YORIX
Digital Partners
Distributing Possibilities, delivering progress digitally
YORIX
Digital Partners
Distributing Possibilities, delivering progress digitally
India's DPDP Act governs how organisations collect, use, store and protect personal data. It applies across industries and affects businesses of every size that handle information relating to individuals.
Understand what the DPDP Act means in plain language and how it affects modern organisations.
Learn whether your organisation is likely to be affected and what questions you should already be asking.
Discover the journey from data discovery and gap assessment to implementation and governance.
For many organisations, the challenge is not whether they possess data. It is understanding where that data exists, how it moves through the organisation, who can access it, and whether the organisation can demonstrate responsible governance when required.
This guide answers some of the most common questions business owners, management teams and decision-makers are asking as they begin their DPDP journey.
It is India's principal law governing the processing of personal data in digital form. It establishes obligations for organisations that collect and use personal information, and provides rights to the individuals whose data is being processed. The Act seeks to create a framework in which organisations can continue to operate and innovate while ensuring that personal information is handled responsibly.
Modern organisations collect and process significant amounts of information every day through websites, mobile applications, employee records, financial transactions, customer interactions, healthcare systems and third-party platforms. As businesses become increasingly digital, personal information moves across departments, vendors, cloud platforms and external service providers. The DPDP Act introduces a common framework to govern these activities transparently and accountably.
Personal data is often spread across multiple systems, teams and external providers. Over time, businesses may lose visibility into:
The DPDP Act encourages organisations to understand and manage these questions systematically.
Cybersecurity and data protection are closely related, but they are not the same thing. Cybersecurity focuses on protecting systems, devices and networks from unauthorised access, attacks and technical failures. The DPDP Act focuses on how organisations collect, use, retain, share and govern personal data throughout its lifecycle. Strong cybersecurity is important, but it is only one part of a broader compliance framework.
Personal data is any information that relates to an identifiable individual. Examples may include names, addresses, email IDs, mobile numbers, PAN and Aadhaar details, photographs, salary records, medical reports, banking information, customer identifiers, employee records and location information. The definition extends beyond customer data it may include information relating to employees, contractors, patients, students and vendors.
Applicability does not depend on the size of an organisation. A large enterprise and a small firm may both process significant amounts of personal information. The relevant question is not how many employees you have, but whether you collect, store, use or share personal data.
Banks, insurers and healthcare institutions often process sensitive information but personal data is handled across finance, manufacturing, education, consulting, logistics, retail and professional services alike.
Startups, LLPs, family-run businesses and proprietorships collect customer, employee, vendor and operational data through websites, accounting systems, payroll platforms and third-party software. The form of the business matters less than the nature of the data being processed.
Manufacturers hold employee, supplier, logistics and customer records. Educational institutions process student and parent information. Professional firms handle financial, identity and payroll records. Every organisation should understand how personal information enters and moves through its business.
The question is not "How large is my organisation?" — it is "How do we collect, store, process or share personal data?"
For many organisations, DPDP readiness begins with visibility. Before implementing new technologies or policies, organisations should understand the information they already possess and how it moves across their operations.
In many cases, organisations already have security measures, contracts and internal processes in place. The challenge is often not the absence of controls, but the ability to demonstrate them clearly and consistently. DPDP readiness is not simply about deploying technology — it is about ensuring that the use of personal information remains transparent, controlled and accountable.
Most organisations are not starting from zero. They may already have information security measures, employment policies, vendor agreements, operational procedures, retention practices, audit controls and regulatory obligations in place.
The first step is understanding where these measures exist and identifying the areas that require greater clarity. To assist with this, Yorix Digital Partners has developed sector specific self-assessment questionnaires designed for different industries and operating environments. These assessments examine:
Most organisations already possess elements of compliance. The challenge is rarely the complete absence of controls — it is demonstrating those controls consistently across people, processes and technology.
Many organisations assume compliance begins with the purchase of software. In reality, it begins with understanding. The journey typically unfolds in stages.
Know what personal data you hold, where it originates, why it was collected, who uses it, and how long it remains relevant. Without this visibility, meaningful governance is difficult.
