DPDP Act FAQs: 100 Questions Answered for Indian Businesses

The Digital Personal Data Protection Act, 2023 is India's main law on how digital personal data is collected, used, shared and erased. It gives individuals enforceable rights and puts clear duties on any organization that decides why and how data is processed. Penalties go up to ₹250 crore, so this is a board-level topic and not only an IT one.

Any person or organization that decides the purpose and means of processing digital personal data in India is a Data Fiduciary and must comply. That includes companies, firms, trusts, schools, hospitals and NGOs, whatever their size or sector. Processing outside India is also covered when it relates to offering goods or services to people in India.

Yes. The Act has no general exemption for small businesses. Section 17(3) lets the Central Government notify certain Data Fiduciaries, including startups, for relief from some obligations such as notice and erasure. Check the current notifications before relying on any relief, and do not assume it applies to you.

It can. If a foreign company processes personal data outside India in connection with offering goods or services to people in India, the Act applies to that processing. Having an office in India is not the test; targeting individuals in India is. Such companies should check their notices, consent flows and breach processes against the Act and Rules.

Personal data is any data about an individual who can be identified by or in relation to it. The Act covers it when collected in digital form, or collected on paper and digitized later. It does not cover purely personal or domestic use, data the individual has made public, or data made public under a legal obligation. Research, archiving and statistical use is outside the Act on stated conditions.

The Data Principal is the individual the data is about. For a child, the parent or lawful guardian acts for them. The Data Fiduciary is the organization that alone or with others decides the purpose and means of processing. Customers, employees and students are Data Principals; the company, school or hospital is usually the Fiduciary.

A Data Processor handles personal data on behalf of a Fiduciary, for example a payroll provider, cloud host or CRM vendor. The Fiduciary stays fully responsible for what its processor does, and can engage one only under a valid contract. The Act puts most direct duties on Fiduciaries, so processor risk is managed mainly through contracts.

Records that stay on paper are outside the Act. Once collected data is digitized, for example scanned or typed into a system, it falls within the Act. Mixed setups such as a paper visitor register that is later entered into software need the same care as fully digital records.

Yes. Employee records and business contact details of individuals, such as names, work emails and phone numbers, are personal data. Employers can rely on the employment ground in Section 7(i) for many HR purposes, but still owe security, accuracy, erasure and grievance duties. Using B2B contacts for marketing usually needs consent.

The Rules were notified in November 2025 and the provisions on the Data Protection Board took effect immediately. Consent Manager registration begins on 13 November 2026. Most other duties, including notice, consent, security, breach reporting, children's data, rights and penalties, start on 13 May 2027. MeitY floated a shorter 12-month window in early 2026, but as of this review no amendment had been notified. Some sources count these dates one day later, so confirm against the Gazette.

The DPDP Act amends the IT Act and removes the compensation provision in Section 43A when the relevant provisions commence. Sector rules from RBI, SEBI, IRDAI and health regulators continue to apply alongside the Act. Where both cover the same ground, follow the stricter requirement and map both into one control framework.

From 13 May 2027, penalties can be imposed for non-compliance: up to ₹250 crore for failing to keep reasonable security safeguards, up to ₹200 crore for failing to report a breach or to protect children's data, and up to ₹50 crore for other breaches. Beyond fines, expect enterprise clients to ask for compliance evidence and to face any incident without a tested plan. Starting early also spreads the work over time.

There are two: the consent of the Data Principal, or one of the "certain legitimate uses" listed in Section 7. Unlike the GDPR, there is no general "legitimate interest" ground. You need a specified lawful purpose and one of these two bases before you process.

Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data necessary for the stated purpose. Pre-ticked boxes and bundled consents do not meet this standard. Every consent request must be accompanied or preceded by a notice.

The notice must give an itemized description of the personal data, the specific purpose, how the person can withdraw consent and exercise their rights, and how to complain to the Data Protection Board. It must be in clear, plain language and available in English or any language in the Eighth Schedule of the Constitution.

Section 7 lists situations where consent is not needed: data voluntarily provided for a stated purpose, State benefits and functions, legal disclosure to the State, compliance with court orders, medical emergencies, epidemics, disasters, and employment purposes. Rely on a use only as narrowly as it is written, and record which use you rely on and why.

