DPDP Intelligence
Practical guidance for compliance teams working under India's DPDP Act 2023. Every article is structured for implementation.
Free DPDP Tools
Score your position across five compliance areas and receive a PDF report in minutes.
Open toolWork through 26 controls mapped to the DPDP Act, tracked in your browser.
Open toolModel your exposure across the stacking DPDP penalty tiers.
Open toolEnforcement milestones, rule notifications, and deadline analysis.
One email when it matters, no more.
The Cabinet Secretary's 20 August 2026 letter orders ministries and states to build time-bound DPDP plans, data inventories and processor contract reviews.
ConsentOS reviewed the public privacy policies of 49 RBI-regulated lenders in August 2026. 8 state a retention schedule per data category. 12 acknowledge the RBI/DPDP dual mandate. 19 name a grievance officer. 4 do all three. The full methodology and counts are published here.
Scraping profiles, contact lists and post data from social platforms is standard practice in marketing and sales. The DPDP Act's publicly available data exclusion is narrower than most teams assume. Here is where the line actually sits.
On 4 August 2026, the keyv and cacheable npm packages were compromised in a credential-stealing worm. For Indian data fiduciaries, a compromised dependency is a Section 8(5) breach vector. Here is what happened and what to do.
A Data Fiduciary determines purpose and means; a Data Processor acts on its behalf. Definitions, obligations, liability, DPA clauses, and a classification test.
Section 16 permits transfers outside India by default, subject to country restrictions by notification. Rule 15, sectoral overlays, and six compliance steps.
Section 8(10) requires a grievance mechanism, Section 13 makes it the mandatory first stop, and Rule 14 caps response at 90 days. What to build, step by step.
What a DPDP notice must contain under Section 5 and Rule 3: itemised data, specific purposes, rights links, and the retrospective notice owed to existing users.
KYC records are retained five years after the relationship ends under the RBI KYC Direction and PMLA Rules. The retention matrix and where DPDP erasure fits.
RBI's draft data governance guidance mandates a board-level committee, data tagging, and quarterly reporting for banks and NBFCs. Comments due August 17, 2026.
A Consent Manager is a registered legal entity. A consent management platform is software. The DPDP Act treats them differently, and so should your budget.
The DPDP Rules 2025 were notified on 13 November 2025. What is in force now, what starts in November 2026, and what takes effect on 13 May 2027. Status as of September 2026.
The path a DPDP complaint follows: grievance to the Data Fiduciary first, then escalation to the Data Protection Board of India, plus the ninety-day response rule.
What DPDP Act 2023 compliance actually costs an Indian business in 2026, by company size: software, implementation, audit, DPO, and ongoing operations.
Consent Manager registration under Rule 4 of the DPDP Rules 2025: eligibility, the Rs 2 crore net worth gate, documents, and the application steps.
Medical record rules set retention periods for specific classes of patient record. The DPDP Act grants erasure rights. How hospitals decide each request, fix admission consent, and govern ABDM data.
Bundled consent, a single accept-all checkbox covering every purpose, fails Section 6 of the DPDP Act 2023. This is why it is non-compliant, what counts as a dark pattern, and how to redesign the flow into purpose-separated consent.
Twenty DPDP compliance platforms compared by buyer type, each stated from the vendor's own pages: Privy, Consentin, Perfios, DPDP Guard, ConsentOS.
RBI requires 5-year KYC retention. The DPDP Act grants erasure rights. Section 8(7) decides which wins. How banks resolve the conflict field by field.
The RBI Business Conduct Second Amendment Directions on consent take effect 1 January 2027. What banks and NBFCs must have in place by then, alongside Advisory 3/2026.
Most SaaS companies are both: Data Fiduciary for their own customer data, Data Processor for client data. What each role demands under the DPDP Act 2023.
MeitY proposed in January 2026 to cut the SDF compliance window from 18 to 12 months. If gazetted, large-volume processors face November 2026, not May 2027.
How NBFCs reconcile DPDP Act 2023 with RBI KYC retention, PMLA record-keeping, CIBIL consent and FIU-IND reporting. Legal Obligation Override explained.
The RBI and PMLA mandate five-year KYC retention. The DPDP Act requires erasure on request. For Indian fintechs and NBFCs, these obligations are in direct conflict. This article explains the Legal Obligation Override framework that supports resolution of both simultaneously.
Step-by-step guide to auditing and documenting personal data flows for India's DPDP Act. The data inventory is the foundation of every DPDP compliance programme.
How the DPDP Act 2023 affects e-commerce operations in India, from cookie consent and marketing communications to cross-border data transfers and customer rights.
How a fintech complies with the DPDP Act 2023: data inventory across payment flows, purpose-specific consent, security safeguards, and breach readiness, alongside RBI data localisation mandates.
How the DPDP Act 2023 applies to health data processing, ABDM interoperability, telemedicine platforms, and clinical trial consent requirements in India.
A practical guide to DPDP Act 2023 penalty tiers, how penalties are calculated, and how to use risk assessment to quantify your organisation's exposure.
From 13 May 2027 the DPDP Act 2023 omits IT Act 2000 Section 43A and supersedes the SPDI Rules 2011. What changes for your consent, penalties, and obligations.
A DPDP Act 2023 privacy notice in all 22 Eighth Schedule languages: required disclosures, purpose, rights, grievance contact. Compliant template included.
The DPDP Act 2023 makes consent the legal foundation for data processing. This is what valid consent requires, how withdrawal works, and what your systems must support.
Access, correction, erasure, grievance, and nominee rights under the DPDP Act 2023: the response deadlines a Data Fiduciary must meet, with ready-to-use request templates.
The DPDP Act imposes 7 obligations on every Data Fiduciary, with penalties reaching ₹250 crore at the top tier. What each obligation requires, section by section.
India's Digital Personal Data Protection Act 2023 decoded: 7 obligations for every Data Fiduciary, the Data Principal rights, penalties up to ₹250 crore.
Miss the 72-hour window and the exposure is ₹200 crore under Section 8(6). The Board deadline, the 6-hour CERT-In rule, and the reporting steps, mapped.
Audit your DPDP Act 2023 posture against 43 controls, then sequence remediation toward the 13 November 2026 and 13 May 2027 commencement dates.
Up to ₹200 crore. Section 9 of the DPDP Act bans tracking, behavioural profiling, and targeted ads aimed at under-18s, even with parental consent, and requires verifiable parental consent before any processing begins.
A breakdown of every penalty provision in the DPDP Act 2023. Understand the financial exposure, the enforcement mechanism, and what triggers each penalty tier.
Most companies do not need to register. Who does, what changes on 13 November 2026, the Rs 2 crore net worth test, and what Sections 6(7) to 6(9) require.
Every DPDP Act date: Rules notified Nov 2025, Consent Manager registration Nov 2026, obligations and penalties from 13 May 2027. Plan your compliance timeline.
Both laws protect personal data. They differ in scope, consent models, penalty structures, and cross-border transfer rules. This is what multinational companies operating in India need to know.
SDF designation under Section 10 of the DPDP Act triggers a DPO in India, data protection impact assessments, and independent audits. Who qualifies and how to prepare.
Structured approach to building a data protection program that meets India's DPDP Act 2023 requirements. From gap assessment through operational compliance in 90 days.