Personal information rarely resides in a single location. It exists across enterprise applications, accounting systems, CRM platforms, email, HR and payroll software, cloud services, shared drives and employee devices.
Payroll providers, software vendors, cloud platforms, consultants, logistics partners and managed service providers may all receive data. Understand what is shared externally and the responsibilities attached to it.
Technology alone cannot create accountability. Effective governance requires defined policies, standard operating procedures, ownership, retention practices, escalation mechanisms and incident response.
Once visibility and governance are established, strengthen the controls that support them — technical, operational, contractual or organisational. The objective is not complexity; it is consistency.
Compliance is not a one-time exercise. Businesses, teams, vendors and systems change. The organisations that adapt treat privacy and governance as an ongoing discipline, not a project with a fixed end date.
In simple terms, the whole of it reduces to one sequence:
Know the data → tell the person → obtain the required consent → use the data for the stated purpose → protect it → respond to the person’s rights → retain it only as required → delete it when required → manage processors → report breaches → maintain evidence → demonstrate compliance when required.
Once it becomes known that you are looking at DPDP, you will start receiving advice. Much of it will be sound. Some of it will describe a method as though it were a legal requirement, which is a different thing, and it is difficult to tell the two apart if the vocabulary is unfamiliar. These are the ones worth recognising. Each correction below rests on a definition published in the glossary, so you can check it rather than take our word for it.
You will be toldEvery organisation needs a Record of Processing Activities and a Data Protection Impact Assessment.
What is trueA DPIA is specifically required for Significant Data Fiduciaries. A RoPA is a common and genuinely useful privacy-management practice, but it is not named as a standalone requirement in the DPDP Rules. Both may be worth doing. Neither is automatically obligatory because someone has put them on a proposal.
You will be toldYou are a Significant Data Fiduciary, so the additional obligations apply to you.
What is trueA Significant Data Fiduciary is one that has been specifically notified as such by the Central Government. It is not a category an organisation falls into by being large, or by holding sensitive data, or because an assessment concluded it should. If you are told the SDF obligations apply, the reasonable question is: on what basis.
You will be toldWe will map your GDPR programme across. It is broadly the same law.
What is trueThe vocabulary maps; the obligations do not. DPDP has no direct equivalent of legitimate interests, and no standalone right to data portability or to object. Work built on GDPR assumptions can produce a programme that is thorough about things the Act does not ask for, and silent about things it does. A mapping is a starting point, not a finished answer, and the terminology mapping sets out exactly where it stops.
You will be toldAll personal data has to be kept inside India.
What is trueDPDP does not generally require all personal data to remain in India. The Central Government may restrict transfers to particular countries or territories by notification, and other laws or sector-specific requirements may impose their own conditions. Blanket localisation is a much larger and more expensive undertaking than the Act itself asks for, so it is worth establishing which requirement is actually driving it.
You will be toldBegin by rewriting your policies and notices.
What is trueA notice describes what you do with personal data. Writing one before you know what you hold, where it is and who it goes to produces a document that is accurate about intentions and wrong about facts. Documents are the output of understanding, not a substitute for it. This is the point the rest of this page keeps returning to.
You will be toldNothing is safe until a full programme has been completed.
What is trueThe first step is small, bounded and worth having on its own: knowing what personal data you hold, where it lives and who can reach it. That answer is useful whether or not anything else follows, and it is what every later decision depends on. An engagement that cannot be broken into stages with value at each one is a scoping choice, not a legal necessity.
You will be toldYour industry has its own DPDP framework that you must adopt.
What is trueDPDP is one Act and it applies across sectors. Your industry may well carry additional obligations from its own regulator, and those matter, but they sit alongside DPDP rather than replacing it with a separate version. Sector expertise is genuinely valuable for knowing how data actually moves in your business. It is not a different statute.
None of this assumes bad faith. Method names travel because they are useful, and a consultant describing a familiar approach is usually offering something real. The difficulty is only that a method and a requirement sound identical when the vocabulary is new. Knowing which is which does not mean refusing the advice. It means being able to ask why.
What follows is the Act in plain words: what each section establishes, and what it means for an organisation acting as a Data Fiduciary. It is a reference rather than a read.