Yes. Withdrawal must be as easy as giving consent. After withdrawal the Fiduciary must stop processing, and make its processors stop, within a reasonable time unless a law requires retention. Processing done before withdrawal stays lawful, and the consequences of withdrawing are borne by the individual.

Individuals can get a summary of their data and how it is processed, ask for correction, completion, updating or erasure, use a grievance process, and nominate another person to exercise rights if they die or become incapable. Fiduciaries must publish how to make requests, and the Rules cap the grievance response period at 90 days. The Act does not create a right to data portability.

Individuals must comply with applicable laws, not impersonate others, not suppress material information when providing data for official documents, not file false or frivolous grievances, and provide only authentic information when seeking correction. Breach of these duties can attract a penalty of up to ₹10,000.

The main duties are: process only for a lawful purpose with valid notice and consent or a Section 7 use; keep data accurate where it drives decisions; put technical and organizational measures in place; keep reasonable security safeguards; report breaches; erase data when the purpose is served or consent is withdrawn; publish a contact point; run a grievance mechanism; and stay responsible for processors.

The Central Government can designate a Fiduciary or class as significant based on factors such as the volume and sensitivity of data and the risk to individuals. Extra duties include an India-based Data Protection Officer who answers to the board, an independent data auditor, and a Data Protection Impact Assessment and audit every 12 months. Further transfer restrictions may apply. As of this review no designation had been reported.

The statute requires them only for Significant Data Fiduciaries, once every 12 months, with significant observations reported to the Board. Other organizations are not required to do so, but a short assessment before high-risk processing such as biometrics, children's data or large-scale profiling is good practice and helps in enterprise client diligence.

A child is anyone under 18. Before processing a child's data you need verifiable consent from a parent or lawful guardian. You must not process data in a way that harms a child's well-being, and must not track, behaviorally monitor or target advertising at children. Rules 10 to 12 and the Fourth Schedule give limited exemptions for certain classes, such as educational institutions and healthcare providers, subject to conditions. Penalties go up to ₹200 crore.

Generally yes. Transfers are allowed except to countries the Central Government restricts by notification. Rule 15 lets the Government set requirements, and Significant Data Fiduciaries face extra restrictions under Rule 13. Sector rules that require local storage or higher protection continue to apply, so check your regulator's rules as well.

A Fiduciary must notify the Data Protection Board and each affected individual. Under Rule 7, detailed information must reach the Board within 72 hours of becoming aware of the breach, unless the Board allows more time, after a prompt initial intimation. Other regimes can be faster: CERT-In's directions require reporting certain cyber incidents within 6 hours.

Maximum penalties are: ₹250 crore for failing to keep reasonable security safeguards; ₹200 crore for failing to notify a breach or breaching children's data obligations; ₹150 crore for Significant Data Fiduciary duties; ₹50 crore for any other breach; and ₹10,000 for an individual's breach of duties. The Board weighs factors such as gravity, duration and mitigation.

The Board is the adjudicating body. It receives complaints and breach intimations, inquires, issues directions, imposes penalties, can direct mediation, and can accept voluntary undertakings. Appeals go to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT). Individuals must first use the Fiduciary's grievance process. As of this review, appointments of the Chairperson and members were still being reported as pending.

Section 17(1) exempts many duties, other than the security and responsibility duties in Section 8(1) and 8(5), for enforcing legal claims, judicial and regulatory functions, offence investigation, processing of non-residents' data under foreign contracts, approved mergers and restructurings, and tracing loan defaulters. Section 17(2) excludes notified State instrumentalities and research, archiving and statistical use. Section 17(3) allows notified relief for classes including startups.

Start with scope and ownership: decide whose data you hold, name a sponsor and a lead, and run a quick gap assessment against the Act and Rules. Then map your data, and move to notices, consent and a breach plan first, since the highest penalties attach to security and breach failures.

Compare current practice against each duty: notice, consent, purposes, security, retention, rights handling, breach response, vendor contracts and children's data. Rate each area as met, partly met or not met, and assign an owner and date to every gap. A self-assessment gives a first view; a full assessment reviews real documents, systems and contracts.

List every system, form, process and vendor that touches personal data. For each, record what data, whose, why it is collected, where it is stored, who can access it, who receives it and how long it is kept. Start with customer onboarding, HR, marketing and vendor feeds. The register you build drives notices, retention and breach response.

