Ind Dpdpa Expert

India DPDPA Expert

Deep working knowledge of the Digital Personal Data Protection Act, 2023 (DPDPA) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules), as enforced by the Data Protection Board of India (DPB) under the Ministry of Electronics and Information Technology (MeitY).

This skill is engineering and assessment guidance for CISOs, DPOs, GRC engineers, and platform teams. It is not legal advice. Binding interpretations come from DPB orders, MeitY notifications, and the courts.

When to invoke this skill

Invoke when the user is:

• Mapping a system, product, or third-party vendor to DPDPA obligations
• Determining whether DPDPA applies (territorial, material, role)
• Assessing Significant Data Fiduciary (SDF) exposure
• Drafting or auditing privacy notices, consent flows, or rights-fulfilment workflows
• Building or stress-testing a personal-data-breach playbook (with DPDPA's 72-hour clock and the parallel sectoral clocks)
• Preparing for a DPB enquiry or compiling penalty-mitigation evidence
• Deciding cross-border transfer postures or evaluating a Consent Manager partner
• Comparing DPDPA to GDPR / Singapore PDPA / other regimes for a multi-jurisdictional product

Framework identity

The Act and the Rules must be read together. The Act sets substantive obligations; the Rules set the operational detail — timelines, formats, registration mechanisms, and procedures. Gaps in either side are gaps in compliance.

Roles and definitions

DPDPA does not define "sensitive personal data" as a separate category (unlike GDPR Article 9 or India's earlier SPDI Rules 2011). All personal data is governed by the same baseline obligations, with intensified obligations for children's data (Section 9) and SDF processing (Section 10).

Territorial and material applicability (Section 3)

DPDPA applies to processing of digital personal data:

1. Within India — processing of digital personal data, regardless of where the Data Fiduciary is established; and
2. Outside India — processing of digital personal data outside India, where the processing is in connection with offering goods or services to Data Principals located in India.

Personal data in non-digital form falls within scope only if digitised subsequently (Section 3(b)).

DPDPA does not apply to:

• Personal data processed by an individual for personal or domestic purposes.
• Personal data made publicly available by the Data Principal themselves, or by another person under a legal obligation.
• Specific exemptions notified under Section 17 — including processing necessary for research, archival, statistical purposes (subject to safeguards), processing by the State for sovereign functions, prevention/detection/investigation of offences, and certain other notified contexts.

When determining applicability, use /ind-dpdpa:scope — it walks the decision tree.

Data Fiduciary obligations (Section 8)

Every Data Fiduciary, whether SDF or not, owes the following baseline obligations:

"Reasonable security safeguards" is not a checklist in the Act. The DPDP Rules 2025 elaborate technical and organisational measures — encryption, access control, logging and monitoring, backup and recovery, incident response capability, periodic review. In practice, alignment with ISO 27001 / NIST CSF / SCF baseline plus the relevant sectoral overlay (e.g. RBI Cyber Security Framework for banks) is what regulators expect of mature Fiduciaries.

Notice, consent, legitimate uses (Sections 5 – 7)

Notice (Section 5)

Before processing, the Data Fiduciary gives the Principal a notice that:

• Describes the personal data and the purpose of processing.
• States the manner in which the Principal may exercise rights (Section 11–14).
• States the manner of making a complaint to the DPB.
• Is in English or any of the languages specified in the Eighth Schedule of the Constitution, at the option of the Principal.
• For consents already obtained before the Act, requires the Fiduciary to give the notice as soon as reasonably practicable.

Consent (Section 6)

Consent must be:

• Free — no coercion, no leverage of power asymmetry.
• Specific — limited to the purpose described in the notice.
• Informed — preceded by the Section 5 notice.
• Unconditional — not bundled with services where the data is not necessary for the service.
• Unambiguous, with clear affirmative action — opt-in. Pre-ticked boxes, default-on toggles, and inferred consent do not satisfy.
• Withdrawable — with the same ease as it was given. On withdrawal, processing for the purpose ceases, and the Fiduciary causes its Processors to cease likewise (Section 6(6)).

The validity of consent does not depend on the Fiduciary's business model — bundling unrelated processing into the consent flow invalidates the consent for those unrelated purposes.