All forty-four sections are listed. Where a section creates an obligation for an organisation, or has a direct practical or regulatory consequence for one, the third column says what that is. Where it does not — the constitution of the Board, its internal procedure, appeals, parliamentary process — the third column says so plainly rather than inventing a task to fill the space. The obligations that actually fall on an organisation are concentrated in sections 4 to 17.
This is a plain-English summary provided for general information. It does not constitute legal advice and is not a certification of compliance under the Digital Personal Data Protection Act, 2023. Organisations should seek professional guidance specific to their circumstances.
| Section | Simple meaning | What this means for your organisation |
|---|---|---|
| 1 – Short title & commencement | Establishes the Digital Personal Data Protection Act, 2023 and provides that different provisions may come into force on different dates. | Track the commencement status of the provisions relevant to your organisation and ensure implementation is aligned with the applicable effective dates. |
| 2 – Definitions | Defines important terms used throughout the Act, including Data Principal, Data Fiduciary, processing, personal data, consent and related concepts. | Use the statutory definitions consistently when designing policies, processes, contracts and systems. |
| 3 – Application of the Act | Specifies when the Act applies to the processing of digital personal data, including certain processing outside India in connection with offering goods or services to Data Principals in India. | Determine whether the organisation’s processing activities fall within the scope of the Act and identify the relevant processing activities covered. |
| 4 – Grounds for processing digital personal data | Digital personal data may be processed only for a lawful purpose, including processing based on consent or certain specified legitimate uses. | Identify the lawful basis for each applicable processing activity and ensure processing is not undertaken without an applicable ground under the Act. |
| 5 – Notice | A Data Fiduciary must give a clear notice describing the personal data being processed and the purpose for which it is processed. | Provide the required notice to Data Principals and ensure it contains the information required by the Act and applicable Rules. |
| 6 – Consent | Consent must be free, specific, informed, unconditional and unambiguous, and given through clear affirmative action. Consent must also be capable of being withdrawn. | Obtain and manage valid consent where consent is the applicable basis for processing, maintain appropriate records, and provide a withdrawal mechanism that is as easy as giving consent. |
| 7 – Certain legitimate uses | Specifies circumstances in which personal data may be processed without obtaining consent, such as certain legal, employment, medical, public-function and other specified situations. | Identify whether a processing activity falls within one of the specified legitimate uses and document the basis for relying on that provision. |
| 8 – General obligations of Data Fiduciary | Places core responsibilities on the Data Fiduciary, including responsibility for processing undertaken by it or on its behalf, reasonable security safeguards, breach notification, accuracy where required, erasure when required, and appropriate contractual controls with Data Processors. | Establish appropriate governance, security, data-quality, retention/erasure and processor-management controls, and maintain evidence that these controls are operating. |
| 9 – Processing of children’s personal data | Provides additional protections for processing children’s personal data, including requirements relating to verifiable parental consent and restrictions on certain processing activities. | Determine whether children’s personal data is processed and, where applicable, implement age-related controls, verifiable parental consent and the required restrictions. |
| 10 – Additional obligations of Significant Data Fiduciaries | Significant Data Fiduciaries are subject to additional obligations, including appointment of a Data Protection Officer, independent data auditor, periodic assessments and other prescribed measures. | If notified as a Significant Data Fiduciary, establish the additional governance, assessment, audit and compliance mechanisms required by the Act and Rules. |
| 11 – Right to access information about personal data | Gives a Data Principal the right to obtain information about personal data being processed and related information, subject to the Act. | Provide a mechanism to receive, authenticate, process and respond to valid access requests within the applicable requirements. |
| 12 – Right to correction and erasure of personal data | Gives Data Principals rights relating to correction, completion, updating and erasure of personal data, subject to applicable requirements and retention obligations. | Provide processes to receive and action correction, completion, updating and erasure requests, while retaining information where retention is legally required. |