Write each purpose in specific terms, such as "order delivery" rather than "business purposes", and match it to consent or a Section 7 use. Drop fields you cannot justify, because consent must be limited to necessary data. The Act has no separate "sensitive data" class, but children's, health, financial and biometric data deserve extra controls.

Only Significant Data Fiduciaries must appoint a Data Protection Officer, who must be based in India and answer to the board. Everyone else must publish contact details of a person who can answer questions about processing. Many organizations name an internal lead, or use an external DPO service for expertise and independence.

A Consent Manager is a registered entity that lets individuals give, manage, review and withdraw consent through one interface. Applicants must meet conditions that include being an Indian company with a net worth of at least ₹2 crore, and registration opens from 13 November 2026. You are not required to use one, but your processes should be able to accept requests that arrive through one.

Name an executive sponsor, a program lead (legal, compliance or the DPO) and function owners in IT or security, HR, marketing, procurement and customer operations. Compliance fails when it sits only with legal or only with IT. A simple responsibility chart is enough. In a small firm, the founder can sponsor, one person can lead, and an adviser can support.

Work back from 13 May 2027, or earlier if the Government shortens the window. A common sequence is: assess and map, design notices, consent and policies, update contracts and systems, train, test the breach plan, then go live and monitor. Leave buffer for vendor negotiations and system changes, which usually take the longest.

Cost depends on your size, number of systems and vendors, volume of consumer data and how much you outsource. Typical line items are advisory work, technology for consent capture and security, training, vendor contract work and ongoing DPO support. Get a scoped estimate after the gap assessment instead of guessing up front.

Frame it as risk and revenue: penalties up to ₹250 crore, enterprise customers asking for compliance proof, and the cost of an unplanned breach. Present the gap assessment, a phased plan with owners and a short dashboard. Boards respond better to a one-page view than to legal analysis.

List every vendor that touches personal data and rank them by data volume and risk. Check what they do with the data, where it is stored, their security, breach notice commitments, sub-processors and deletion support. Start with HR and payroll, CRM, cloud, marketing and call-center vendors. You remain responsible for them.

Scope and owners; gap results; data register; notice and consent redesign; policy set; vendor contract plan; security measures; rights and grievance process; breach plan; training; a dated timeline with milestones; and the metrics you will report. Keep it to a few pages that leadership will actually read.

Include an itemized list of data, specific purposes, how to withdraw consent, how to exercise rights and how to complain to the Board. Write in plain language, offer it in English or an Eighth Schedule language, and place it at every collection point with a link in the consent request. Avoid catch-all purposes.

Take a separate consent for each purpose, through a clear affirmative action, with no pre-ticked boxes and no bundling of unnecessary data with access to your service. On web and apps, use a layered notice and unticked checkboxes. Offline, use signed forms or a scripted, logged verbal consent. Make withdrawal as easy as giving, for example a settings toggle or a reply keyword.

The Act places the burden of proving valid consent on the Fiduciary, so keep a record of who consented, when, which notice version they saw, for which purposes and through which channel. Store these logs securely and keep the withdrawal history with them.

Publish how to submit a request, verify identity, log every request, route it to the system owners, and respond within your service levels. Include the contact details of your DPO or contact person in each response. Define when erasure is refused because a law requires retention, and prepare template responses.

Publish a grievance channel and a named contact. Acknowledge quickly, set internal targets well inside the 90-day outer limit in the Rules, escalate unresolved cases and keep records. Individuals must use your process before they can approach the Board, so a good process also reduces regulatory exposure.

Cover: processing only on your instructions for stated purposes; confidentiality; security measures matching Rule 6; sub-processor approval; breach notice to you within a short fixed period so you can meet the 72-hour deadline; help with rights requests; erasure or return at the end; audit rights; and liability. You remain liable to the Board whatever the contract says.

List the contracts that involve personal data and prioritize customers, vendors and employees. Add DPDP clauses or a data processing addendum, update customer terms and privacy notices, and revisit liability caps in light of the new penalty exposure. For many vendors, a single amendment letter is faster than renegotiating each contract.