Legitimate uses (Section 7)

Section 7 enumerates uses for which consent is not required. These are narrow and exhaustive — they do not create general "legitimate interest" latitude as GDPR does. The categories include:

• Where the Principal has voluntarily provided personal data and has not indicated objection to its use for a specified purpose.
• Performance of any function of the State authorised by law (subject to conditions).
• Compliance with any judgment, decree, or order of a court / tribunal.
• Responding to a medical emergency involving threat to life or immediate threat to the health of the Principal or any other person.
• Taking measures to provide medical treatment or health services during an epidemic, outbreak, or threat to public health.
• Disaster response and ensuring safety / providing assistance during disaster, breakdown of public order.
• Employment-related purposes, including prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property, classified information, services / benefits sought by employee, verifications.

When relying on Section 7 instead of consent, the burden is on the Fiduciary to fit the processing strictly within the named legitimate use. Drift outside the named purpose collapses the lawful basis.

Data Principal rights (Sections 11 – 14)

The Fiduciary must respond within timelines prescribed under the DPDP Rules 2025. Free of charge for first request; reasonable fees may apply for repeated, manifestly unfounded, or excessive requests.

The right to erasure is qualified — retention required by law (e.g. tax records, audit trails, KYC records under PMLA / RBI rules) overrides the request. The Fiduciary should document the retention basis when refusing erasure.

DPDPA does not include a portability right (unlike GDPR Article 20) or an explicit right to object to automated decision-making (unlike GDPR Article 22). However, the obligation to respond to grievances and the Section 11 access right indirectly cover much of the same territory.

Children's data (Section 9)

For Data Principals who are children (under 18, per DPDPA's reading) or persons with disability who have a lawful guardian:

• Processing requires verifiable parental consent / guardian consent.
• The Fiduciary must not undertake any tracking or behavioural monitoring of children.
• The Fiduciary must not target advertising directed at children.
• These prohibitions apply to all Fiduciaries — not just SDFs. Penalty exposure is up to ₹200 crore for failure to fulfil obligations relating to children.

The Central Government may exempt classes of Fiduciary or notify a lower threshold age for specific purposes (e.g. educational platforms, health services). Until exempted, the default 18-year threshold applies.

"Verifiable parental consent" is not yet operationally specified by the Rules in granular detail. In practice, Fiduciaries rely on a combination of: (a) credit-card or banking-instrument transaction by an adult, (b) Aadhaar-based parent verification (where applicable and lawful), (c) signed declaration with identification, (d) Consent Manager flow where the Consent Manager performs the parent verification.

Significant Data Fiduciary regime (Section 10)

The Central Government may notify any Data Fiduciary or class as an SDF, considering:

• Volume and sensitivity of personal data processed.
• Risk to the rights of Data Principals.
• Potential impact on the sovereignty and integrity of India.
• Risk to electoral democracy.
• Security of the State.
• Public order.

An SDF has the baseline obligations plus the following:

SDF designation is by notification and not automatic. However, prudent organisations that exceed implicit volume thresholds (typically very large consumer platforms, financial sector players with national reach, telecom / digital infrastructure providers) prepare for SDF posture in advance — designation can come at short notice.

Penalty exposure for SDF-specific failures: up to ₹150 crore.

Cross-border transfers (Section 16)

DPDPA's cross-border posture is the inverse of GDPR:

• The default is permissive: a Data Fiduciary may transfer personal data outside India.
• The Central Government may, by notification, restrict transfer to specified territories. Until a territory is notified as restricted, transfer is allowed.

Important interactions:

• Section 16 does not displace sectoral data localisation rules. Where RBI Master Directions require payment-system data to be stored only in India, that requirement applies independent of DPDPA. Same for SEBI's CSCRF storage requirements, IRDAI guidance on insurance data, and any sector-specific localisation directive.
• The list of restricted territories is published by the Central Government and changes over time. This plugin does not vendor the list; query the latest gazette notification at posture-determination time.
• Cross-border processing also remains subject to the underlying lawfulness — purpose, consent, security — at every step.

The practical posture for most Data Fiduciaries today is: transfer is allowed; the friction is sectoral localisation rules and contractual obligations to data principals (e.g. retention, deletion-on-withdrawal cascading across sub-processors).

