Law firms handle personal information in intake forms, identity documents, correspondence, employee records and case files. Preparing for India's Digital Personal Data Protection framework starts with identifying those workflows and assessing which obligations and exemptions apply. A policy document or a software subscription does not establish that a firm is compliant.
Position as at 30 September 2026: the DPDP Act and final Rules have phased commencement. Do not treat every provision as already enforceable simply because the Act was enacted or the Rules were published.
Check the commencement date before making a compliance claim
The official G.S.R. 843(E) commencement notification dated 13 November 2025 separates the Act's provisions into three groups:
- On publication: specified definitions, Board and administrative provisions commence.
- One year after publication: section 6(9) and section 27(1)(d) commence.
- Eighteen months after publication: the listed core processing provisions, rights and penalty provisions commence, including sections 3–17 with the specified section 6 exclusions, and sections 28–34.
Those intervals run from publication in the Official Gazette. The notification's stated date is distinct from its publication; check the publication record and any subsequent changes before calculating a deadline. At this article's update date, the one-year and eighteen-month stages are still ahead.
Rule 1 of the final Digital Personal Data Protection Rules, 2025 also staggers commencement: Rules 1, 2 and 17–21 begin on publication, Rule 4 after one year, and Rules 3, 5–16, 22 and 23 after eighteen months. Read the Rules with the official December 2025 corrigendum, which includes corrections to the commencement wording.
What the ₹250 crore figure means
The DPDP Act's Schedule, read with section 33, sets a maximum of ₹250 crore for breach of the section 8(5) security-safeguards obligation. This is a statutory ceiling for that specified breach, not an automatic fine for every leak or every law firm. Section 33 provides for an inquiry, an opportunity to be heard and consideration of factors including gravity, duration and mitigation. Its commencement must also be checked.
A law firm's assessment is fact-specific. The Act defines the Data Fiduciary by who determines the purpose and means of processing. Section 17(1)(a) provides a limited exemption for processing necessary to enforce a legal right or claim, while retaining section 8(1) and 8(5). That does not establish a blanket exemption for every office workflow. Review matter work, marketing, recruitment and administration separately against the statutory text.
A practical preparation checklist
The following steps are office-management recommendations to support an assessment. They do not replace a legal opinion, technical audit or the applicable statutory requirements.
1. Build a data map for the office
For each workflow, list the information collected, purpose, source, storage locations, people with access, external providers and proposed retention period. Include emails, local downloads, scanned copies, shared links, backups and mobile devices. Assign a named owner to each record so that unanswered questions have somewhere to go.
| Workflow | Information | Locations | Question to resolve |
|---|---|---|---|
| New client intake | Contact details and identity copy | Intake form, email and matter folder | Is the identity copy needed at intake, who can open it, and which duplicate copies can be removed? |
2. Review access and security evidence
Rule 6, when commenced, specifies security measures including appropriate protection of data, access controls, logs and monitoring, continuity measures, processor-contract provisions and technical and organisational safeguards. Use its text to guide a gap assessment rather than treating a single control as sufficient.
- Replace shared logins with individual accounts and document who approves access.
- Review active users when an associate, clerk or contractor leaves.
- Check device protections, backup recovery and how sensitive documents are shared.
- Request evidence for vendor claims and record unresolved gaps with an owner and target date.
3. Assess notices, requests and retention
Prepare an inventory of where privacy information is shown and where a person can contact the firm. Ask the responsible adviser to assess lawful processing, notice, consent where applicable, exemptions and how requests should be handled. Review retention against procedural, contractual, professional and statutory needs; avoid an arbitrary “keep everything forever” or “delete everything immediately” rule.
Rules 3, 8 and 9 address notices, retention and contact information respectively, subject to their commencement. Check their detailed requirements against each workflow before finalising a policy.
4. Check every external provider
Record the storage, email, transcription and AI services used by the office. For each, establish what data leaves the firm, who can access it, whether model-training terms apply, how deletion and backups work, and what contractual commitments are available. Do not upload confidential case files merely because a tool is convenient.
5. Rehearse an incident response
Assign responsibility for receiving an incident report, containing exposure, preserving evidence, identifying affected information and assessing applicable notifications. Rule 7 contains breach-intimation requirements, subject to commencement. Keep a contact list and run a fictional lost-device exercise so the team can identify missing steps before a real incident.
What MyAdvoMate can help organise
MyAdvoMate's case workspace helps organise matter documents, notes and preparation tasks. That can make an office's records easier to locate, but it does not determine the legal basis for processing, satisfy every security requirement or certify DPDP compliance. Assess the product's current privacy policy, access behaviour and relevant provider terms within your firm's wider process.
Explore the case-management workflow or view the product walkthrough using sample information. Complete your assessment before migrating confidential files.
Primary documents to keep with the assessment
- Digital Personal Data Protection Act, 2023: definitions, applicable scope and exemptions, section 33 and the Schedule.
- G.S.R. 843(E): the Act's commencement groups.
- Final DPDP Rules, 2025 and G.S.R. 892(E) corrigendum: read together.
Editorial note: This source-linked preparation guide is general information, not a legal opinion or a finding that any firm or product is compliant. The editorial update date does not represent review by a qualified advocate. Obtain advice on your firm's actual processing and the instruments in force when making compliance decisions.