Where consent was obtained before the Act applies, give the individual a notice as soon as reasonably practicable; you may continue processing until they withdraw. Alongside, run a clean-up: delete data you no longer need and map older datasets to a lawful purpose. Prioritize re-permissioning where the original consent was vague.

Set a retention period for each data category based on purpose and on other laws such as tax, labor, company and sector rules. Erase once the purpose is served unless a law requires retention. Under Rule 8, large e-commerce, online gaming and social media platforms above prescribed user thresholds must erase after three years of inactivity, with at least 48 hours' notice, and certain logs must be kept for at least a year. Build deletion into systems and vendor workflows.

The Act requires "reasonable security safeguards" over data in your control, including data held by processors. The Rules set minimum measures: encryption or similar, access control, logging and monitoring, backups, and processor contracts that require safeguards. Apply them on a risk basis, for example aligned to ISO 27001-style controls. Failure can attract up to ₹250 crore.

Define roles, a severity scale, containment steps, evidence preservation and a decision tree for who to notify: the Board, affected individuals, CERT-In and any sector regulator. Add templates, a 72-hour clock owner, a communications lead, vendor escalation contacts and a post-incident review. Test it with a drill.

To individuals: a plain-language account of what happened, what data was affected, likely consequences, what you have done and what they can do, plus a contact point. To the Board: a prompt initial intimation, then detailed information within 72 hours on the nature, extent, timing, cause and mitigation, and the steps taken to prevent recurrence. Check your templates against the exact content list in Rule 7.

Run role-based sessions: all staff (basics, phishing, how to report an incident), HR, marketing, customer support, IT and leadership. Use short scenarios, keep attendance records, and refresh at least once a year and after any incident.

Update the employee privacy notice, consent forms for non-essential uses such as photos and wellness programs, and policies on monitoring, BYOD, background checks, retention and exit. Align each policy to the employment ground in Section 7(i), and refresh payroll and HRIS vendor contracts.

The Act has no separate biometric category, but these are high-risk data. Attendance and access control can often rest on the employment ground, while non-essential uses need consent. Keep the scope proportionate, display notices, limit retention, restrict access and secure biometric templates. Avoid audio recording unless clearly justified.

Where cookies, trackers or analytics tags collect personal data, you need consent: use a banner with real choices and no pre-ticked boxes. Marketing emails, SMS and WhatsApp messages need consent for that purpose and an easy opt-out. Telecom and anti-spam rules continue to apply separately.

Each group company is a separate Fiduciary unless it acts only as a processor. Sharing needs a lawful basis and disclosure in the notice. Use intra-group agreements that set roles, purposes and security, treat shared services such as central HR or IT as processing for the entity concerned, and follow the cross-border rules for transfers outside India.

Keep an indexed file with the data register, notice versions, consent logs, policies, vendor contracts, training records, rights and grievance logs, the breach register, risk assessments and board reports. If the Board asks questions, this file is your evidence of reasonable steps.

Review it at least once a year, and also whenever there is a new product, vendor, data type, incident or rule change. A quarterly check of rights requests, vendor changes and retention keeps small issues from growing.

Name one response owner, keep evidence ready, respond within the stated time and involve counsel early. In Board proceedings the Fiduciary gets a hearing, so keep records of the steps you took. Where a gap is found, document remediation and consider whether a voluntary undertaking is appropriate.

Add a privacy checkpoint to procurement and product change: before signing or launch, confirm the purpose, lawful basis, vendor risk, contract clauses and any notice update. Keep the data register current as part of the same step.

Version your notices and keep older versions on file. When a purpose changes, issue a new notice and obtain fresh consent where needed. Periodically check pages, forms and apps for stale text and remove outdated forms.

Assign one person to track MeitY notifications and the Gazette: any change to the 18-month period, Significant Data Fiduciary designations, Board appointments, cross-border restrictions and the list of registered Consent Managers. Challenges to the Act are also before the Supreme Court, so watch for orders. Update the program when anything changes.

Run a tabletop exercise at least once a year using a realistic scenario, such as a vendor data leak. Test roles, decisions, the 72-hour clock and the drafting of notices, record the lessons and update the plan.

Useful measures: rights requests closed on time, grievance closure time, consent coverage by purpose, training completion, vendors with signed agreements, open risks, incidents and time to notify, and deletion against schedule. Report them to leadership every quarter.