| 13 – Right of grievance redressal | Gives Data Principals the right to raise grievances with the Data Fiduciary and provides for grievance redressal before approaching the Board. | Establish an accessible grievance mechanism, define responsibility and ensure grievances are handled within the applicable prescribed period. |
| 14 – Right to nominate | Allows a Data Principal to nominate another individual to exercise the rights of the Data Principal in specified circumstances. | Provide a mechanism through which Data Principals can make, manage and update a valid nomination. |
| 15 – Duties of Data Principals | Sets out responsibilities of Data Principals, including providing authentic information, not impersonating another person, not suppressing material information in specified cases, and not filing false or frivolous complaints. | Provide appropriate mechanisms for identity verification, request validation and handling of potentially fraudulent or abusive requests where necessary. |
| 16 – Processing outside India | Allows the Central Government to restrict the transfer of personal data by a Data Fiduciary to certain countries or territories outside India through notification. | Maintain visibility into relevant cross-border transfers and ensure processing and transfers comply with applicable government restrictions and requirements. |
| 17 – Exemptions | Provides exemptions from specified provisions of the Act in certain circumstances, including specified legal, judicial, regulatory, research and other situations. | Assess whether an exemption applies to a particular processing activity and document the basis for relying on the applicable exemption. |
| 18 – Establishment of Board | Establishes the Data Protection Board of India as the body that administers the Act. | Nothing directly. It is the body that would deal with a complaint or a data breach involving your organisation, so it is worth knowing who the regulator is. |
| 19 – Composition and qualifications for appointment of Chairperson and Members | Sets who may be appointed to the Board and what qualifications they must hold, including that at least one Member must be an expert in law. | Nothing. This concerns the constitution of the Board. |
| 20 – Salary, allowances payable to and term of office | Sets the terms of service of the Chairperson and Members, and a term of office of two years with eligibility for re-appointment. | Nothing. This concerns the Board's members. |
| 21 – Disqualifications for appointment and continuation as Chairperson and Members of Board | Sets the circumstances that disqualify a person from being appointed to, or continuing on, the Board. | Nothing. This concerns the Board's members. |
| 22 – Resignation by Members and filling of vacancy | Provides how a Member may resign and how the resulting vacancy is filled. | Nothing. This concerns the Board's members. |
| 23 – Proceedings of Board | Provides how the Board conducts its proceedings, including that a vacancy or defect in its constitution does not invalidate them. | Nothing. This concerns how the Board operates. |
| 24 – Officers and employees of Board | Allows the Board, with the approval of the Central Government, to appoint its own officers and employees. | Nothing. This concerns the Board's staffing. |
| 25 – Members and officers to be public servants | Treats the Board's Chairperson, Members, officers and employees as public servants when acting under the Act. | Nothing. It is a status provision about the Board's people. |
| 26 – Powers of Chairperson | Gives the Chairperson general superintendence over the Board and the conduct of its business. | Nothing. This concerns the Board's internal management. |
| 27 – Powers and functions of Board | Sets out what the Board may do: act on an intimation of a personal data breach, direct urgent remedial or mitigation measures, inquire into a breach or a complaint, and impose penalties as provided in the Act. | Nothing in advance, but this is the section under which action would be taken against your organisation. It is the source of the Board's authority to inquire into you. |
| 28 – Procedure to be followed by Board | Provides that the Board functions as an independent body and, as far as practicable, as a digital office, and sets out how it decides whether there are sufficient grounds to inquire and how an inquiry proceeds. | Nothing in advance. It governs how an inquiry would be conducted if one concerned you. |
| 29 – Appeal to Appellate Tribunal | Gives a person aggrieved by an order or direction of the Board a right of appeal to the Appellate Tribunal. | Nothing in advance. It is a right available to you, not a requirement on you. |
| 30 – Orders passed by Appellate Tribunal to be executable as decree | Makes an order of the Appellate Tribunal enforceable as if it were a decree of a civil court. | Nothing. It concerns how the Tribunal's own orders are enforced. |
