30-60-90 Day DPDP Implementation Plan for SMEs
A three-phase readiness plan that starts with data and risk, builds core workflows and finishes with testing, evidence and management sign-off.
An SME does not need a hundred-page policy library on day one. It needs an accurate data map, controlled access and workable incident response.
The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; section 6(9), section 27(1)(d) and rule 4 follow after one year; most operating duties and rules follow eighteen months after Gazette publication. As of 22 June 2026, readiness should distinguish current law from future-state DPDP controls.
Readiness should prioritise current cyber, sector, contract and consumer duties while building toward scheduled DPDP provisions.
The first thirty days should establish ownership, scope, inventory and immediate high-risk fixes.
Days thirty-one to sixty should build notices, consent, vendor, access, retention and rights workflows.
What the organisation should understand
- The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; section 6(9), section 27(1)(d) and rule 4 follow after one year; most operating duties and rules follow eighteen months after Gazette publication. As of 22 June 2026, readiness should distinguish current law from future-state DPDP controls.
- Readiness should prioritise current cyber, sector, contract and consumer duties while building toward scheduled DPDP provisions.
- The first thirty days should establish ownership, scope, inventory and immediate high-risk fixes.
- Days thirty-one to sixty should build notices, consent, vendor, access, retention and rights workflows.
- Days sixty-one to ninety should test controls, remediate failures and obtain management decisions.
The five-point review
| Check | What to examine |
|---|---|
| People | Sponsor, privacy lead, security, HR and product. |
| Inventory | Data, systems, processors and purposes. |
| Priority | Children, finance, health and identity. |
| Workflow | Notice, rights, retention and incident. |
| Evidence | Logs, approvals and tests. |
Practical example
A 40-person SaaS company spends its first month buying compliance software but still cannot list its processors or find customer exports. It should map the problem before selecting tools.
How to apply the framework
Use a small number of owned deliverables. A policy without a system change is incomplete.
Test real scenarios: deletion request, vendor breach, employee exit, child account and marketing withdrawal.
Operating workflow
Define the processing or incident precisely
Identify the people, data, system, purpose, owner, vendor and transaction or event. Review people, inventory and priority together. Do not start from a policy template or software feature; start from what the business and system actually do.
Separate current duties from future-state DPDP readiness
Apply the 14 November 2025 commencement notification provision by provision. Continue complying with currently operative IT, CERT-In, telecom, banking, insurance, employment, consumer, contract and criminal-law requirements. Build the future DPDP process now, but do not describe a scheduled rule as already legally operative.
Preserve proof and improve the system
Keep the approved decision, notice or workflow version, access or event logs, vendor evidence, user communications and remediation record. Update product design, role access, retention, support scripts or incident playbooks so the same weakness does not recur.
Action checklist
- Days 1–30: appoint owners and map data.
- Days 1–30: fix open access and backup risks.
- Days 31–60: update notices and vendor terms.
- Days 31–60: build rights and retention.
- Days 61–90: run simulations.
- Days 61–90: approve continuing roadmap.
Evidence to keep
- 90-day plan
- Data and vendor inventory
- Updated notices
- Procedures
- Exercise reports
Warning signs
- Software before scope
- Legal owns every task
- No commencement tracker
- Employee data omitted
- Project ends after policy publication
Finin2min takeaway
Privacy governance is an operating system, not a policy PDF. The data map, purpose, access, vendor, retention, user workflow, incident response and evidence file must all tell the same story.