Consider it when you lack in-house expertise, need independence, run several entities, expect Significant Data Fiduciary status, face enterprise clients who ask for a named DPO, or cannot justify a full-time hire. Accountability stays with your board. If you are designated a Significant Data Fiduciary, confirm that an external arrangement satisfies the India-based, board-reporting requirements.

The school, through its trust, society or company, is the Data Fiduciary for student, parent and staff data. Students under 18 are children, so a parent or lawful guardian gives verifiable consent. Boards, affiliating bodies and edtech vendors are separate parties with their own roles.

Rule 10 requires you to check that the consenting person is an adult and is the child's parent or guardian. A school can use admission records and identity details it already holds, or verified digital identity sources, and should record the method it used. Educational institutions have a limited exemption in Rule 12 and the Fourth Schedule, with conditions.

Section 9 bars tracking, behavioral monitoring and targeted advertising directed at children. Educational institutions have a limited exemption for tracking and monitoring tied to educational activities or safety, subject to conditions. Avoid sharing student data for ad targeting, and keep marketing to parents separate and consent-based.

Photos and videos of identifiable children are personal data. Get parental consent for each use, such as the website, social media, newsletters and yearbooks, separately from enrolment. Use clear opt-in forms at admission and per event, honor withdrawal for future use, avoid naming children in public posts, and restrict staff from using personal phones for this.

Records needed for academic administration and for reporting to boards and authorities can be handled on the basis of consent given at admission, or under the legal disclosure ground where a law requires sharing. Keep use within the stated purpose, secure the records, follow retention rules in education and tax laws, and avoid posting results with personal identifiers on open boards or websites.

Treat each app as a processor or a separate Fiduciary and check what it collects, whether it profiles or advertises to students, where data is stored and with whom it is shared. Sign processor agreements, confirm the parental consent flow, restrict apps that track children, and require deletion at the end of the contract.

The hospital or clinic is the Data Fiduciary, and patient data in an EMR or HIS is digital personal data subject to notice and consent, security, breach reporting and rights. The Act has no separate health data class, but the risk is high: use encryption, role-based access, audit logs and emergency access controls. Medical emergencies are covered by Section 7(f).

Use a layered consent at admission that covers treatment records, billing and insurance, laboratory work and sharing with referring doctors. Take separate optional consents for marketing, research and photos. Informed consent for treatment under medical law is separate from data consent. Record both in the HIS.

Section 8(7) allows you to keep data where a law requires it, so medical record retention rules, medico-legal needs and insurance claim periods continue to apply. Set a retention schedule by record type, erase or anonymize after expiry, document the legal basis for each period, and avoid keeping data "just in case".

Tell patients before recording and obtain consent for recording and storage. Limit access, encrypt storage and transmission, set a retention period and sign platform contracts. Do not use recordings for training or marketing without separate consent. Telemedicine guidelines on records and prescriptions apply as well.

Research, archiving and statistical use falls outside the Act only when the data is not used to make decisions about a specific individual and the prescribed standards are met. Trials with identifiable participants still need consent and ethics approval. Data that can be re-identified remains personal data, so document your de-identification method.

Map who is a processor and who is an independent Fiduciary: insurers and TPAs often act independently for claims. Sign processor agreements with laboratories, cloud and HIS vendors and billing providers, share only what is needed, require prompt breach notice and keep a current vendor list.

Sector rules on KYC, data security, outsourcing, record retention, grievances and cyber incident reporting continue to apply alongside the Act. Use the stricter standard where they overlap and build one control framework that maps both. Where a regulation requires retention or disclosure, Sections 7(d) and 8(7) support it.

KYC is required by regulation, but the Act has no broad "legal obligation" ground, so regulated entities usually collect KYC data under a clear notice and consent and rely on Section 8(7) to retain records that the law requires. Collect only the prescribed documents, secure them, and do not reuse KYC data for marketing.

Cross-selling is a different purpose from the original service, so it needs a specified purpose and consent of its own. Do not make unrelated consent a condition of the service, give a simple opt-out, and disclose any sharing with group companies or partners.

Designation depends on factors such as volume and sensitivity of data and risk to individuals. Large banks, large NBFCs, insurers and fintechs handling millions of records are likely candidates, but no designations had been reported at the time of this review. This is an assessment, not a rule: plan as if you may be designated if you operate at scale.

