What Actually Changed, and Why It Reaches Your Business
The DPDP Act, 2023 and the DPDP Rules, 2025 — what replaced the old regime and why the penalties are real.
Do You Fall in Scope? Fiduciary, Processor, Principal
The three roles, the B2B myth, the extraterritorial reach, and why there is no small-business exemption.
The Dates That Define Your Next 18 Months
13 November 2025, 13 November 2026 and 13 May 2027, plus the Board's real status and the Rules at a glance.
Notice: The Notice That Stands on Its Own
Section 5 and Rule 3 — the itemised data, the purpose, the three links, and the Eighth Schedule language option.
Consent: What Valid Consent Looks Like Now
Free, specific, informed, unconditional, unambiguous, withdrawable — and the burden of proof that sits on you.
Legitimate Uses: The Nine Times You Don't Need Consent
All nine Section 7 grounds, and how not to stretch them into an excuse for marketing.
Security: The Rs. 250-Crore Obligation
Rule 6's minimum safeguards, the AI-tool trap from the CERT-In advisory, and the cheapest high-value moves.
Breach: The First 72 Hours
Notify individuals and the Board without delay, the 72-hour detailed report, and CERT-In's six-hour clock.
Retention and Erasure: The 48-Hour Warning
Rule 8, the Third Schedule's three-year rule, and reconciling the duty to erase with statutory retention.
Rights and Grievance: The 90-Day Clock
Access, correction, erasure, grievance and nomination — and how to find one person's data across every system.
Children's Data: Under-18 Means Verifiable Parental Consent
Section 9, Rule 10, DigiLocker verification, the ban on tracking and targeted ads, and the narrow exemptions.
Vendors: Your Processor Contracts and the DPA Clause List
Why you cannot outsource responsibility, and the non-negotiable clauses every processor contract needs.
Significant Data Fiduciary: Who Gets the DPO, Auditor and DPIA
Who is notified, the extra duties under Section 10 and Rule 13, and how to prepare without over-spending.
Consent Managers: What November 2026 Changes
The Rule 4 framework, the Rs. 2 crore eligibility, and what it means for your consent architecture.
Penalties: The Schedule, Decoded
Every band from Rs. 250 crore to Rs. 10,000, why consent has no line of its own, and how the Board sets an amount.
Cross-Border Transfers and the Rules That Stack
Section 16, RBI localisation, CERT-In, and the marketplace express-consent duty from 1 January 2027.
Worked Example: A 12-Person D2C Brand, End to End
What the data map found, what changed, and what compliance actually cost.
Sector Spotlights
Clinics, coaching and edtech, e-commerce sellers, agencies and freelancers, and employers — with the sharp edges.
Working With AI Tools Under the DPDP Act
The CERT-In finding on AI agents, and four rules that keep you safe while still using AI.
Your 12-Question Readiness Self-Assessment
Score yourself honestly before 13 May 2027 — and know exactly what to fix first.
The 90-Day Compliance Sprint
A week-by-week plan with deliverables, from data mapping to a team briefing.
Templates and Checklists
Data map, notice skeleton, breach notice, Board intimation, DPA clauses, rights register and vendor questions.
Ten Mistakes That Will Cost You Most
The errors that turn a manageable obligation into a Rs. 250-crore problem.
Questions Everyone Asks
Scope, B2B, consent, DPOs, the startup exemption, real costs and what happens if you do nothing.
Data Accuracy: The Obligation Everyone Forgets
Section 8(3) — the data you act on, and pass on, has to be complete, accurate and consistent.
Your DPDP Calendar, January to May 2027
What to finish each month so that 13 May 2027 is a formality, not a scramble.
If the Board Comes Calling: How an Inquiry Runs
Section 27 to 33, the six-month inquiry window, voluntary undertakings, and why documentation is your defence.