| 31 – Alternate dispute resolution | Allows the Board to refer a complaint for mediation or other alternate dispute resolution where it considers a dispute is likely to be resolved that way. | Nothing in advance. It is a route the Board may offer. |
| 32 – Voluntary undertaking | Allows the Board to accept a voluntary undertaking from any person at any stage of a proceeding, which closes the proceedings on the matter it covers. Failing to keep to the undertaking is itself treated as a breach of the Act. | Nothing in advance. If you ever give one, keep to it — not doing so becomes a breach in its own right. |
| 33 – Penalties | Where the Board determines after inquiry that a breach is significant, it may impose the monetary penalty specified in the Schedule. Sub-section (2) sets out what the Board must weigh in fixing the amount: the nature, gravity and duration of the breach, the type of personal data affected, whether the breach was repetitive, any gain realised or loss avoided, and what was done to mitigate it. | Nothing separate from the obligations elsewhere in the Act. This is the consequence attached to failing them — and the factors in sub-section (2) are the reason evidence of prompt mitigation is worth keeping. |
| 34 – Crediting sums realised by way of penalties to Consolidated Fund of India | Provides that penalties collected under the Act go to the Consolidated Fund of India. | Nothing. It concerns where the money goes. |
| 35 – Protection of action taken in good faith | Protects the Central Government, the Board, and its Chairperson, Members, officers and employees from legal proceedings for anything done in good faith under the Act. | No direct operational obligation for an ordinary Data Fiduciary. This provision concerns legal protection for specified government and Board actions taken in good faith. |
| 36 – Power to call for information | Allows the Central Government to require the Board, or any Data Fiduciary or intermediary, to furnish such information as it may call for. | Be able to produce information when it is lawfully called for. That capability comes from the records you already keep under your obligations elsewhere in the Act; this section adds no separate record-keeping requirement of its own. |
| 37 – Power of Central Government to issue directions | Where the Board reports that a Data Fiduciary has been penalised in two or more instances and advises it in the interests of the general public, allows the Central Government to direct that access to information be blocked. | Nothing in advance. It is a consequence that follows repeated penalties, and any direction issued must be complied with. |
| 38 – Consistency with other laws | Provides that the Act is in addition to and not in derogation of other laws, and that where its provisions conflict with another law, this Act prevails to the extent of the conflict. | Where another law appears to require something different, establish which governs. This Act does not displace your other obligations; it sits alongside them and prevails only on a genuine conflict. |
| 39 – Bar of jurisdiction | Provides that no civil court may entertain a suit or proceeding on a matter the Board is empowered to determine, and that no injunction may be granted against action taken under the Act. | Nothing. It determines where a matter is heard, not what you must do. |
| 40 – Power to make rules | Empowers the Central Government to make rules for carrying out the provisions of the Act. The Digital Personal Data Protection Rules, 2025 were made under this section. | Nothing directly, but this is where your operational detail comes from. Watch for new or amended rules; see section 10 of this page for what the Rules currently ask. |
| 41 – Laying of rules and certain notifications | Requires rules made and certain notifications issued under the Act to be laid before both Houses of Parliament. | Nothing. It is a parliamentary procedure. |
| 42 – Power to amend Schedule | Allows the Central Government to amend the Schedule, which sets the penalty amounts, subject to the limit set in the Act. | Nothing directly. Penalty amounts can be changed by notification, so the figures in the Schedule are not fixed for all time. |
| 43 – Power to remove difficulties | Allows the Central Government, within three years of commencement, to make orders removing difficulties in giving effect to the Act. | Nothing. It is a transitional power. |
| 44 – Amendments to certain Acts | Amends other enactments, including the Telecom Regulatory Authority of India Act, 1997, the Information Technology Act, 2000 and the Right to Information Act, 2005 — the last of which replaces the exemption in section 8(1)(j) with one covering information which relates to personal information. | Nothing under this Act itself. If you rely on any of the amended provisions — the Right to Information exemption in particular — work from the amended text. |
Section 33(1) lets the Board impose “the monetary penalty specified in the Schedule”. This is that Schedule. Each row is a separate head, so a single incident can engage more than one of them: a personal data breach that was preventable and then went unreported engages rows 1 and 2, and each carries its own penalty.
