DPDP FAQ & Knowledge Hub

The Digital Personal Data Protection Act, 2023 is India's statutory framework for processing digital personal data. It establishes, among other things, requirements concerning grounds for processing, notices, consent, Data Fiduciary obligations, children's data, Significant Data Fiduciaries, Data Principal rights and certain processing outside India.

Explore DPDP Compliance Overview →

The Digital Personal Data Protection Rules, 2025 are subordinate rules made under the Act that provide further requirements for areas such as notices, security safeguards, breach notification, Consent Managers and other operational matters. They were officially notified on 13 November 2025.

No. The Act and Rules have different commencement dates. Under the final Rules, Rules 1, 2 and 17–21 commenced on publication; Rule 4 is scheduled to commence one year after publication; and Rules 3, 5–16, 22 and 23 are scheduled to commence eighteen months after publication. The Act also has its own phased commencement notification.

Rule 4 is scheduled to commence on 13 November 2026, one year after publication of the Rules. Rule 4 concerns registration of Consent Managers and related requirements; it does not mean every business must become a Consent Manager.

They are scheduled to commence 18 months after 13 November 2025, which is 13 May 2027.

Not every organisation has identical obligations. Section 3 sets out the Act's scope for processing digital personal data in India and also addresses certain processing outside India connected with offering goods or services to Data Principals in India, subject to the Act's provisions and exclusions. Applicability should therefore be assessed from the actual processing activity rather than from company size or business type alone.

Assess Your Applicability with DPDP Compliance →

No simple 'website = covered, offline = not covered' rule exists. The Act addresses digital personal data, including situations where personal data collected non-digitally is digitised subsequently, within the statutory scope.

The answer depends on the processing activity and applicable provisions. Businesses should not assume that all employee-data processing is either completely outside the framework or always consent-based. The Act also contains specified legitimate-use provisions.

Explore DPDP Compliance for HRTech & Recruitment →

Potentially. A SaaS company can process personal data for its own purposes (such as account signups and billing) and can also process customer data on behalf of another organisation as a Data Processor. The role therefore depends on the actual processing relationship.

Explore DPDP Compliance for SaaS Companies →

Potentially, particularly where personal data is processed on behalf of customers. The critical question is not simply whether the company is 'IT' or 'BPO', but whose purposes determine the processing and what the service provider actually does with the data.

Explore DPDP Compliance for IT, ITES & BPO →

The Act specifically addresses certain processing outside India where it is connected with offering goods or services to Data Principals in India. The analysis should consider the statutory scope and the actual processing arrangement rather than treating all overseas processing as automatically prohibited.

A Data Fiduciary is the entity that determines the purpose and means of processing personal data. In practical terms, the important question is: Who decides why the data is being processed and how that processing is carried out? The statutory definition should control the final classification.

A Data Processor processes personal data on behalf of a Data Fiduciary. The relationship should be assessed from the actual arrangement and processing activity rather than only from the service contract's title.

Yes. A company's role can differ according to the processing activity. For example, a SaaS provider may determine purposes for some information it collects directly (such as telemetry or billing) while processing customer-controlled data on behalf of an enterprise customer for another activity.

No. Operating an application or collecting information through an interface is not, by itself, the complete legal test for determining the role. The relevant question remains who determines the purpose and means of the processing.

A practical 2026 industry discussion around a Loan Service Provider (LSP) / loan-origination platform raised this exact issue: whether running a borrower-facing application, collecting KYC documents and performing operational processing necessarily makes the LSP a Data Fiduciary, or whether a Processor relationship can still exist. The answer must be derived from the Act rather than informal opinions: who decides the purpose and means governs.

No. Consent collection is one part of processing. It does not replace the statutory test for determining who determines the purpose and means.

A contract is important, but the contractual description should match the actual relationship. Section 8 also addresses engagement of Data Processors by Data Fiduciaries through a valid contract. The document should therefore reflect how processing actually occurs.

Explore DPDP Vendor & Data Processor Compliance →

No. The Act provides for processing based on consent as well as specified legitimate uses. Organisations therefore need to determine the applicable basis for each processing activity instead of assuming that every activity needs a consent checkbox.

For processing covered by the Act's legitimate-use provisions, yes. The correct question is whether the particular processing falls within an applicable legitimate use, not whether the business prefers legitimate use over consent.

Where processing is based on consent, the Act provides for withdrawal of consent and states that withdrawal should be as easy as giving consent. Operationally, organisations also need to understand what systems and downstream processing depend on that consent.

Not necessarily. The framework requires consent to meet statutory conditions. The final Rules also require notices to be presented in clear and simple language and to provide information enabling the Data Principal to give specific and informed consent where consent is required.

The final Rules require the notice to be understandable independently and to provide specified information in clear and simple language. The focus should therefore be on whether the notice performs its statutory function, not merely on document length or format.

Not necessarily. Withdrawal of consent and erasure are related but distinct concepts. The organisation needs to determine the applicable statutory requirement and how withdrawal affects the relevant processing activity and downstream systems.

The Act provides Data Principals with rights including: access to information about processing, correction and erasure of personal data, grievance redressal, and nomination.

Explore DPDP Consent, Rights & Privacy Management →

Not as a universal rule. Whether and how erasure applies depends on the relevant statutory requirement, processing context and any applicable requirement to retain information under law.

Not necessarily. A business may need to understand relevant applications, analytics systems, backups and processors before determining the practical scope of an erasure action. The important operational question is: Can the organisation identify where the relevant personal data exists and how a valid erasure action propagates through the processing environment?

