Questions on DPDPA,answered plainly.

Implementation produces the artefacts the Act requires: notices, consent flows, contracts, policies. Resilience is whether those artefacts hold under stress, such as a breach, a mass withdrawal of consent or a Board inquiry. The Act's penalties are triggered by failures in practice, so resilience is what reduces exposure.

The DPDP Rules, 2025 were notified in November 2025 with a phased timeline. Provisions on the Data Protection Board applied at once, consent manager registration follows after twelve months, and most Data Fiduciary obligations apply eighteen months after notification.

The Act requires reasonable security safeguards and intimation of a personal data breach to the Board and to each affected Data Principal. The Rules require a detailed report to the Board within 72 hours. Meeting that without a rehearsed plan is unrealistic.

Yes. DPDPA applies to digital personal data of any individual, including employees, job candidates, client contacts and vendor staff. A B2B business model does not remove those Data Principals from scope.

No. Section 7 sets out certain legitimate uses, including specified employment purposes, compliance with law and medical emergencies. Everything else generally needs consent that is free, specific, informed, unconditional and unambiguous.

Generally no. Section 8(7) requires erasure once the specified purpose is no longer served, unless retention is necessary to comply with law. The Rules add fixed timelines for certain large platforms.

The Act does not use the term, but its obligations on notice, purpose limitation, security, erasure and Data Principal rights cannot be met without knowing where personal data sits. Significant Data Fiduciaries must also carry out data protection impact assessments, which depend on one.

At minimum: the category of Data Principal, data fields, source, purpose, legal basis, storage location, processors, cross-border transfers, retention period and accountable owner.

Section 6 requires consent to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to personal data necessary for the specified purpose. It must be as easy to withdraw as to give.

Consent must be signified by a clear affirmative action. A pre-ticked box is not an action by the Data Principal and is unlikely to meet the standard.

Consent managers are entities registered with the Data Protection Board that let Data Principals give, manage, review and withdraw consent through an accessible, interoperable platform. They act on behalf of the Data Principal.

Under the DPDP Rules, 2025 a Data Fiduciary must intimate the Board and each affected Data Principal without delay on becoming aware of a personal data breach, and give the Board a detailed report within 72 hours, or a longer period the Board allows.

Failure to give the Board or affected Data Principals intimation of a personal data breach attracts a penalty of up to ₹200 crore under the Schedule to the Act.

Yes. Section 8(1) makes the Data Fiduciary responsible for complying with the Act in respect of processing undertaken by it or on its behalf by a Data Processor.

Yes. Section 8(2) allows a Data Fiduciary to engage a Data Processor only under a valid contract.

A Significant Data Fiduciary is a Data Fiduciary or class notified by the Central Government under Section 10, considering factors such as volume and sensitivity of data, risk to Data Principals, and impact on sovereignty, security and public order.

It must appoint a Data Protection Officer based in India who is responsible to the board, appoint an independent data auditor, and carry out periodic data protection impact assessments and audits, along with measures in the Rules.

The highest ceiling in the Schedule is up to ₹250 crore, for failure of a Data Fiduciary to take reasonable security safeguards to prevent a personal data breach.

Under Section 33(2) the Board considers the nature, gravity and duration of the breach, the type of personal data, whether it is repetitive, any gain or loss avoided, mitigation and its timeliness, proportionality, and the likely impact of the penalty.

No. Section 8(7) requires erasure when the purpose is served unless retention is necessary for compliance with law. Records a law such as PMLA requires to be kept may be retained for that period and purpose.

Using data collected for account opening to market other products is a new purpose. Unless a legitimate use applies, it generally requires specific consent.

An operating-system permission grants technical access; it does not by itself provide the notice of purpose and the specific consent Section 5 and Section 6 require. Apps should pair permissions with a clear notice and choice.

Where they process borrower data on behalf of a regulated lender, they generally act as Data Processors, and the lender as Data Fiduciary remains responsible under Section 8(1).

No. DPDPA does not create separate categories. However, under Section 33 the Board considers the type and nature of personal data when determining penalties, so health data breaches are likely to be treated as more serious.

Section 7 permits certain processing without consent, including responding to a medical emergency involving a threat to life or health. Routine care, research and marketing should be assessed separately and often need consent.