These are maximums, not fixed amounts. What the Board may actually impose is governed by section 33(2), set out in the table above.
| Breach | Penalty |
|---|---|
| Failing to take reasonable security safeguards to prevent a personal data breach — section 8(5) | May extend to ₹250 crore |
| Failing to give the Board or the affected Data Principal notice of a personal data breach — section 8(6) | May extend to ₹200 crore |
| Failing the additional obligations in relation to children — section 9 | May extend to ₹200 crore |
| Failing the additional obligations of a Significant Data Fiduciary — section 10 | May extend to ₹150 crore |
| A Data Principal failing the duties placed on them — section 15 | May extend to ₹10,000 |
| Breaching a term of a voluntary undertaking accepted by the Board — section 32 | Up to the extent applicable for the breach in respect of which the section 28 proceedings were instituted |
| Breach of any other provision of the Act or the Rules | May extend to ₹50 crore |
The Act establishes the obligations. The Digital Personal Data Protection Rules, 2025 set out what satisfying them looks like in practice, and they are the more operational of the two. What follows covers only the Rules that create a requirement for an organisation acting as a Data Fiduciary.
| Rule | What it means for a Data Fiduciary | What this means for your organisation |
|---|---|---|
| Rule 1 – Short title and commencement | Establishes the DPDP Rules, 2025 and specifies when individual Rules become effective. Different requirements therefore become applicable at different stages. | Track the applicable commencement dates and ensure that controls and processes are implemented before the relevant requirements become applicable to your organisation. |
| Rule 2 – Definitions | Establishes additional terms used in the Rules, including user account, verifiable consent and techno-legal measures. | Understand and apply the defined terms when designing your privacy notices, consent mechanisms, rights processes, security controls and other DPDP processes. |
| Rule 3 – Notice given by Data Fiduciary to Data Principal | Your notice must be understandable on its own, use clear and plain language, identify the personal data being processed, state the specified purpose and describe the goods, services or uses enabled by the processing. It must also provide the means for withdrawing consent, exercising rights and making complaints. | Review and redesign privacy notices where necessary. Clearly identify the personal data collected and the purpose for which it is processed. Provide easily accessible mechanisms for consent withdrawal, exercise of rights and complaints. |
| Rule 6 – Reasonable security safeguards | You must protect personal data against personal data breaches using appropriate technical and organisational measures. The Rules specifically refer to measures such as encryption, masking, tokenisation, access controls, logging and monitoring, backups, contractual security provisions with Data Processors and organisational measures. | Implement and maintain appropriate security safeguards. Control access to personal data, monitor access, maintain logs, protect confidentiality/integrity/availability, maintain backups and ensure Data Processor contracts contain appropriate security requirements. |
| Rule 7 – Intimation of personal data breach | A Data Fiduciary must notify affected Data Principals without delay when a personal data breach occurs. The Data Fiduciary must also notify the Board without delay and provide detailed information within the prescribed period. | Establish a documented personal data breach response process. Detect and assess breaches, notify affected Data Principals without delay, notify the Board without delay, provide the required detailed information within the prescribed timeframe and maintain records of the incident and remediation. |
| Rule 8 – Specified period for erasure of personal data | Certain classes of Data Fiduciaries and specified purposes are subject to prescribed retention/erasure periods. The Rule also requires continued retention of specified personal data, traffic data and processing logs for at least one year for the purposes specified in the Seventh Schedule, unless another law requires longer retention. | Identify whether your organisation falls within the classes covered by the Rule. Establish retention and deletion schedules, implement automated or controlled deletion where appropriate, notify affected Data Principals before applicable deletion and ensure required logs/data are retained for the prescribed period. |
| Rule 9 – Contact information for questions about processing | You must prominently publish contact information for a person who can answer questions about the processing of personal data. Where applicable, this is the Data Protection Officer’s business contact information. | Publish appropriate contact information on your website or app and include it in communications relating to Data Principal rights. Ensure there is an actual person/function capable of responding to processing-related questions. |
| Rule 10 – Verifiable consent for processing personal data of children | Before processing a child’s personal data, you must obtain verifiable consent from the parent and exercise due diligence to verify that the person identifying themselves as the parent is an identifiable adult. | Determine whether children may use your services or whether you otherwise process children’s personal data. Implement appropriate age and parental verification mechanisms and obtain verifiable parental consent before processing where required. |
