DPDP Compliance Automation: Which Tasks to Automate First

Rule 4 of the Digital Personal Data Protection Rules, 2025 governs registered Consent Managers and applies from 13 November 2026. Most core duties follow on 13 May 2027. Your website forms and your support desk can each trigger these duties several times in a day. A sign up needs a notice and a consent record. A withdrawal needs to reach every messaging tool, and a request for data needs a tracked response. DPDP compliance automation is the use of software to run this repeatable work, from recording consent to scheduling deletion.

Volume makes the case for automation. For example, a loyalty programme may take consent on the website and at the store billing counter on the same day, while the support desk receives requests by email. The Act places the burden of proving that notice was given and consent obtained on the business, and a spreadsheet kept by hand slows that proof as customer numbers and tools increase. Automated records let the team answer a customer faster and give auditors a trail to follow.

A business can start with consent management software, which stores each consent next to the notice the customer saw and sends each withdrawal to the connected tools. The same records give your team evidence when a customer, a partner or the Data Protection Board asks for proof. Data discovery and request management software then cover the remaining tasks.

The sequence you choose decides how much rework follows. Take consent records: they carry value once you know which of your systems use the data. Deletion schedules need the same list, since a system missing from it never receives the instruction. Seven tasks follow in a practical order, each tied to the rule behind it. EY India surveyed about 150 professionals and reported in February 2026 that 48% of organisations had started gap assessments, which makes the assessment the most common first step. Automation comes after that assessment, and you save rework by choosing its order early.

What DPDP Compliance Automation Covers

Two terms recur in the Act. A Data Fiduciary is the business that decides why and how personal data is used, and a Data Principal is the customer, lead or employee the data belongs to. Software can support the cycle from the moment consent is recorded to the day the data is deleted. Legal responsibility stays with your business even when a vendor processes the data for you.

The Rules use one further term with a specific meaning. A Consent Manager is a registered entity under Rule 4 that helps individuals give, review and withdraw consent, and the Board regulates it. A consent management tool that a business buys for its own use is a different thing. Throughout this article, what the Rules require is kept separate from recommended practice, which is marked as such.

Why the Order of Automation Matters

The Rules were notified on 13 November 2025. Rule 4 applies from 13 November 2026. Rules 3 and 5 to 16 set out the daily duties of a Data Fiduciary and apply from 13 May 2027.

The Ministry of Electronics and Information Technology consulted stakeholders in January 2026 on cutting the window for Significant Data Fiduciaries from 18 months to 12. The Central Government designates a Significant Data Fiduciary after weighing factors such as the volume and sensitivity of the data the business handles. No notification has changed the date for the core duties, which remains 13 May 2027 as of October 2026. Official notifications will show any change.

Early automation helps three groups of task. The first group has a deadline in the Rules or a high volume, so automation saves hours of manual effort. The second group produces records an auditor asks for, so each completed task adds to the proof on file. Tasks that other work depends on, such as finding where data is stored, belong at the start.

The Seven Tasks to Automate, in Order

Step 1: Run a Gap Assessment and Map Where Your Data Is Stored

A DPDP gap assessment measures your current practices against the Rules. Data discovery then lists the places where your systems store personal data. Every later Step works from these two outputs. For example, a retailer may hold customer data in the billing system, a loyalty app and a WhatsApp campaign tool, along with spreadsheets kept by store teams. Discovery software can scan the connected systems and list the personal data in each. The team lists spreadsheets and paper files by hand and assigns an owner to each tool that discovery software cannot reach. A DPDP compliance consultant or an internal privacy lead can run the assessment, and the findings give Steps 2 to 7 their starting list.

Related reading: Data mapping under DPDPA

Step 2: Capture Consent Against the Notice the Customer Saw

Under Rule 3, a notice has to be understandable without reading any other document. The notice itemises the personal data and states the specified purpose, and it describes the goods or services the processing enables. The notice must also carry a link for withdrawing consent and exercising rights, and it must explain how to complain to the Data Protection Board. Your business, as the Data Fiduciary, has to prove that it gave notice and obtained consent.

Notice management software keeps every version of a notice and ties each consent record to the version that customer saw. A store tablet at the billing counter and a website form can each record the notice version shown and the time of consent. Recording the language and channel is a recommended practice, and it shortens later audit questions.

Step 3: Make Consent Withdrawal Reach Every Downstream Tool

Withdrawal has to be as easy as giving consent. After a withdrawal, the business must stop processing within a reasonable time and cause its Data Processors to stop too, unless the law authorises the processing. The Act refers to a reasonable time, and neither the Act nor the Rules specify hours or days.

