DPDPA (India) Compliance Advisor
Navigate India's Digital Personal Data Protection Act and DPDP Rules 2025 — Data Fiduciary obligations, consent and notice, children's data, SDF duties, cross-border transfers, and breach notification.
India's DPDPA plus the 2025 Rules reshape how every company handling Indian users' data must operate — consent, notice, children's data, and Significant Data Fiduciary duties included. The Data Protection Board is being stood up now; "we'll deal with it later" is running out of runway.
Who it's for: global companies with Indian users, privacy and legal teams building a DPDPA program, Data Fiduciaries and Significant Data Fiduciaries, teams comparing DPDPA with GDPR, product teams handling children's data or cross-border transfers
Example
"Run a DPDPA gap analysis and tell me if we're a Significant Data Fiduciary" → SDF determination, a consent-and-notice redesign, a children's-data plan, cross-border transfer guidance, and a compliance roadmap
CLAUDE.md Template
New here? 3-minute setup guide → | Already set up? Copy the template below.
# India DPDPA — Digital Personal Data Protection Act, 2023 Skill
You are an expert **India DPDPA compliance advisor** assisting **legal, privacy, and
compliance teams** at Indian organisations AND global organisations that process personal
data of individuals in India. Your knowledge covers the full text of the **Digital Personal
Data Protection Act, 2023** (passed 11 August 2023) and the **Digital Personal Data
Protection Rules, 2025** (notified 13 November 2025), which set the operative compliance
timeline.
**Full compliance deadline: 13 May 2027** (18 months from Rules notification).
Get new playbooks like this one
One email a week with new Claude Code workflows. Free, like everything here.
No spam. Unsubscribe anytime.
What This Does
Turns Claude Code into an advisor on India's Digital Personal Data Protection Act, 2023 (DPDPA) and the DPDP Rules 2025. It covers Data Fiduciary obligations, Data Principal rights, consent and notice requirements (Section 6), legitimate uses (Section 7), children's data (Section 9), Significant Data Fiduciary duties (Section 10 / Rule 13), cross-border transfers (Section 16), breach notification (Rule 6), gap analysis, a compliance roadmap, and DPDPA-vs-GDPR comparison.
The Problem
The DPDPA introduces a consent-first regime with verifiable parental consent for children, Significant Data Fiduciary obligations, and India-specific breach and transfer rules — all now being operationalized through the 2025 Rules and a new Data Protection Board. Global companies that built for GDPR still have gaps: India's notice format, consent-manager expectations, children's-data rules, and SDF duties don't map one-to-one.
Quick Start
Step 1: Create Your Workspace
mkdir -p ~/Documents/DPDPA-Compliance
Step 2: Download the Template
mv ~/Downloads/CLAUDE.md ~/Documents/DPDPA-Compliance/
Step 3: Add Context (Optional)
Add your data inventory, existing privacy documentation, or a description of your India-facing services.
Step 4: Run Claude Code
cd ~/Documents/DPDPA-Compliance
claude
Step 5: Start
Say: "Run a DPDPA gap analysis and build our compliance roadmap."
Example Commands
"Run a DPDPA gap analysis"
"Are we a Significant Data Fiduciary, and what extra duties apply?"
"Design Section 6 consent and notice that meets the DPDP Rules 2025"
"How do we handle children's data and verifiable parental consent?"
"What are our Section 16 cross-border transfer obligations?"
"Build a Rule 6 breach-notification procedure"
"Map Data Principal rights to fulfillment workflows"
"Compare DPDPA to GDPR for our global program"
What You Get
| Output | Contents |
|---|---|
| Gap Analysis | Section-by-section findings and priorities |
| SDF Determination | Whether you qualify and the added obligations |
| Consent & Notice | Designs aligned to Section 6 and the 2025 Rules |
| Children's-Data Plan | Verifiable parental consent workflows |
| Roadmap | Phased plan toward DPDPA readiness |
Tips
- Decide your SDF status early — it changes DPIA, audit, and DPO obligations.
- Treat consent as a product surface — notice format and consent managers matter under the Rules.
- Map transfers explicitly — India's approach differs from GDPR adequacy.
Important Disclaimer
This is a compliance support tool, not legal advice. The DPDPA and its 2025 Rules are still being operationalized. Have qualified Indian privacy counsel review outputs before relying on them.