The Origin ChapterIs your company
DPDP-ready?
A live, hands-on workshop for Indian startups. You work on your own company, and you leave with a first-draft personal data inventory and a 90 day action plan.
13 May 2027
When most of the Act's obligations take effect: notice, consent, Data Principal rights and breach reporting. That is closer than a proper implementation takes.
₹250 crore
The maximum penalty. For an Indian startup that is not a fine, it is an exit notice.
You may have heard 13 November 2026 called the deadline. It is not one for you: that date is only for Consent Manager registration under Rule 4.
What we cover
Six topics, one working plan.
When the Act hits you
Which obligations apply to you, from when, and what 13 May 2027 actually covers.
Where your data lives
Map the personal data across your product, databases, spreadsheets and vendors. Your inventory starts here.
Notices and old data
What a notice has to say under Rule 3, and what to do about data you collected before the Act.
Access and erasure requests
Handling Data Principal requests without breaking your product or your team.
Breaches and vendor contracts
The 72 hour report to the Board, and what your processor contracts need to say.
Your 90 day plan
Turn the gaps you found into a plan you can start on Monday.
Who it's for
The people who will actually do the work at Indian startups and SMEs. No legal background needed.
Your hosts
Nakendraprasath K
Founder, Privacy Labs
Olivia Daniel
Head of Legal, Privacy Labs
Reserve your seat
Saturday, 24 October 2026 at 10:00 am IST
₹1,768.82 including 18% GST
How we use your details
Privacy Labs is the Data Fiduciary for this registration. Notice version 2026-10-03.2.
- What we collect
- Name, to address you and keep the attendee list.
- Work email, to confirm your seat and send the joining link.
- Company and role, so the exercises are pitched at the right depth. You work on your own company in the session.
- Payment reference: the Razorpay order and payment IDs and the amount. Card and UPI details go straight to Razorpay; we never see them.
- What we do not ask for
- Your phone number. Razorpay’s payment window may ask for one, under Razorpay’s own terms.
- Why
- To register you, take payment and send you the joining details. Nothing else, unless you tick the optional box for future session and DPDP update emails.
- Who else handles it
- Razorpay (payment processing), Resend (email delivery), and our hosting and database providers, each only to do that job for us.
- How long we keep it
- We delete your registration 30 days after the workshop, and an unfinished, unpaid registration after 7 days. Razorpay keeps its own payment records as the law requires of it. Our security log keeps a record that we emailed you, including your address, for at least one year, as the DPDP Rules require.
- Your rights
- You can withdraw consent, or ask to see, correct or erase your details, at any time. Withdrawing is as easy as giving it: use our data request form, which gives you a reference to track it. Withdrawing does not undo processing already done.
- Complaints
- Use our grievance form, or write to founder@theprivacylabs.com. If we do not resolve it, you can complain to the Data Protection Board of India.
The full picture is in our privacy policy.