Personal data breach response (Section 8(6) + DPDP Rules 2025 R7)

A personal data breach under DPDPA is broader than a security incident — any compromise of confidentiality, integrity, or availability of personal data, including accidental disclosure, loss of access, or unauthorised processing.

The Section 8(6) obligation requires the Fiduciary to give intimation of such breach to:

1. The Data Protection Board of India, and
2. Each affected Data Principal.

The DPDP Rules 2025 prescribe the timeline (72 hours from awareness, with extensions on application showing reasonable cause) and the form/content of the notification.

Notification content (Rules 2025-aligned baseline):

• Description of the breach — nature, timing, geographical extent.
• Categories and approximate number of Principals affected.
• Categories and approximate volume of personal data records affected.
• Likely consequences for affected Principals.
• Measures taken or proposed to mitigate adverse effects.
• Contact point for follow-up.

Sectoral parallel clocks — these run in addition to, not in place of, the DPDPA clock:

The first thing the breach playbook does is identify which clocks are running. A bank suffering a ransomware incident affecting customer data has at least three clocks: CERT-In 6-hour, RBI 6-hour, DPDPA 72-hour. Missing the fastest clock is the typical failure mode.

Penalty exposure for failure to notify: up to ₹50 crore for the notification failure itself; the underlying security failure continues to expose up to ₹250 crore separately.

Consent Manager

A Consent Manager is a Board-registered entity that:

• Is accountable to the Data Principal (not to the Fiduciary).
• Provides Principals an interoperable platform to give, manage, review, and withdraw consents across multiple Fiduciaries.
• Is registered with the DPB under conditions prescribed in the DPDP Rules 2025.
• Cannot itself process the personal data for any purpose other than consent management.

Consent Managers are still emerging as of 2026; their role is critical for high-volume sectors where Principals deal with many Fiduciaries (financial services, healthcare). Account Aggregators in the financial sector are an early Consent Manager analogue regulated by RBI.

For a Fiduciary that integrates a Consent Manager:

• Consent provenance (who, when, what scope, what version of notice) flows from the Consent Manager into the Fiduciary's system.
• Withdrawal events flow back from the Consent Manager and trigger deletion / processing-cessation cascade.
• Record-keeping obligations remain with the Fiduciary; the Consent Manager's records are corroborative, not substitutive.

Sectoral overlay

DPDPA does not displace sectoral data and security rules. They stack. A Fiduciary that is also a regulated entity must comply with both — and the stricter or earlier-deadline rule binds.

When assessing a regulated Fiduciary, build a regulator matrix first. For each obligation theme (notice, consent, retention, breach, cross-border, audit), record (a) DPDPA position, (b) sectoral position, (c) which is stricter, (d) which clock starts first. The strictest binding rule is the operating obligation.

GDPR comparison (most-asked)

Most multi-jurisdictional product programs converge on the stricter of GDPR and DPDPA per theme as the operating posture, except for cross-border (where the regimes don't overlap — both must be satisfied independently for the relevant data flows).

Common implementation pitfalls

1. Treating Rules 2025 as advisory. The Rules give the Act its operational teeth (timelines, formats, registration). Compliance posture without reference to the Rules is incomplete.
2. Confusing notice with consent. A privacy policy posted on a website is not consent. Consent requires a clear affirmative action by the Principal, post-notice.
3. Bundling unrelated processing into one consent. Section 6 invalidates consent for any processing beyond what is necessary for the service the Principal sought. Granular per-purpose consent is the safe posture.
4. Missing the withdrawal cascade. When consent is withdrawn, processing must cease and Processors must be caused to cease. Many implementations stop at the Fiduciary's own systems and forget the sub-processor / vendor chain.
5. Applying GDPR's "legitimate interest" framing to DPDPA. DPDPA has no equivalent. Section 7 legitimate uses are exhaustive.
6. Children-by-default missing. Sites that don't ask age, or ask but don't enforce verifiable parental consent on positive-age signals, fail Section 9.
7. Breach clock collision. Running only DPDPA's 72-hour clock and missing the parallel CERT-In / RBI / SEBI 6-hour clocks. This is the single most common breach-response failure for regulated Fiduciaries.
8. Cross-border misreading. Assuming Section 16 has a GDPR-style restrictive default; or assuming sectoral localisation rules disappear under DPDPA. Both are wrong.
9. SDF posture only after notification. SDF designation can come fast; preparing only after notification leaves a 90-day scramble.
10. Vendor compliance gaps. Processors operating without DPDPA-aligned contracts. The Fiduciary remains accountable.
11. Consent vintage. Treating pre-Act consents as automatically valid under DPDPA. Section 5(2) requires fresh notice, and consents must satisfy Section 6 going forward.

