DPDP Intelligence
Practical guidance for compliance teams navigating India's DPDP Act 2023. Every article is structured for implementation, not comprehension theatre.
MeitY proposed in January 2026 to compress the Significant Data Fiduciary compliance window from 18 months to 12 months. If gazetted, large-volume data processors face a November 2026 deadline, not May 2027. Here is what SDF status means and how to know if it applies to your organisation.
How the DPDP Act 2023 interacts with RBI's KYC retention mandates, PMLA transaction record obligations, CIBIL consent requirements, and FIU-IND reporting for Non-Banking Financial Companies.
RBI mandates 10-year KYC retention. The DPDP Act requires erasure on request. For Indian fintechs and NBFCs, these obligations are in direct conflict. This article explains the Legal Obligation Override framework that resolves both simultaneously.
Step-by-step guide to auditing and documenting personal data flows for India's DPDP Act. The data inventory is the foundation of every DPDP compliance programme.
A practical guide to DPDP Act 2023 penalty tiers, how penalties are calculated, and how to use risk assessment to quantify your organisation's exposure.
How the DPDP Act 2023 affects e-commerce operations in India, from cookie consent and marketing communications to cross-border data transfers and customer rights.
How the DPDP Act 2023 intersects with RBI data localisation mandates, payment data protection, and consent requirements for fintech companies operating in India.
How the DPDP Act 2023 applies to health data processing, ABDM interoperability, telemedicine platforms, and clinical trial consent requirements in India.
How India's Digital Personal Data Protection Act 2023 supersedes the IT Act 2000 Section 43A and the SPDI Rules 2011. A regulatory comparison for compliance officers and business leaders.
DPDP Act requires privacy notices in any 8th Schedule language upon request. Mandatory disclosures, plain language rules, and a compliant privacy notice template.
The DPDP Act 2023 makes consent the legal foundation for data processing. This is what valid consent requires, how withdrawal works, and what your systems must support.
India's DPDP Act grants 8 enforceable rights to data principals — access, correction, erasure, nomination, grievance redress. Includes mandatory response timelines.
If your business determines the purpose of processing personal data, you are a Data Fiduciary. The DPDP Act imposes seven categories of obligation. This is what compliance requires.
The Digital Personal Data Protection Act 2023 decoded. What it requires, who it applies to, and what happens if you ignore it.
India's DPDP Act mandates breach notification to the Data Protection Board within 72 hours and to affected individuals promptly. Delayed reporting carries independent penalties.
A structured checklist covering every obligation under the DPDP Act 2023. Use this to audit your current compliance posture and prioritise remediation.
The DPDP Act imposes strict requirements for processing children's personal data. Verifiable parental consent, advertising restrictions, and tracking prohibitions apply to every business serving minors.
A breakdown of every penalty provision in the DPDP Act 2023. Understand the financial exposure, the enforcement mechanism, and what triggers each penalty tier.
India's DPDP Act 2023 introduces Consent Managers as registered intermediaries managing consent across businesses. Registration deadline: November 2026. Requirements explained.
India's DPDP Act mandates 30 days to respond to data principal requests and 72 hours for breach notification. Complete DPDP deadline calendar with enforcement dates.
Both laws protect personal data. They differ in scope, consent models, penalty structures, and cross-border transfer rules. This is what multinational companies operating in India need to know.
The Central Government can designate certain businesses as Significant Data Fiduciaries, triggering additional obligations including DPO appointment, impact assessments, and independent audits.
Structured approach to building a data protection program that meets India's DPDP Act 2023 requirements. From gap assessment through operational compliance in 90 days.