| Rule 11 – Verifiable consent for a person with disability having a lawful guardian | Where consent is obtained from a person identifying themselves as the lawful guardian of a person with disability, you must verify that the person is actually appointed as the lawful guardian under applicable law. | Where applicable, establish a process to verify the lawful guardian before relying on such consent. Maintain appropriate evidence of the verification. |
| Rule 12 – Exemptions relating to children’s personal data | Certain classes of Data Fiduciaries and certain specified purposes receive exemptions from some children’s-data requirements, subject to the conditions specified in the Fourth Schedule. | Determine whether any exemption applies to your organisation or processing activity. Do not assume that an exemption applies simply because children’s data is involved; satisfy the conditions attached to the applicable exemption. |
| Rule 13 – Additional obligations of Significant Data Fiduciary | If you are notified as a Significant Data Fiduciary, additional obligations apply. These include a Data Protection Impact Assessment and audit every twelve months, reporting significant observations to the Board, due diligence over technical measures including algorithmic software, and additional requirements concerning specified personal data and traffic data. | If notified as an SDF, establish the required DPIA and audit programme, complete them every twelve months, ensure reports are prepared and submitted as required, assess algorithmic and technical measures for risks to Data Principal rights, and comply with applicable data-transfer restrictions. |
| Rule 14 – Rights of Data Principals | You must provide Data Principals with clear means to exercise their rights. Your website or app must prominently identify how requests can be made and what identifiers may be required. You must also establish a grievance redressal system capable of responding within a reasonable period not exceeding ninety days. | Publish clear rights-request mechanisms. Define the information needed to identify the Data Principal. Establish processes for access, correction, erasure, grievance and other applicable rights requests, and ensure the grievance system can respond within the prescribed period. |
| Rule 15 – Transfer of personal data outside India | Personal data may be transferred outside India, subject to requirements that the Central Government may specify regarding making the data available to a foreign State or persons/entities controlled by or acting for such a State. | Identify relevant international transfers and maintain visibility over where personal data is transferred or made available. Ensure applicable government restrictions and requirements are incorporated into cross-border processing arrangements. |
| Rule 16 – Exemption for research, archiving or statistical purposes | Processing necessary for research, archiving or statistical purposes may receive an exemption where it is carried out in accordance with the standards specified in the Second Schedule. | If relying on this exemption, identify the applicable purpose, confirm that the processing meets the required standards and maintain evidence supporting the basis for the exemption. |
| Rule 22 – Appeal to Appellate Tribunal | If a Data Fiduciary is affected by an order or direction of the Board, the Rules provide the mechanism for filing an appeal before the Appellate Tribunal in digital form. | Nothing in advance. It is the route of appeal available to you if the Board makes an order against you, and it sets out how such an appeal is filed. |
| Rule 23 – Calling for information from Data Fiduciary or intermediary | The Central Government may require a Data Fiduciary to provide information for specified purposes under the Act. In certain circumstances, the Data Fiduciary may also be restricted from disclosing that such information has been requested. | Maintain accurate and accessible records and establish a process for responding to lawful information requests. Ensure that information requests subject to confidentiality restrictions are handled accordingly. |
The following Rules are deliberately absent. They govern the Data Protection Board, the Appellate Tribunal, processing by the State, or the registration of a Consent Manager — none of which creates an obligation for an ordinary Data Fiduciary. They are listed so you can see what was left out rather than wonder whether it was missed.
| Rule | Why it is not included |
|---|---|
| Rule 4 – Registration and obligations of Consent Manager | Applies to an entity operating as a Consent Manager, not to an ordinary Data Fiduciary merely because it uses or interacts with a Consent Manager. |
| Rule 5 – Processing by State and its instrumentalities | Primarily establishes standards for processing by the State and its instrumentalities in connection with subsidies, benefits, services, certificates, licences and permits. |
| Rule 17 – Appointment of Chairperson and Members | Concerns appointment of the Data Protection Board. |
| Rule 18 – Salary and service conditions of Board Members | Concerns the Data Protection Board. |
| Rule 19 – Procedure for Board meetings and authentication | Concerns how the Data Protection Board operates. |
| Rule 20 – Board functioning as a digital office | Concerns the functioning of the Data Protection Board. |
| Rule 21 – Officers and employees of the Board | Concerns staffing of the Data Protection Board. |