https://amlegalsdpdpa.com/dpdpa-exposure-assessmentA strategy field guide to India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025: eight arguments on resilience over implementation, and twelve sector briefings on how unclear thinking breaks DPDPA programmes.en-inhttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-resilience-not-implementationhttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-resilience-not-implementationFri, 25 Sep 2026 00:00:00 GMTDPDPA implementation ends on a date. Resilience begins on it. Why India's data protection law rewards organisations built to survive a breach, not just pass a checklist.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-unclear-thinkinghttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-unclear-thinkingFri, 25 Sep 2026 00:00:00 GMTBefore data leaks, clarity leaks. Seven common assumptions that quietly break DPDPA implementation in Indian companies, and the clearer thought that replaces each.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-data-mappinghttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-data-mappingFri, 25 Sep 2026 00:00:00 GMTYou cannot protect what you have not named. Why a living data map is the foundation of DPDPA compliance, breach response and every Data Principal right.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-consent-architecturehttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-consent-architectureFri, 25 Sep 2026 00:00:00 GMTUnder Section 6 of DPDPA, consent must be free, specific, informed, unconditional and unambiguous, and as easy to withdraw as to give. Why a banner is not a consent architecture.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-breach-72-hourshttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-breach-72-hoursFri, 25 Sep 2026 00:00:00 GMTUnder the DPDP Rules, 2025 a personal data breach must be intimated to the Board and affected Data Principals without delay, with a detailed report within 72 hours. What the first three days actually demand.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-processors-vendorshttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-processors-vendorsFri, 25 Sep 2026 00:00:00 GMTUnder Section 8 of DPDPA the Data Fiduciary remains responsible for processing by its Data Processors. How to govern vendors, SDKs and cloud providers as part of your own estate.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-board-governancehttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-board-governanceFri, 25 Sep 2026 00:00:00 GMTWhat boards and CXOs must ask about DPDPA: ownership, Significant Data Fiduciary duties under Section 10, data protection officers, impact assessments and audits.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-penalties-exposurehttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-penalties-exposureFri, 25 Sep 2026 00:00:00 GMTThe DPDPA penalty schedule: up to ₹250 crore for failed security safeguards, ₹200 crore for breach intimation and children's data, ₹150 crore for SDF duties, ₹50 crore otherwise, and the factors the Board weighs.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-banking-bfsihttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-banking-bfsiFri, 25 Sep 2026 00:00:00 GMTHow DPDPA applies to banks and financial institutions in India: KYC retention under PMLA versus erasure, vendor chains, breach intimation alongside RBI and CERT-In reporting.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-fintech-nbfchttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-fintech-nbfcFri, 25 Sep 2026 00:00:00 GMTHow DPDPA applies to fintechs, NBFCs and digital lenders: purpose-bound consent for app permissions, lending service providers as processors, and alternative-data scoring.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-healthcare-pharmahttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-healthcare-pharmaFri, 25 Sep 2026 00:00:00 GMTHow DPDPA applies to hospitals, diagnostics, healthtech and pharma: patient consent, the narrow medical-emergency legitimate use, clinical trial data and TPAs.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-edtech-childrenhttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-edtech-childrenFri, 25 Sep 2026 00:00:00 GMTUnder Section 9 of DPDPA a child is anyone under 18. EdTech platforms need verifiable parental consent and may not track, behaviourally monitor or target advertising at children.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-ecommerce-d2chttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-ecommerce-d2cFri, 25 Sep 2026 00:00:00 GMTHow DPDPA applies to e-commerce and D2C: marketing consent, pixels and SDKs as processors, dark patterns, and the three-year erasure rule for large platforms under the DPDP Rules.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-saas-it-serviceshttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-saas-it-servicesFri, 25 Sep 2026 00:00:00 GMTHow DPDPA applies to SaaS companies and IT services firms: processor versus fiduciary roles, the Section 17 exemption for processing foreign clients' data, and contract design.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-telecomhttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-telecomFri, 25 Sep 2026 00:00:00 GMTHow DPDPA applies to telecom operators, ISPs and telecom value-added services: subscriber data at scale, dealer networks, SDF likelihood and overlap with the Telecommunications Act, 2023.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-insurancehttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-insuranceFri, 25 Sep 2026 00:00:00 GMTHow DPDPA applies to insurance: health and claims data, agents and brokers as processors, TPAs, underwriting purposes and retention after claims close.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-hr-staffinghttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-hr-staffingFri, 25 Sep 2026 00:00:00 GMTHow DPDPA applies to employee and candidate data: the Section 7(i) employment legitimate use, background checks, candidates never hired, and staffing firms as processors.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-hospitality-travelhttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-hospitality-travelFri, 25 Sep 2026 00:00:00 GMTHow DPDPA applies to hotels, airlines, OTAs and travel companies: passport and ID copies, guest registers, loyalty programmes and booking partners.