Evidence patterns by obligation

For each Section 8 obligation theme, the typical evidence the DPB or an independent auditor will expect:

The /ind-dpdpa:evidence-checklist command renders the live checklist with collection guidance per evidence type.

DPDP Rules 2025 — operational themes

The Rules notified in November 2025 give DPDPA its day-to-day shape. Headline themes:

When a precise Rule number is needed for an assessment artefact, read the gazette notification of the DPDP Rules 2025 directly — that is the authoritative numbering.

Penalty exposure (Schedule)

Penalties are imposed by the DPB after inquiry. Bands (per breach class):

• Up to ₹250 crore — failure to take reasonable security safeguards (Section 8(5)) leading to a personal data breach
• Up to ₹200 crore — failure to fulfil obligations relating to children (Section 9)
• Up to ₹150 crore — failure to fulfil additional obligations of an SDF (Section 10)
• Up to ₹50 crore — failure to inform the Board / affected Principal of a breach (Section 8(6))
• Up to ₹10,000 — failure of a Data Principal to comply with Section 15 duties (this is a Principal-side penalty under the Schedule, distinct from the crore-scale Fiduciary penalties above)

The DPB considers nature, gravity, duration, type and nature of personal data, repetitive conduct, mitigation, and benefit gained / loss avoided in determining the actual penalty. Recidivism is treated as an aggravating factor.

Implementation roadmap (mature programme)

For a Fiduciary starting an end-to-end DPDPA programme:

Day 0 — Determine

• Run /ind-dpdpa:scope for territorial / material applicability and role assignment.
• Build the regulator matrix (DPDPA + sectoral overlays).
• Inventory in-scope systems and data flows. Identify Processors.

Phase 1 — Foundations (0–90 days)

• Notice templates per language, per processing activity. Versioned.
• Consent capture redesign: opt-in, granular, withdrawable, recorded.
• Rights workflow: intake, triage, response SLAs, refusal logging.
• Breach playbook: parallel-clock matrix, notification templates (DPB + Principals), tabletop drill.
• Vendor / processor contract uplift: DPDPA addendum, security safeguards, breach-cooperation, deletion cascade.

Phase 2 — SDF preparation (where applicable, 90–180 days)

• DPO appointment (India-resident, accountable to Board).
• DPIA framework: trigger criteria, methodology, register.
• Independent auditor selection and first audit.
• Algorithmic risk inventory for model-driven decisions affecting Principals.

Phase 3 — Continuous compliance (180+ days)

• Evidence automation: consent receipts, deletion jobs, audit logs flow into the GRC platform automatically.
• Quarterly internal reviews; annual independent review.
• Regulator matrix maintenance: sectoral rule changes, restricted-territory list checks.
• DPB filing register (any inquiry, notice, or order).
• Lessons-learned from sector incidents fed back into the breach playbook.

Plugin commands

When the user invokes any of these, this skill provides the framework knowledge:

• /ind-dpdpa:scope — applicability and SDF-trigger walkthrough
• /ind-dpdpa:assess — gap assessment via SCF crosswalk
• /ind-dpdpa:evidence-checklist — evidence-by-theme list
• /ind-dpdpa:breach-process — 72-hour timeline and parallel sectoral clocks

Caveats

• This skill paraphrases statutory obligations; the gazette text of the Act and Rules is authoritative.
• Rule numbering for the DPDP Rules 2025 referenced here is illustrative — confirm specific rule numbers against the gazette notification when authoring compliance artefacts.
• Sectoral references (RBI, SEBI, IRDAI, TRAI, NHA, CERT-In) are provided so the engineering posture accounts for parallel obligations; the authoritative source for each is the regulator's own circulars and directions, not this skill.
• Penalty bands are from the Schedule attached to the Act. Actual penalty in any matter is determined by the DPB on the merits.
• This is engineering and assessment guidance, not legal advice. Confirm postures with qualified counsel before treating any output as compliant.