India's DPDP Act 2023 and Rules 2025

One Month as the
Data Fiduciary.

The duties commence on 13 May 2027, and the Schedule to the Act runs to Rs 250 crore. One month in an invented office is a cheaper place to find out what you would have got wrong.

20 decisions across 24 days · about five minutes

The office floor

You are the only person responsible for personal data at a company of about two hundred people. You can only be in one room at a time, and that is the whole difficulty.

●●

INTAKE 01

Sign off the consent notices before they go live. Decide when consent is even the right basis. Verify a parent before a child's account opens.

s.5(1)s.6(1)s.7s.9(1)s.9(3)

▤

RECORDS 02

Answer access, erasure and grievance requests. Keep the filing room lawful in both directions, since deleting too early is also a breach. Keep the logs on.

s.8(7)s.11s.12(3)s.13Rule 6(1)Rule 8

◉

DISPATCH 03

Stop data leaving without a contract that carries the safeguards down. Decide what may go offshore, and what a liability clause can and cannot move.

s.8(1)s.8(2)s.16Rule 15

⚠

THE CORRIDOR !!

One morning there is a breach, and two clocks start at once. One runs to every affected person without delay. The other runs to the Board, and only part of it is 72 hours.

s.8(6)Rule 7(1)Rule 7(2)

No instant feedback.
Which is the point.

Compliance training tells you at once whether you picked the right option, and that is exactly what real life never does. You approve a notice on a Tuesday, and the fact that it was never valid consent surfaces months later, by which time everything collected under it is already sitting in your database.

So nothing here reacts. You decide, the day moves on, and the verdict exists only in the audit at the end.

  • Taken from the text. 20 decisions, 28 sections and rules, each one checked against the bare Act and Rules 2025 before this was published.
  • A real audit at the end. Every decision reconstructed, what it cost, the pattern your failures form, and the controls that would have caught them.
  • Both directions punished. Refusing everything fails too, because some of what arrives is perfectly lawful.

Two simulations

Both are free, both run entirely in your browser, and both cite the section or rule behind every judgement.

▤

ONE MONTH AS THE DATA FIDUCIARY this page

Run a company's data duties for 24 days. 20 decisions, a breach, and an audit at the end that reconstructs what each one cost. About five minutes.

s.5s.6s.8s.9Rule 7

Start the month

✎

REVIEW THIS NOTICE →

Read five real privacy notices and find what is wrong with each. 119 clauses, 56 planted flaws, and you only move on once you have cleared a stage.

s.5(1)s.6(1)Rule 3s.9(3)s.38(2)

Open the notice review

Who this is for

Legal, compliance, product and engineering people at Indian companies that collect personal data. Anyone who signs off a release without knowing what s.5(1) requires the notice to say. It assumes no prior knowledge of the Act and explains every duty as it arrives.

Before you start

  • Arrow keys or WASD to walk. On a phone, tap where you want to go.
  • Stand at a desk and press E, or tap the desk again, to deal with what is waiting.
  • Blue means something is waiting there, amber means due tomorrow, red means already overdue.
  • The filing room fills by itself every day and nobody will ever ask you to empty it.
  • Once you start, the month runs to the end. No pause, no save, no going back. Reloading abandons the run and starts a new one, with the scenarios in a different order.
  • Each decision gets at most 30 seconds, and a day lasts no longer than that either. The clock keeps running while you read, so reading carefully costs you something else. Choosing what to lose is the whole exercise.
  • Clear your desk and the next arrival comes at once. No time is spent waiting for the calendar, though you still have to walk to it.
Nothing is stored and nothing is sent anywhere

What this is not. Not legal advice, and not a certification or an assessment of your organisation. The company is invented, and the rupee figures are illustrative rather than a prediction of what the Board would impose.

What is real. Every duty, every correct answer and every citation was checked against the bare text of the DPDP Act 2023 and the DPDP Rules 2025. Where the simulation invents something for playability, it says so on screen. No penalty has been imposed under this Act yet: the operative duties and the section 33 penalties commence on 13 May 2027.

Nothing is collected. It runs entirely in your browser. No account, no tracking of your answers, no server. If you put a name on the result card at the end, it never leaves your device.

To find out which of these duties apply to your own organisation, run the readiness assessment, or read the rest of the writing on DPDP.

For organisations. These simulations are free, and they stay free. If you want one built around your own policies, your sector and your systems, so your team works through the decisions they will actually face, write to contact@dpdpcore.in.