Define roles for each data flow: the bank or NBFC as Fiduciary, the fintech as processor or Fiduciary. Use data sharing agreements that limit use, take customer consent that names the parties, keep API-level consent logs, set breach notice timelines, audit rights and deletion on exit, and follow RBI's digital lending requirements.

Section 7(i) allows processing for employment purposes and to protect the employer from loss or liability, for example preventing corporate espionage and protecting trade secrets, and for providing a benefit an employee asks for. Payroll, attendance, leave, statutory filings, performance and discipline are typical. Optional items such as wellness programs and photos still need consent.

The statutory notice duty attaches to consent requests, but a clear employee notice is good practice and is required wherever you rely on consent. Cover what data you hold, the purposes, who receives it (payroll vendor, insurer, background check agency), retention, rights, how to complain and the contact person. Include it in offer letters, the handbook and HRIS onboarding.

Keep verification to what the role needs, use agencies as processors under contract and tell candidates what will be checked. Avoid excess collection such as social media or health data. Candidates are not yet employees, so it is safer to take consent for their checks instead of relying on the employment ground.

Monitoring of email, systems, location or CCTV needs a justification under Section 7(i) or consent, and must be proportionate. Publish a monitoring policy, limit access and retention, avoid covert monitoring, and separate personal data on BYOD devices. Track field staff location only during working hours.

Keep only what is needed for statutory and legal reasons such as payroll, PF and ESI records, tax and litigation limitation periods. Erase or anonymize the rest, restrict access to archives, and respond to access or erasure requests subject to those retention needs. Use an offboarding checklist that also revokes access and triggers deletion at vendors.

If you process a client's end-user data on the client's instructions for the client's purposes, you are usually a Processor. If you decide the purposes and means, such as your own analytics, product improvement or marketing, you are a Fiduciary for that data. Many SaaS firms are both, so document roles in the contract.

Section 17(1)(d) exempts many duties for processing, by an India-based person, of data of individuals outside India under a contract with a foreign person, but not the responsibility and security duties in Section 8(1) and 8(5). Data of people in India is fully covered. Control access for offshore teams and check any cross-border restrictions.

Expect questions on your data map, data processing agreement, security certifications and controls, breach process and timelines, sub-processors, cross-border transfers, retention and deletion, DPO or contact point, training and audit rights. Keep a ready compliance pack with your policies, DPA template, security summary and sub-processor list.

Personalization and profiling need clear purposes and consent, and marketing needs separate consent. Order, delivery and payment data can rest on consent or voluntary provision for that purpose. Avoid dark patterns. Large platforms above the prescribed user thresholds face erasure after three years of inactivity with advance notice. Do not target ads at children.

Make loyalty enrolment optional, explain the benefits and data use, and avoid making a phone number mandatory for a bill unless it is necessary. For CCTV, display notices, store footage securely, limit retention and restrict access.

These businesses hold ID proofs, bookings, payment and CCTV data. Collect only what is needed, take separate consent for marketing, secure ID copies, and keep records only as long as tax, registration and police-reporting rules require. Treat brokers, agents and lead portals as processors or independent Fiduciaries under written terms.

Typical stages are scoping and gap assessment, data mapping, drafting of policies and notices, consent design, vendor contract review, a breach plan and training, followed by ongoing support if you want it. We tailor scope to your size and sector, and you review every draft before it is used.

It is an external DPO and compliance lead function: a named contact point, advisory support, monitoring, help with rights and grievance handling, breach guidance and training. It suits organizations without in-house capability, or those that want independence. It does not replace board accountability.

Yes. We draft privacy notices, consent forms, data processing agreements, employee notices, retention schedules and breach response plans adapted to how your business actually operates.

Yes. We run role-based sessions for leadership, HR, IT and customer-facing teams, using scenarios from your own processes. Sessions can be held online or in person.

It depends on your size, number of systems and vendors, data volume and current readiness. A small business with few systems moves faster than a multi-entity group. A scoping call gives a realistic timeline measured against 13 May 2027.

Book a free 30-minute consultation or message us on WhatsApp. Share your sector, size and main systems, and we will outline a scope and next steps.