DPDPA compliance means five things, in this order. One, you can state every purpose for which you process digital personal data and show the itemised notice that disclosed it. Two, every purpose rests on a lawful basis — consent under Section 6 or a certain legitimate use under Section 7 — with a record that survives audit. Three, you hold reasonable security safeguards under Section 8(5) and can evidence them as designed, deployed and tested. Four, you can run the Rule 7 breach sequence from detection to a 72-hour detailed report without improvising. Five, you can serve a Data Principal's rights request inside your published timeline and prove you did. Everything else — DPIAs, audits, consent managers, cross-border registers — is a consequence of one of those five.
There is no size or revenue threshold. Section 3 reaches offshore processing tied to offering goods or services in India. And because the Act creates no certification regime, the only defence that exists is a contemporaneous evidence file.
Not screenshots of software — these are the working documents an engagement leaves behind, shown the way they sit on a compliance desk.
Forty-four sections and twenty-three rules, each resolved to a control with an owner and a dated artefact. Gaps are visible by section, not buried in a policy — so remediation starts where the exposure is largest.
Read Part one · FoundationsSix stages from intake to retention, each timestamped. Verification is proportionate, scope comes from the purpose register, and the record survives the erasure it executes.
Walk a request through the stagesOne row per purpose, per system, per vendor. Consent under Section 6 or a named Section 7 limb — and where neither exists, the purpose stops. The register is what makes notice, consent and rights answerable.
Read Part two · Notice and consentData class, destination, purpose, sectoral overlay and cost to repatriate. Rule 6(2) flow-down in one addendum applied to every processor, so a future restriction is a configuration change rather than a migration.
Read Part seven · TransfersAwareness logged at hour zero, both intimations out without delay, root cause and remediation timestamped, report filed on time. The second penalty head — up to ₹200 crore — never opens.
Run the 72-hour clockSeven obligations, each expressed the way we build them: statutory duty, operating control, artefact for the file, penalty head.
Section 5 requires the notice to accompany or precede the request for consent, and Rule 3 requires it to be itemised, in plain language, and independently understandable. If the reader has to open a second document to learn what you take and why, the notice has failed on its face.
Test every notice by reading it aloud to someone outside the company.
Each question is a document a regulator can ask for. Nothing is stored, nothing is sent — the score is computed in your browser.
Read it end to end as an implementation map, or jump to the obligation you are being asked about this week.
The Act is short. The file it demands is not. These eleven exhibits fix scope, roles, lawful basis and the sequence in which a programme has to be built — because building them out of order is what makes remediation expensive.
Run it once per system, not once per company. Most groups discover that two subsidiaries are in and one is out.
DPDPA does not split liability the way GDPR does. The Data Fiduciary answers for the processor it appointed, which makes the contract the control.
Each step is worthless without the one before it. Consent captured before purposes are fixed has to be captured twice.
Arguments about scope are almost always arguments about one of these four words.
There is no legitimate-interest basis for a private business. Section 7 is a closed list, and each entry is narrower than its label suggests.
Notified 13 November 2025. Three commencement tranches, three budget cycles.
If a Board notice arrived on Monday, these are what you would send. Anything else is supporting paper.
The market is selling certificates for a statute that recognises none. What the Board can act on is what you can produce, dated.
A certificate says somebody looked. A file says what they would have found.No certification regime exists under the Act
Reuse the inventory, the DSAR muscle and the vendor register. Rebuild everything below.
Nothing here needs a tool licence. All of it needs a decision-maker in the room.
Unowned obligations fail first. Name a person, not a function, and put it in the minutes.
Nine exhibits on the two obligations that generate the most litigation risk and the most engineering work: the itemised notice under Section 5 with Rule 3, and consent that is free, specific, informed, unconditional and unambiguous.
A notice that requires the reader to consult a second document has already failed. Test every line against the failure column.
Five blocks, in this order, in the reader's language, on the same screen as the request.
Section 6(1) is not a drafting instruction. It is a specification for a screen and a database row.
Real edits from real remediation. The right column is longer to read and far shorter to defend.
Withdrawal is not a preference flag. It starts a cascade with an evidentiary tail.
A registered intermediary, not a cookie banner. Live from 13 November 2026.
Every pattern below converts a valid consent into a contested one. The cost is not the fine; it is that the purpose becomes unusable retrospectively.
If the interface had to argue for itself before the Board, would you send it alone?S.6(1) read with S.5
Do the triage once, in writing, before May 2027. The register you produce is itself an exhibit.
This is the schema we implement. If your ledger is missing a column, that is the column counsel will be asked about.
Six exhibits on Sections 11 to 15 and Rule 14 — the access summary, correction and erasure, grievance redressal, nomination, requester verification, and the narrow grounds on which a request may lawfully be refused.
Every right has an engineering dependency. Discover them now, not on the first request.
Six stages, each timestamped. The clock you publish is the clock you are held to.