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-gaminghttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-gamingFri, 25 Sep 2026 00:00:00 GMTHow DPDPA applies to online gaming: minors on the platform, behavioural data, the DPDP Rules' three-year erasure requirement for large gaming intermediaries, and in-game advertising.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-government-vendorshttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-government-vendorsFri, 25 Sep 2026 00:00:00 GMTHow DPDPA applies to companies processing personal data for government departments: the State exemption under Section 17(2)(a) does not automatically extend to vendors.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-bfsi-three-reporting-clockshttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-bfsi-three-reporting-clocksFri, 25 Sep 2026 00:00:00 GMTOne incident at a bank can start three clocks: CERT-In's six hours, the RBI's own reporting, and DPDPA intimation to the Board and every affected customer. How to run one playbook for all three.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-bfsi-retention-vs-erasurehttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-bfsi-retention-vs-erasureFri, 25 Sep 2026 00:00:00 GMTPMLA requires banks to keep KYC and transaction records. DPDPA requires erasure once purpose ends. How to separate the legal hold from everything that merely stayed.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-bfsi-agents-partnershttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-bfsi-agents-partnersFri, 25 Sep 2026 00:00:00 GMTDirect selling agents, collection agencies, business correspondents and co-lending partners all handle customer data. Under DPDPA the bank remains responsible for processing done on its behalf.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-fintech-app-permissionshttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-fintech-app-permissionsFri, 25 Sep 2026 00:00:00 GMTAn Android or iOS permission grants access, not consent. How fintech and lending apps should pair every permission with a purpose, a notice and a real choice.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-fintech-alternative-datahttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-fintech-alternative-dataFri, 25 Sep 2026 00:00:00 GMTFintechs score credit on SMS, device and behavioural data. Under DPDPA, data collected for one purpose cannot silently feed another. How to use alternative data lawfully.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-fintech-account-aggregatorhttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-fintech-account-aggregatorFri, 25 Sep 2026 00:00:00 GMTIndia's account aggregator framework already runs on purpose-bound, time-bound, revocable consent. Why it is the blueprint for DPDPA consent across fintech.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-healthcare-patient-consenthttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-healthcare-patient-consentFri, 25 Sep 2026 00:00:00 GMTDPDPA allows limited processing for medical emergencies. Routine care, analytics, research and marketing each need their own basis. How hospitals separate care from commerce.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-healthcare-reports-messaginghttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-healthcare-reports-messagingFri, 25 Sep 2026 00:00:00 GMTDiagnostic labs and hospitals share reports over consumer messaging apps for speed. Under DPDPA, every forwarded copy is part of your data estate and your security duty.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-pharma-clinical-researchhttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-pharma-clinical-researchFri, 25 Sep 2026 00:00:00 GMTConsent to a clinical trial does not extend to marketing a later product. How pharma and research teams scope purpose, retention and processors for trial and real-world data.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-edtech-parental-consenthttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-edtech-parental-consentFri, 25 Sep 2026 00:00:00 GMTDPDPA requires verifiable consent of a parent before processing a child's data. What verification means under the Rules and how to build it into onboarding.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-edtech-behavioural-monitoringhttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-edtech-behavioural-monitoringFri, 25 Sep 2026 00:00:00 GMTSection 9(3) bars tracking, behavioural monitoring and targeted advertising directed at children. What that means for adaptive learning, proctoring and engagement analytics.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-edtech-schools-exemptionshttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-edtech-schools-exemptionsFri, 25 Sep 2026 00:00:00 GMTThe DPDP Rules exempt certain processing by educational institutions from parts of Section 9. The exemption follows the purpose, not the product. What schools and EdTech vendors must know.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-ecommerce-pixels-sdkshttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-ecommerce-pixels-sdksFri, 25 Sep 2026 00:00:00 GMTEvery advertising pixel and SDK sends personal data to a third party. Under DPDPA that is processing, often cross-border, and the brand remains responsible.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-ecommerce-dark-patternshttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-ecommerce-dark-patternsFri, 25 Sep 2026 00:00:00 GMTPre-ticked boxes, confirm-shaming and buried opt-outs fail DPDPA's clear affirmative action test and are regulated as unfair practices under India's dark patterns guidelines.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-ecommerce-dormant-accountshttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-ecommerce-dormant-accountsFri, 25 Sep 2026 00:00:00 GMTLarge e-commerce entities must erase personal data of users inactive for three years, after notice. How to build dormancy, notice and erasure into the customer lifecycle.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-saas-processor-or-fiduciaryhttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-saas-processor-or-fiduciaryFri, 25 Sep 2026 00:00:00 GMTRole under DPDPA follows who decides purpose and means. How SaaS companies map roles per activity, and why product features can quietly turn a processor into a fiduciary.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-saas-sub-processorshttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-saas-sub-processorsFri, 25 Sep 2026 00:00:00 GMTMonitoring, support, email, analytics: every SaaS runs on sub-processors. How to map the chain, flow obligations down and evidence them to enterprise customers.