or missing notice.
A plan that fits in seven months
If you start this month, sixteen weeks is enough to get through the work below and still leave about three months of slack before May. For most mid size organisations, reaching a defensible position takes 90 to 120 days, so the plan is realistic. It moves with how many systems and vendors hold personal data.
A few notes on the order. Map your data first, because everything else depends on knowing where it is. Start vendor contracts early, since they wait on other people. Test after you have fixed the obvious access and logging gaps, otherwise you are paying a tester to find things you already knew about. And rehearse a breach once, even badly. The first run always exposes the missing phone number or the unclear owner.
If you would rather not run all this from spreadsheets, DPDP Compass is the platform we built for it. It tracks the data map, consent, data principal requests with their response clocks, and the breach workflow in one place. It supports your team’s judgement and does not replace it.
Choosing someone to help
Whoever you pick, ask a few blunt questions. Do they test by hand, or do they hand you a scanner export? Will the same people connect the findings to the safeguards the Rules describe? Is the retest in the price? And do they tell you plainly that there is no DPDP certificate? The Act has no certifying body, so what you end up with is evidence you can show, not a badge.
If you are in the NCR, we also have pages on DPDP Act consulting in Noida and in Gurugram.
FAQs
When do the main DPDP obligations apply?
Most of the remaining obligations apply from 13 May 2027, with the consent manager provisions starting earlier, in November 2026. Dates can change through government notifications, so confirm the current position with your legal adviser.
Does the DPDP Act require a penetration test?
The Act does not name one. It requires reasonable security safeguards, and testing is one of the clearest ways to show that yours work.
How long does DPDP readiness take?
For most mid size organisations, 90 to 120 days to a defensible position. The range depends on how many systems hold personal data and how much of it sits with vendors.
Is there a DPDP certificate?
No. The DPDP Act has no certifying body. What you build is evidence you can show to a customer, an investor or the Board.
Who is responsible if our cloud provider holds the data?
You remain accountable as the Data Fiduciary. Your contracts should require the provider to apply equivalent safeguards.
Start with a scoping call
Tell us what holds personal data and when you need to be ready. After a 30 to 45 minute call you will have a written scope and a fixed price, or an honest answer if we are not the right firm for it.
Request an assessment or book a scoping call.
This article is general information, not legal advice. Check dates and obligations against the official text and with your legal adviser.