Over-collection at verification is the most common self-inflicted wound in a rights programme.
The Board expects internal exhaustion. A grievance mechanism that is hard to find becomes the complainant's best point.
Section 14 has no GDPR analogue, which is exactly why no platform is ready for it. Health, insurance, banking and legacy accounts will see it first.
The first Section 14 request will arrive as a bereavement, not a ticket.S.14
Refusal is legitimate on narrow grounds and indefensible on convenience. Say which ground, in the response.
Six exhibits on Section 8(6) and Rule 7 — detection triggers, the hour-by-hour sequence, what goes to the Data Principal versus the Board, and the drill that turns a runbook into a reflex.
Written to be executed by whoever is awake, not by the person who wrote it. Every step names an artefact.
There is no materiality filter. Rule 7(2)(b) lets the Board allow a longer period for the detailed report, but only on a written request — silence is never an extension.
Define these in advance and in writing. Deciding at 2 a.m. whether you are aware is how the seventy-two hours are lost.
Two audiences, two documents, one set of facts. Divergence between them is what an inquiry finds first.
The safeguards failure and the reporting failure are separately penalised. The second is entirely within your control after the fact — which is why late reporting is the costliest choice available.
You may not be able to prevent the breach. You can always prevent the second penalty.Schedule, entries 1 and 2
We run these with the actual on-call staff, unannounced, on a working day. Each produces a dated artefact for the file.
Four exhibits on Section 9, Rule 10 and Rule 12 — the three prohibitions, verifiable parental consent, the Fourth Schedule exemptions, and age assurance that does not become a surveillance programme of its own.
₹200 crore under the Schedule. The prohibitions apply to every general-audience product with under-eighteen users, not only to children's apps.
Rule 10 requires due diligence that the adult is identifiable and is in fact an adult. Design for the minimum that achieves it.
The exemptions are purpose-bound. They lift specific obligations for specific classes of Fiduciary, and nothing else.
The failure mode is over-correction: collecting identity documents from every user to solve a problem that affects a minority of accounts.
Five exhibits on Section 10 and Rule 13 — the designation factors, the DPIA that survives audit, the India-based DPO, algorithmic due diligence, and how to prepare before a notification arrives rather than after.
Designation adds no new principles. It adds proof obligations with named deliverables and an annual cadence.
Most DPIAs fail because they describe a system instead of assessing a risk to a person.
Getting this wrong is visible from outside the company, which makes it a cheap finding for the Board.
The duty is to verify that algorithmic software does not pose a risk to Data Principals' rights. That is testable, and the test is the artefact.
The Government notifies on volume and sensitivity of data, risk to Principals, effect on the sovereignty and integrity of India, risk to electoral democracy, and security of the State and public order. None of those are secrets about your own business.
Ask one question: if our data set led the evening news, would the Government be comfortable that nobody was watching it?S.10(1)
Four exhibits on cross-border transfer, the transfer register, processor contracting under Rule 6, and the sectoral localisation stack that survives the Act untouched.
DPDPA liberalised transfer relative to the 2019 drafts. The constraints that remain are the ones people forget to check.
Five columns, one row per flow. This is the artefact that makes a future restriction survivable.
Liability does not transfer, so the contract is a control rather than a shield. Write it to be enforced.
Where sectoral law is stricter, it governs. A DPDPA programme that ignores the regulator on the other side of the building is only half a programme.
Six exhibits on the Schedule, the Section 33(2) quantum factors, Board procedure and appeal, the voluntary undertaking, the non-monetary consequences, and what privilege does and does not protect.
Ceilings, not tariffs. The Board determines quantum after inquiry, and per instance — a single programme failure can produce several instances.
Five of the six are fixed by the time an inquiry opens. The sixth is built in the twelve months before it.
The Board functions as a digital office. Filings are documents, and documents are what you will be judged on.
Accepted by the Board, it bars proceedings on the same subject matter for the term of the undertaking.
Boards budget for the fine and are surprised by everything else. The non-monetary consequences usually arrive first.
The penalty is a number. Losing the enterprise renewal is a business model.S.37 · S.44(2)–(3)
Sequencing matters more than labelling. A gap assessment run as a vendor project is discoverable; the same work run under counsel need not be.
Four closing exhibits: where the first exposure sits by sector, the fiduciary nobody thinks about, DPDPA in the data room, and what an engagement with us produces.
Drawn from diagnostics, not from a survey. The first-failure column is where remediation should start.
No customer-facing product, no privacy team, and the largest volume of sensitive records in the building.
From May 2027 an unbuilt file is a quantified liability, not a covenant. Ask before the term sheet.
Counsel-led, evidence-first, privileged where privilege is available. No certificate, because none exists.
When the Board writes to you, the only question that matters is whether the file was built before the letter arrived.AMLEGALS DPDPA practice
Ceilings under the Schedule, not a prediction of quantum. The Board fixes quantum after inquiry on the Section 33(2) factors.