In daily operations a withdrawal touches many tools. Take a customer who withdraws marketing consent in your app at noon. The SMS provider may still run the evening campaign, and the WhatsApp tool may keep the customer on a broadcast list. A central consent record can send each withdrawal to those tools straight away, so the evening campaign skips that customer. You can set an internal target, such as the same working day, and the law prescribes no such period.

Step 4: Route Customer Requests and Grievances to the Right Owner

Under Rule 14, a business publishes how individuals can make requests and resolves grievances within a reasonable period not exceeding 90 days. Individuals may also nominate another person to exercise their rights. The 90 day limit is the outer boundary, and a shorter internal target is a recommended practice.

Here, automation gives you one intake point for web forms and emails, with an identity check before any data leaves your systems. Each request then goes to the system owner named in Step 1, and an alert reaches the team as the deadline approaches. Once your customer base grows, a shared inbox that relies on one person to remember each case is difficult to defend.

Step 5: Build a Breach Workflow Around the Rule 7 Sequence

Once the business becomes aware of a personal data breach, it must tell each affected Data Principal without delay and in plain language. The message describes the breach and its likely consequences for the person. The message also lists the steps taken to reduce harm and names a business contact. The business must give the Board a description without delay and further details within 72 hours of becoming aware, or within any longer period the Board allows on a written request.

A workflow tool can start the 72 hour timer when the team records the moment of awareness, and it keeps a single log of each action. Message templates drafted in advance mean the team edits a notice instead of writing one from scratch during an incident. Detection comes from your security monitoring, so connect that monitoring to the workflow.

Step 6: Set Retention Periods and Schedule Erasure

The business must erase personal data at the earlier of two points, withdrawal of consent or the moment the specified purpose is no longer served, unless a law requires retention. The business also has to make sure its Data Processors erase the data. Two rules set a minimum for logs. Rule 6 requires logs and personal data used for security purposes to be kept for one year, and Rule 8(3) sets a one year minimum for data and logs linked to the Seventh Schedule purposes. Fixed erasure periods apply to certain large e-commerce, online gaming and social media entities, and each must give the user at least 48 hours of notice before erasing.

A retention period for each purpose, together with written legal hold exceptions, gives the deletion jobs their instructions. Scheduled deletion jobs that keep an execution log then show that the schedule ran.

Related reading: Data retention policies under DPDPA

Step 7: Add Vendor Oversight, Impact Assessments and Reporting

A business may engage a Data Processor only under a valid contract, and it stays responsible for the data. Rule 6 asks for appropriate security provisions in processor contracts where applicable. A vendor register keeps this manageable. Each processor appears with the data shared and the contract renewal date, and reminders prompt the periodic reviews.

Data protection impact assessments and annual audits apply to Significant Data Fiduciaries only. A business outside that class can adopt them voluntarily as good practice. A dashboard fed by Steps 2 to 6 lets senior management check consent volumes and open requests in one place.

Decisions Your Team Keeps

Software records decisions and carries them out. Five decisions remain with people.

• Purpose and ground for processing. Whether a use of data rests on consent or on a legitimate use under Section 7 is a legal judgement.

• Breach scope. People decide which systems and which individuals a breach affected, because the notice depends on that finding.

• Erasure exceptions. If a law or a legal claim requires you to keep data, a named person in your team approves the exception and writes down the reason.

• Impact assessment conclusions. Where an assessment applies, a qualified person weighs the risk and signs off the conclusion.

• Unconnected data. Paper files, personal devices and tools outside the workflow need manual tracking.

How the OneConsent Platform Maps to This Sequence

The OneConsent platform has modules that correspond to most of the seven tasks:

• Step 1: gap assessment and data discovery

• Steps 2 and 3: notice management, consent preference management and a consent audit trail

• Step 4: data principal rights

• Step 5: breach management

• Step 7: third party risk management and DPIA

Each module records decisions and runs workflows. The legal judgements in the previous section stay with your team, and coverage of systems that are not connected depends on the integrations you set up. For Step 6, ask any vendor how erasure instructions reach connected tools and Data Processors. A DPDP compliance platform adds the most value once the baseline from Step 1 exists, because the workflows then run on an accurate list of your systems and owners.

A Sensible Order for DPDP Compliance Automation

The sequence starts with the baseline and the consent tasks. The tasks that run on a clock follow, and vendors and reporting come last. Each Step hands records to the next and leaves a short list of decisions for the team. A one page plan naming an owner for each system and each Step gives your DPDP compliance automation a place to start.

Plan Your Automation Sequence With the OneConsent Team

If you want to know which of the seven Steps suits your systems first, the OneConsent team reviews your current practices and gives you findings written for your business. To see how the modules connect, explore the OneConsent platform. When you want to go through your own workflows with the team, book a demo session. A gap assessment gives your team the baseline for Step 1, and the OneConsent team can support it with DPDP compliance solutions matched to those systems.