Under Section 2(f) a child is an individual who has not completed eighteen years of age.

Section 9 requires verifiable consent of the parent or lawful guardian, prohibits processing likely to cause detrimental effect on a child's well-being, and bars tracking, behavioural monitoring and targeted advertising directed at children, subject to exemptions in the Rules. Breach can attract a penalty of up to ₹200 crore.

Generally yes. Consent must be specific to a purpose. Processing an order and sending marketing are different purposes, so marketing typically requires its own consent that can be refused and withdrawn.

The Rules require certain classes of large Data Fiduciaries, including e-commerce entities above a user threshold, to erase personal data of users who have not engaged for three years, after notifying them in advance.

It depends on each activity. Processing client data on the client's instructions is typically as a Data Processor. Processing for the company's own purposes, such as analytics, benchmarking or marketing, makes it a Data Fiduciary for that activity.

Section 17(1)(d) exempts certain provisions for processing personal data of persons not within India under a contract with a person outside India. Obligations such as security safeguards and the company's own employee data remain relevant.

Only the Central Government can notify Significant Data Fiduciaries. Given the volume and sensitivity of subscriber data, large telecom operators are strong candidates and should prepare for Section 10 obligations.

Where retailers collect and handle subscriber data on behalf of an operator, they generally act as Data Processors, and the operator remains responsible under Section 8(1).

When they collect and handle customer data on behalf of an insurer, they generally act as Data Processors, and the insurer remains responsible. Some brokers may act as independent fiduciaries for their own purposes.

No. Data should be erased once its purpose is served, unless retention is required by law. Insurers should align retention with regulatory requirements and limitation periods.

Section 7(i) allows processing without consent for employment purposes and to safeguard the employer from loss or liability, among other listed purposes. Processing outside those purposes may require consent.

Only as long as needed for the purpose, such as the recruitment for which it was provided, unless law requires longer. Employers should set and apply a retention period for unsuccessful candidates.

Hotels may collect and keep ID where a law requires it, for the period it requires. Retaining ID copies beyond that, or collecting more than required, is difficult to justify under Section 8(7).

Section 16 permits transfers outside India except to countries restricted by Government notification. Contracts and safeguards are still expected, and sectoral rules may add requirements.

Gaming platforms must obtain verifiable parental consent for users under 18, avoid tracking, behavioural monitoring and targeted advertising directed at children, and, for large gaming intermediaries, erase data of users inactive for three years under the Rules.

The Rules require Data Fiduciaries to adopt appropriate measures to ensure verifiable parental consent. A self-declared birth year alone is unlikely to be seen as sufficient where children are likely users.

Section 17(2)(a) lets the Central Government exempt notified instrumentalities of the State in specified interests. It does not automatically exempt private vendors, and the scope of any exemption depends on the notification.

Where they process personal data on a department's instructions, they generally act as Data Processors. Where they use the data for their own purposes, they may be Data Fiduciaries.

A cyber incident may need reporting to CERT-In under its 2022 directions, and a personal data breach must also be intimated to the Data Protection Board and each affected Data Principal under DPDPA and the Rules. Sectoral reporting to the RBI may apply as well.

CERT-In's April 2022 directions require specified cyber security incidents to be reported within six hours of noticing them.

Where the law requires retention, such as KYC and transaction records under PMLA, the bank may retain those records for the required period. Data not covered by a legal requirement should be erased once its purpose is served.

Under the PMLA framework, records are generally kept for five years after the business relationship ends or the transaction, subject to the specific rule. Banks should confirm the period applicable to each record type.

When they process borrower data on behalf of a bank or NBFC, they generally act as Data Processors. The lender, as Data Fiduciary, remains responsible for compliance under Section 8(1).

Processing a third person's personal data needs a lawful basis of its own. Lenders should limit collection and use of reference contacts and follow applicable RBI conduct rules.

No, not by itself. A permission grants technical access. DPDPA requires a notice of the purpose and consent that is free, specific, informed and unambiguous. Apps should show their own notice alongside permissions.

RBI's digital lending rules restrict access to contacts, media and call logs. DPDPA separately requires the data to be necessary for the stated purpose.