Hour zero is awareness, not confirmation. Every position on this scrubber has a required action and a document.
Awareness is when any of your defined triggers fires — not when legal is briefed and not when the finding is confirmed. Record the timestamp and the person, because every later deadline is measured from it and the Board will test it against your own logs.
Six stages. At each one, the service level, the action, the artefact it leaves behind, and the way it usually fails.
One published channel, named in every notice version. The clock starts when the request lands, including when it lands in the wrong inbox. Requests that arrive by reply to a marketing email still count.
Answered against the notified text, with the section or rule stated. If an answer here is wrong, tell us and we will correct it with a dated note.
Ask a thirteenth question →The ability to evidence, on any given date, that every purpose for which you process digital personal data was disclosed in an itemised notice under Section 5, rests on consent under Section 6 or a legitimate use under Section 7, is protected by reasonable safeguards under Section 8(5), can be breach-reported under Rule 7 inside the clock, and can be answered when a Data Principal exercises a right under Sections 11 to 14. It is a file, not a certificate.
In three phases from the notification of the DPDP Rules on 13 November 2025. Institutional provisions and the Board are live now. Consent Manager registration opens 13 November 2026. The substantive obligations bite on 13 May 2027. The Board can act on conduct from the date each provision commences — not from the date you finish your programme.
No. The Act creates no accreditation or certification regime and empanels no certifier. A vendor certificate has no statutory standing before the Data Protection Board. What has standing is the record: notices as served, consent artefacts as captured, safeguards as tested, breach logs as timestamped, rights requests as closed.
Yes. Section 3(b) reaches processing outside India connected with offering goods or services to Data Principals in India. A Delaware SaaS company with Indian subscribers is a Data Fiduciary. There is no revenue, headcount or user threshold for the base obligations — thresholds appear only in Rule 8 retention classes and in Significant Data Fiduciary designation.
Up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore for failing to intimate the Board or affected Data Principals. Two separate heads on one incident. Quantum is decided under Section 33(2) — nature, gravity and duration of the breach, the type of data affected, repetitive conduct, gain or loss, and what you did after you found out. The last factor is the only one you can still change today.
Rule 7 requires intimation to each affected Data Principal without delay, an initial intimation to the Board without delay, and a detailed report to the Board within seventy-two hours of becoming aware. There is no materiality filter and no de minimis carve-out. The operative words are becoming aware — which is why your detection triggers, not your legal opinion, decide when the clock started.
Whoever the Central Government notifies under Section 10(1), judged on volume and sensitivity of data, risk to Data Principals, effect on the sovereignty and integrity of India, risk to electoral democracy, security of the State and public order. Designation is not self-assessed, but it is predictable. If your data set would make a national news story, budget for the SDF duties now: DPIA, annual independent audit, algorithmic due diligence, and a DPO based in India who reports to the board.
Under the Act, yes. Section 16 is a negative list: transfer is free except to a country the Government restricts by notification. Two caveats do the real work. Sectoral law is untouched — RBI payment data localisation still binds. And Rule 15 lets the Government attach conditions about making personal data available to a foreign State. Build a transfer register now so that a future notification is a configuration change, not a migration project.
More than the vendors admit. There is no legitimate-interest basis for a private business, so every purpose you currently run on balancing tests has to move to consent or to a Section 7 legitimate use. Notice must be itemised and available in the languages of the Eighth Schedule to the Constitution. Everyone under eighteen is a child, with verifiable parental consent and a prohibition on tracking and targeted advertising. Breach reporting has no risk threshold. In our experience a mature GDPR programme covers roughly half the DPDPA file.
Only where the original collection can be shown to meet the Section 6 standard and the purpose is unchanged. A bundled tick against a privacy policy is not consent that is free, specific, informed and unambiguous. The practical answer is a triage: keep what is provable, re-paper what is salvageable with a fresh itemised notice, and stop the purposes you cannot defend. Doing that before May 2027 costs a sprint. Doing it during an inquiry costs the inquiry.
A tool is excellent at doing the same thing a million times and useless at deciding what that thing should be. Software cannot classify a purpose, choose between Section 6 and Section 7, draft a defensible notice, decide whether an incident is a reportable breach, or appear before the Board. Buy the tool for scale. Buy counsel for the positions the tool will execute — and keep the reasoning privileged.
Two weeks of diagnostic against the 56 exhibits on this page, producing a gap register with named owners and a dated remediation plan. Then a build phase: notices, consent architecture, Section 7 memoranda, processor contracts, breach runbook, rights workflow, DPIA where SDF designation is plausible. Then a standing retainer for the file — quarterly evidence review, board reporting, and representation if the Board ever writes to you.
Two weeks. Fifty-six exhibits tested against your actual processing. One gap register your board can read and your engineers can execute.
Scoping calls are privileged. Nothing you tell us in one becomes a marketing case study.