DPDP Intelligence
Practical guidance for compliance teams navigating India's DPDP Act 2023. Every article is structured for implementation, not comprehension theatre.
The NHA Health Data Management Policy mandates 8-year patient record retention. The DPDP Act grants erasure rights. How hospitals resolve the conflict, fix admission consent, and govern ABDM data.
Bundled consent, a single accept-all checkbox covering every purpose, fails Section 6 of the DPDP Act 2023. This is why it is non-compliant, what counts as a dark pattern, and how to redesign the flow into purpose-separated consent.
Eight DPDP compliance platforms compared by buyer type: Privy, Consentin, Perfios, CookieYes, KavachOne, Complynz, OneTrust, ConsentOS. Pick by obligation, not by feature list.
RBI requires 5-year KYC retention. The DPDP Act grants erasure rights. Section 8(7) decides which wins. How banks resolve the conflict field by field.
The RBI Business Conduct Directions on consent are final and effective July 1, 2026. What banks and NBFCs must have in place, alongside Advisory 3/2026.
Most SaaS companies are both: Data Fiduciary for their own customer data, Data Processor for client data. What each role demands under the DPDP Act 2023.
MeitY proposed in January 2026 to compress the Significant Data Fiduciary compliance window from 18 months to 12 months. If gazetted, large-volume data processors face a November 2026 deadline, not May 2027. Here is what SDF status means and how to know if it applies to your organisation.
How NBFCs reconcile DPDP Act 2023 with RBI KYC retention, PMLA record-keeping, CIBIL consent and FIU-IND reporting. Legal Obligation Override explained.
The RBI and PMLA mandate five-year KYC retention. The DPDP Act requires erasure on request. For Indian fintechs and NBFCs, these obligations are in direct conflict. This article explains the Legal Obligation Override framework that resolves both simultaneously.
Step-by-step guide to auditing and documenting personal data flows for India's DPDP Act. The data inventory is the foundation of every DPDP compliance programme.
How the DPDP Act 2023 applies to health data processing, ABDM interoperability, telemedicine platforms, and clinical trial consent requirements in India.
How the DPDP Act 2023 affects e-commerce operations in India, from cookie consent and marketing communications to cross-border data transfers and customer rights.
How a fintech complies with the DPDP Act 2023: data inventory across payment flows, purpose-specific consent, security safeguards, and breach readiness, alongside RBI data localisation mandates.
A practical guide to DPDP Act 2023 penalty tiers, how penalties are calculated, and how to use risk assessment to quantify your organisation's exposure.
Yes. The DPDP Act 2023 omits IT Act 2000 Section 43A and supersedes the SPDI Rules 2011. What changes for your consent, penalties, and obligations.
A DPDP Act 2023 privacy notice in all 22 Eighth Schedule languages: required disclosures, purpose, rights, grievance contact. Compliant template included.
The 8 rights customers can enforce under the DPDP Act 2023: access, correction, erasure, grievance, nominee. Response deadlines and templates included.
The DPDP Act 2023 makes consent the legal foundation for data processing. This is what valid consent requires, how withdrawal works, and what your systems must support.
If your business determines the purpose of processing personal data, you are a Data Fiduciary. The DPDP Act imposes seven categories of obligation. This is what compliance requires.
India's Digital Personal Data Protection Act 2023 decoded: 7 obligations for every Data Fiduciary, 8 rights for Data Principals, penalties up to ₹250 crore.
DPDP Act breach reporting: notify the Data Protection Board within 72 hours and CERT-In within 6 hours. Two-stage filing, penalties up to ₹200 crore.
Audit your DPDP Act 2023 posture against 43 controls, then sequence remediation across five months to the November 2026 Consent Manager deadline.
The DPDP Act imposes strict requirements for processing children's personal data. Verifiable parental consent, advertising restrictions, and tracking prohibitions apply to every business serving minors.
A breakdown of every penalty provision in the DPDP Act 2023. Understand the financial exposure, the enforcement mechanism, and what triggers each penalty tier.
Who must register as a Consent Manager under the DPDP Act? Complete guide to the November 2026 deadline, Rs 2 Cr net worth requirement, DPB registration process, and how Consent Managers differ from consent management platforms.
Every DPDP Act date: Rules notified Nov 2025, Consent Manager registration Nov 2026, penalty enforcement May 2027. Plan your compliance timeline.
Both laws protect personal data. They differ in scope, consent models, penalty structures, and cross-border transfer rules. This is what multinational companies operating in India need to know.
SDF designation under Section 10 of the DPDP Act triggers a DPO in India, data protection impact assessments, and independent audits. Who qualifies and how to prepare.
Structured approach to building a data protection program that meets India's DPDP Act 2023 requirements. From gap assessment through operational compliance in 90 days.