Only if the purpose was clearly notified and the customer gave specific consent for it, and subject to RBI rules on app data access. Data collected for another purpose cannot be repurposed without a new basis.

Section 11 gives Data Principals the right to obtain a summary of personal data being processed and the processing activities undertaken.

Account aggregators operate under RBI regulation using consent artefacts that specify purpose, duration and revocation. The model closely reflects DPDPA's requirements for specific, informed and withdrawable consent.

They are distinct concepts. Consent managers are registered with the Data Protection Board under DPDPA. The Rules set their registration conditions.

Marketing is a separate purpose from treatment. It generally requires specific, freely given consent that the patient can refuse without affecting care.

Section 7 allows processing for responding to a medical emergency involving a threat to life or immediate threat to health, and for certain health services during epidemics or public health threats, among other listed uses.

DPDPA does not ban specific apps, but the Data Fiduciary must take reasonable security safeguards. Uncontrolled copies on staff and third-party devices make it harder to meet that duty and to respond to a breach.

Under DPDPA a breach includes unauthorised processing, accidental disclosure, loss of access and similar events that compromise confidentiality, integrity or availability of personal data. A report sent to the wrong person can qualify.

Using trial participants' personal data for marketing is a new purpose. It would generally require fresh, specific consent under DPDPA.

Where a CRO processes participant data on the sponsor's instructions, it generally acts as a Data Processor, and the sponsor as Data Fiduciary remains responsible.

It is consent from a child's parent or lawful guardian that the Data Fiduciary has taken reasonable steps to verify, as prescribed by the DPDP Rules, including checking that the person is an identifiable adult.

Breach of the additional obligations for children under Section 9 can attract a penalty of up to ₹200 crore.

Section 9(3) bars tracking, behavioural monitoring and targeted advertising directed at children, subject to exemptions notified in the Rules. Adaptive features must fit within an exemption or be redesigned.

Proctoring involves monitoring. For children it must fit the Section 9 framework and any Rules exemption, be limited to its purpose, and be secured and erased appropriately.

No. The Rules exempt certain processing of children's data by educational institutions for specified purposes, such as educational activities and safety, from some Section 9 requirements. Other obligations continue to apply.

Only to the extent they process data for the school's exempt purpose on its behalf. Processing for the vendor's own purposes needs its own lawful basis.

Yes, where they process personal data such as identifiers, device data or hashed emails. The brand generally acts as Data Fiduciary and should have a basis, a notice and appropriate contracts.

Hashed data that can be matched back to an individual remains data about an identifiable person and should be treated as personal data.

Consent must be signified by a clear affirmative action. A pre-ticked box is not an action by the user and is unlikely to meet the standard.

The Central Consumer Protection Authority's 2023 guidelines identify deceptive design practices such as false urgency, basket sneaking and confirm-shaming as unfair trade practices.

The Rules require certain e-commerce entities above a registered-user threshold in India to erase personal data of users who have not engaged for three years, after informing them at least 48 hours in advance, unless retention is required by law.

Yes, where tax or other law requires retention. Only data required by law should be retained, for the period required.

A Data Fiduciary determines the purpose and means of processing. A Data Processor processes on behalf of a fiduciary. A company can be both, for different activities.

DPDPA places obligations primarily on Data Fiduciaries, who must ensure processors comply through contract. Processors should expect those obligations to flow down in their contracts.

DPDPA does not use the term, but a processor engaging another entity to process data on the fiduciary's behalf creates a chain that the fiduciary remains responsible for. Contracts should govern each link.

Often. Logs, error traces and support tickets can capture identifiers and content. They should be minimised, secured and included in data maps.

Common questions cover the vendor's role, breach notification timelines, sub-processors, data location and transfers, security safeguards, retention and support for Data Principal rights.

No. They evidence security controls, which support Section 8(5), but do not address roles, consent, notice, rights or other DPDPA obligations.

Where they collect subscriber KYC on behalf of an operator, they generally act as Data Processors. The operator remains responsible under Section 8(1).

Limit capture to the official process, prohibit local copies, audit devices and contractually bind distributors and retailers to security and deletion obligations.

Beyond Section 10's DPO, independent auditor, DPIA and audit requirements, the Rules require an annual DPIA and audit and due diligence that algorithmic software does not pose risks to Data Principals' rights, among other measures.