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-saas-enterprise-procurementhttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-saas-enterprise-procurementFri, 25 Sep 2026 00:00:00 GMTIndian enterprises are adding DPDPA questions to vendor due diligence. What buyers now ask and how resilient vendors answer faster than competitors.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-telecom-retail-kychttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-telecom-retail-kycFri, 25 Sep 2026 00:00:00 GMTRetailers and distributors collect subscriber identity documents on behalf of telecom operators. Under DPDPA the operator remains responsible. How to govern the edge.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-telecom-sdf-readinesshttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-telecom-sdf-readinessFri, 25 Sep 2026 00:00:00 GMTLarge telecom operators are strong candidates for Significant Data Fiduciary notification. What Section 10 and the Rules require and how to prepare before notification.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-telecom-rights-at-scalehttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-telecom-rights-at-scaleFri, 25 Sep 2026 00:00:00 GMTAccess, correction, erasure and grievance requests at telecom volume cannot run on email. How to productise rights handling with identity checks and timelines built in.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-insurance-agents-brokershttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-insurance-agents-brokersFri, 25 Sep 2026 00:00:00 GMTProposal forms travel through agents, branch teams and brokers before a policy issues. How insurers govern the distribution chain as part of their own data estate.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-insurance-claims-health-datahttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-insurance-claims-health-dataFri, 25 Sep 2026 00:00:00 GMTClaims files hold diagnoses, bank details and family information, handled by TPAs and hospitals. How insurers secure the claims chain and prepare for breach intimation.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-insurance-underwriting-minimisationhttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-insurance-underwriting-minimisationFri, 25 Sep 2026 00:00:00 GMTSection 6 limits consent to data necessary for the purpose. How insurers decide what underwriting genuinely needs, and stop collecting for the file.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-hr-candidate-datahttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-hr-candidate-dataFri, 25 Sep 2026 00:00:00 GMTDPDPA's employment legitimate use covers employees. Candidates who were never hired need their own basis and a retention limit. How employers and staffing firms handle CV data.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-hr-employee-monitoringhttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-hr-employee-monitoringFri, 25 Sep 2026 00:00:00 GMTProductivity trackers, keystroke logging and webcam checks raise DPDPA questions of necessity and purpose. How employers set limits they can defend.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-hr-background-verificationhttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-hr-background-verificationFri, 25 Sep 2026 00:00:00 GMTBackground checks collect education, employment, address and sometimes criminal records. How employers limit, contract and audit verification vendors under DPDPA.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-hospitality-id-copieshttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-hospitality-id-copiesFri, 25 Sep 2026 00:00:00 GMTHotels collect passports and identity documents at check-in. How to collect only what law requires, restrict access and erase on schedule under DPDPA.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-hospitality-loyaltyhttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-hospitality-loyaltyFri, 25 Sep 2026 00:00:00 GMTLoyalty programmes build rich guest profiles. How hotels and airlines define purpose, get consent and avoid turning loyalty into surveillance.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-hospitality-cctv-wifihttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-hospitality-cctv-wifiFri, 25 Sep 2026 00:00:00 GMTCCTV footage and Wi-Fi login data are personal data. How hotels set retention, access and notice for surveillance and connectivity systems.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-gaming-age-assurancehttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-gaming-age-assuranceFri, 25 Sep 2026 00:00:00 GMTA self-declared birth year is not verification. How gaming platforms design age assurance and parental consent that meet DPDPA and the DPDP Rules.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-gaming-player-telemetryhttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-gaming-player-telemetryFri, 25 Sep 2026 00:00:00 GMTGames log every action. Linked to an account or device, telemetry is personal data, and for children, behavioural monitoring is restricted under Section 9(3).https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-gaming-dormant-erasurehttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-gaming-dormant-erasureFri, 25 Sep 2026 00:00:00 GMTThe DPDP Rules require large online gaming intermediaries to erase data of users inactive for three years, after notice. How to plan dormancy and erasure.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-govt-exemption-scopehttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-govt-exemption-scopeFri, 25 Sep 2026 00:00:00 GMTThe Central Government may exempt notified instrumentalities of the State. Private contractors are not automatically covered. How vendors read the exemption and their contracts.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-govt-contract-endhttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-govt-contract-endFri, 25 Sep 2026 00:00:00 GMTWhen a government IT contract ends, citizen data often stays with the vendor. How to plan data return, deletion and certification under DPDPA.https://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-govt-test-environmentshttps://amlegalsdpdpa.com/dpdpa-strategy/dpdpa-govt-test-environmentsFri, 25 Sep 2026 00:00:00 GMTCopying production data into development and test environments is common and dangerous. How vendors mask, minimise and govern non-production data.