DPDP Intelligence
Practical guidance for compliance teams navigating India's DPDP Act 2023. Every article is structured for implementation, not comprehension theatre.
Free DPDP Tools
Score your position across five compliance areas and receive a PDF report in minutes.
Open toolWork through 26 controls mapped to the DPDP Act, tracked in your browser.
Open toolModel your exposure across the stacking DPDP penalty tiers.
Open toolEnforcement milestones, rule notifications, and deadline analysis.
One email when it matters, no more.
ConsentOS reviewed the public privacy policies of 49 RBI-regulated lenders in August 2026. 8 state a retention schedule per data category. 12 acknowledge the RBI/DPDP dual mandate. 19 name a grievance officer. 4 do all three. The full methodology and counts are published here.
Scraping profiles, contact lists and post data from social platforms is standard practice in marketing and sales. The DPDP Act's publicly available data exclusion is narrower than most teams assume. Here is where the line actually sits.
On 4 August 2026, the keyv and cacheable npm packages were compromised in a credential-stealing worm. For Indian data fiduciaries, a compromised dependency is a Section 8(5) breach vector. Here is what happened and what to do.
A Data Fiduciary determines purpose and means; a Data Processor acts on its behalf. Definitions, obligations, liability, DPA clauses, and a classification test.
Section 16 permits transfers outside India by default, subject to country restrictions by notification. Rule 15, sectoral overlays, and six compliance steps.
Section 8(10) requires a grievance mechanism, Section 13 makes it the mandatory first stop, and Rule 14 caps response at 90 days. What to build, step by step.
What a DPDP notice must contain under Section 5 and Rule 3: itemised data, specific purposes, rights links, and the retrospective notice owed to existing users.
KYC records are retained five years after the relationship ends under the RBI KYC Direction and PMLA Rules. The retention matrix and where DPDP erasure fits.
RBI's draft data governance guidance mandates a board-level committee, data tagging, and quarterly reporting for banks and NBFCs. Comments due August 17, 2026.
A Consent Manager is a registered legal entity. A consent management platform is software. The DPDP Act treats them differently, and so should your budget.
The DPDP Rules 2025 were notified on 13 November 2025. What is in force now, what starts in November 2026, and what waits for May 2027. Status as of July 2026.
The path a DPDP complaint follows: grievance to the Data Fiduciary first, then escalation to the Data Protection Board of India, plus the ninety-day response rule.
What DPDP Act 2023 compliance actually costs an Indian business in 2026, by company size: software, implementation, audit, DPO, and ongoing operations.
Consent Manager registration under Rule 4 of the DPDP Rules 2025: eligibility, the Rs 2 crore net worth gate, documents, and the application steps.
The NHA Health Data Management Policy mandates 8-year patient record retention. The DPDP Act grants erasure rights. How hospitals resolve the conflict, fix admission consent, and govern ABDM data.
Bundled consent, a single accept-all checkbox covering every purpose, fails Section 6 of the DPDP Act 2023. This is why it is non-compliant, what counts as a dark pattern, and how to redesign the flow into purpose-separated consent.
Eight DPDP compliance platforms compared by buyer type: Privy, Consentin, Perfios, CookieYes, KavachOne, Complynz, OneTrust, ConsentOS. Pick by obligation, not by feature list.
RBI requires 5-year KYC retention. The DPDP Act grants erasure rights. Section 8(7) decides which wins. How banks resolve the conflict field by field.
The RBI Business Conduct Directions on consent took effect July 1, 2026. What banks and NBFCs must already have in place, alongside Advisory 3/2026.
Most SaaS companies are both: Data Fiduciary for their own customer data, Data Processor for client data. What each role demands under the DPDP Act 2023.
MeitY proposed in January 2026 to compress the Significant Data Fiduciary compliance window from 18 months to 12 months. If gazetted, large-volume data processors face a November 2026 deadline, not May 2027. Here is what SDF status means and how to know if it applies to your organisation.
How NBFCs reconcile DPDP Act 2023 with RBI KYC retention, PMLA record-keeping, CIBIL consent and FIU-IND reporting. Legal Obligation Override explained.
The RBI and PMLA mandate five-year KYC retention. The DPDP Act requires erasure on request. For Indian fintechs and NBFCs, these obligations are in direct conflict. This article explains the Legal Obligation Override framework that supports resolution of both simultaneously.
Step-by-step guide to auditing and documenting personal data flows for India's DPDP Act. The data inventory is the foundation of every DPDP compliance programme.
How the DPDP Act 2023 affects e-commerce operations in India, from cookie consent and marketing communications to cross-border data transfers and customer rights.
How a fintech complies with the DPDP Act 2023: data inventory across payment flows, purpose-specific consent, security safeguards, and breach readiness, alongside RBI data localisation mandates.
How the DPDP Act 2023 applies to health data processing, ABDM interoperability, telemedicine platforms, and clinical trial consent requirements in India.
A practical guide to DPDP Act 2023 penalty tiers, how penalties are calculated, and how to use risk assessment to quantify your organisation's exposure.
Yes. The DPDP Act 2023 omits IT Act 2000 Section 43A and supersedes the SPDI Rules 2011. What changes for your consent, penalties, and obligations.
A DPDP Act 2023 privacy notice in all 22 Eighth Schedule languages: required disclosures, purpose, rights, grievance contact. Compliant template included.
The DPDP Act 2023 makes consent the legal foundation for data processing. This is what valid consent requires, how withdrawal works, and what your systems must support.
Access, correction, erasure, grievance, and nominee rights under the DPDP Act 2023: the response deadlines a Data Fiduciary must meet, with ready-to-use request templates.
The DPDP Act imposes 7 obligations on every Data Fiduciary, with penalties reaching ₹250 crore at the top tier. What each obligation requires, section by section.
India's Digital Personal Data Protection Act 2023 decoded: 7 obligations for every Data Fiduciary, 8 rights for Data Principals, penalties up to ₹250 crore.
Miss the 72-hour window and the exposure is ₹200 crore under Section 8(6). The Board deadline, the 6-hour CERT-In rule, and the reporting steps, mapped.
Audit your DPDP Act 2023 posture against 43 controls, then sequence remediation across five months to the November 2026 Consent Manager deadline.
₹200 crore per violation. Section 9 of the DPDP Act bans tracking, behavioural profiling, and targeted ads aimed at under-18s, even with parental consent, and requires verifiable parental consent before any processing begins.
A breakdown of every penalty provision in the DPDP Act 2023. Understand the financial exposure, the enforcement mechanism, and what triggers each penalty tier.
Most companies do not need to register. Who does, the 13 November 2026 deadline, the Rs 2 crore net worth test, and what Sections 6(7) to 6(9) require.
Every DPDP Act date: Rules notified Nov 2025, Consent Manager registration Nov 2026, penalty enforcement May 2027. Plan your compliance timeline.
Both laws protect personal data. They differ in scope, consent models, penalty structures, and cross-border transfer rules. This is what multinational companies operating in India need to know.
SDF designation under Section 10 of the DPDP Act triggers a DPO in India, data protection impact assessments, and independent audits. Who qualifies and how to prepare.
Structured approach to building a data protection program that meets India's DPDP Act 2023 requirements. From gap assessment through operational compliance in 90 days.