Breach of the additional obligations of a Significant Data Fiduciary can attract a penalty of up to ₹150 crore.

Sections 11 to 14 provide rights to access information, correction and erasure, grievance redressal and to nominate another person, alongside the right to withdraw consent.

Yes. Section 13 requires a Data Principal to exhaust the grievance redressal opportunity with the Data Fiduciary or consent manager before approaching the Board.

Where agents collect and handle data for an insurer, they generally act as its Data Processors, and the insurer remains responsible. Agreements should impose security and deletion duties.

Require return or destruction of all customer personal data held by the agent, revoke access and document confirmation.

When processing claims data on an insurer's behalf, TPAs generally act as Data Processors. The insurer remains responsible for compliance.

DPDPA does not create a separate category, but the Board considers the type and nature of personal data when determining penalties, so breaches of health data are likely to be viewed seriously.

Section 6 limits consent to personal data necessary for the specified purpose, and Section 8(7) requires erasure when the purpose is served. Together they require collecting and keeping only what is needed.

Collecting data for an unspecified future purpose is hard to reconcile with DPDPA's purpose-specific consent. Cross-selling should be a separate, notified purpose with its own consent.

Only as long as needed for the recruitment purpose, unless the candidate consents to longer retention, for example for future roles. Data should be erased once the purpose is served.

Section 7(i) permits processing for employment purposes. Whether it extends to candidates who never become employees is not settled; relying on consent for talent pools is safer.

Section 7(i) allows processing for employment purposes and to safeguard the employer from loss or liability. Monitoring should be necessary and proportionate to those purposes.

Consent must be free. In an employment relationship that can be difficult to show, so employers should rely on a clearly applicable legitimate use and limit monitoring to it.

Generally yes, when it verifies candidates on the employer's instructions. The employer remains responsible for the processing.

Only what is necessary for the stated purpose of the role, with notice to the candidate. Checks should be proportionate and data retained only as needed.

Hotels may collect and retain ID where law requires it, such as for foreign guest reporting, for the period required. Retaining copies beyond that is difficult to justify under Section 8(7).

Hotels should avoid storing Aadhaar copies where not required, use masked Aadhaar or verification methods, and follow Aadhaar-specific legal restrictions.

Yes, for purposes beyond the programme's core function. Profiling for marketing and sharing with partners are separate purposes requiring specific consent.

Sharing with partners for their own purposes typically needs clear notice and specific consent. Sharing with processors needs a contract.

Yes, where individuals can be identified. It should be collected for a stated purpose, secured, access-controlled and retained only as long as needed.

Collecting login data should be limited to what is needed to provide the service, with clear notice. Use for marketing would need specific consent.

Where children are likely users, platforms must obtain verifiable parental consent before processing their data, which requires reasonable steps to establish age and parental identity.

A self-declared birth year alone is unlikely to be sufficient where children are likely users, given the Rules' requirement for due diligence in verifying parental consent.

Where it is linked to an account, device identifier or other data that identifies a player, it is personal data and subject to DPDPA.

Section 9(3) bars tracking, behavioural monitoring and targeted advertising directed at children, subject to exemptions. Targeting offers based on a child's behaviour is high risk.

The DPDP Rules apply it to online gaming intermediaries above a registered-user threshold in India, requiring erasure after three years of inactivity with advance notice, unless law requires retention.

The Rules require informing the Data Principal at least 48 hours before erasure that their data will be erased unless they log in or engage.

DPDPA applies to the State, but Section 17(2)(a) lets the Central Government exempt notified instrumentalities in specified interests such as sovereignty, security and public order.

Not automatically. The scope depends on the notification. Vendors should assume DPDPA applies to their own processing and contract accordingly.

As a processor, the vendor should return data to the department and delete remaining copies, including backups and test environments, unless law requires retention. Contracts should specify this.

Yes. A written certificate of deletion, covering all environments and backups, is good practice and evidences compliance.

It is not prohibited, but security safeguards apply to every environment. Masking or synthetic data reduces risk and is good practice.

The Rules list measures including encryption, obfuscation or masking, access control, logging and monitoring, backups and contractual safeguards with processors.