Yes. The Act expressly provides for grievance redressal. An organisation therefore needs an actual process for receiving, routing and responding to grievances rather than only mentioning grievance rights in a policy.

The Act includes a nomination mechanism that allows a Data Principal to nominate another individual in accordance with the statutory requirements.

A child is an individual who has not completed 18 years of age under the Act.

Yes. Section 9 contains additional provisions for children's personal data, including verifiable parental consent and restrictions concerning tracking, behavioural monitoring and targeted advertising, subject to the Act and applicable provisions.

No. The Act contains specific conditions and exemptions. A commercial EdTech company should not assume that its educational purpose automatically removes the relevant children's-data requirements.

Explore DPDP Compliance for EdTech Companies →

No. The relevant obligations concern the processing of a child's data while the individual falls within the Act's definition of a child.

The final Rules require reasonable security safeguards and specifically identify measures such as encryption, obfuscation, masking or virtual tokens where appropriate, along with access controls, logging and monitoring, backup/continuity and other technical and organisational measures.

No universal algorithm is prescribed for every organisation. The Rules describe categories of security safeguards rather than requiring every organisation to deploy the exact same encryption architecture.

No universal penetration-testing requirement applies to every organisation. Penetration testing may be appropriate as part of a security assessment depending on the systems, applications, APIs and risk environment.

Explore DPDP Compliance & Security Assessment →

There is no universal requirement in the DPDP Act or Rules requiring every organisation to obtain ISO 27001 certification. Certification and assurance frameworks can still be useful commercially or contractually, but they should not be presented as universal statutory DPDP certification.

No. Application security addresses one part of the environment. DPDP implementation can also involve processing scope, governance, notices, consent where applicable, Data Principal rights, vendors, lifecycle management, incident processes and other controls.

No. The final Rules distinguish between different notification requirements. Affected Data Principals are to be informed without delay. The Board is also to be informed without delay, and Rule 7(2)(b) requires detailed information to the Board within 72 hours of becoming aware of the breach, unless the Board permits a longer period on written request. This is why a DPDP incident playbook should not be reduced to a '72-hour countdown.'

Explore DPDP Data Breach & Incident Readiness →

The Rules specify information concerning the nature, extent, timing and location of the breach, relevant consequences, measures taken or being taken to reduce risk, safeguards that affected Data Principals can take, and a business contact for questions.

Yes, the relationship matters. Section 8 places responsibility on the Data Fiduciary in relation to processing undertaken by it or on its behalf through a Data Processor, while the Rules also address security safeguards and processor-related contractual provisions.

Not necessarily. A contract is important, but organisations also need to understand: what data the processor receives → why it receives it → what access it has → where processing occurs → what security controls exist → what happens at exit. That is an operational governance issue, not just a contracting issue.

No. A certification or assurance report can provide useful evidence, but it does not automatically demonstrate that the organisation's particular processing arrangement, contract, data flows and access model are appropriately governed.

DPDP does not create a blanket rule that all personal data must always remain inside India. Section 16 addresses processing of personal data outside India and provides for restrictions that may be imposed by the Central Government. The actual architecture therefore needs to be assessed against the applicable statutory requirements and processing arrangement.

Potentially, but 'we don't sell the data' is not the legal test. The organisation should assess the actual purpose, means, instructions, access, processing activities and role relationship.

A practical 2026 industry discussion about a SaaS platform processing customer-uploaded electoral-roll data raised this exact distinction: whether processing only on customer instructions and not selling or merging data is enough for Processor classification. The legal classification must be determined from the applicable law and actual operational arrangement.

There is no standalone rule saying 'AI use = new DPDP category.' The important questions remain: What personal data enters the system? Why is it being processed? Who determines the purpose and means? Who operates the AI service? Where is the data processed? Who can access the data and outputs? The DPDP analysis should therefore begin with the processing activity.

The business should not treat this as a purely productivity question. It should consider whether the activity is authorised, what personal data is involved, what processing occurs, where the information goes, which provider receives it, and whether the organisation's governance and security controls permit that use.

Not automatically. The role depends on the actual relationship and who determines the purpose and means of the relevant processing.

No. The framework creates additional obligations for Significant Data Fiduciaries, including audit-related requirements under Rule 13. That should not be converted into a universal annual audit requirement for every organisation.

Explore DPDP Audit & Gap Assessment Guide →

No. A gap assessment primarily asks: Where are we missing or incomplete? An audit asks: Have defined controls been implemented and supported by sufficient evidence against the selected criteria? The correct engagement depends on the organisation's objective and maturity.

The Act and Rules do not establish a universal requirement for every organisation to obtain a government-issued 'DPDP certification.' Businesses should be careful with marketing claims that make such certification sound universally mandatory.

Not necessarily a formal assessment in every case, but the organisation needs enough understanding of its scope, processing environment and current state to avoid implementing controls blindly. The appropriate starting point may be: Data Mapping → Gap Assessment → Security Assessment → Implementation, depending on the situation.

A Significant Data Fiduciary is a Data Fiduciary that is designated by the Central Government under Section 10 of the Act based on factors such as volume and sensitivity of personal data, risk to Data Principals, public order, and state sovereignty. It should not be assumed that every large organisation automatically has SDF status.

No. SDF status depends on designation under the statutory framework and the relevant criteria, not solely on company headcount or balance sheet size.

The Act provides additional requirements for Significant Data Fiduciaries, and the Rules include requirements concerning matters such as a locally resident Data Protection Officer (DPO), an independent data auditor, periodic Data Protection Impact Assessments (DPIAs) and recurring independent audits.

Not necessarily. A privacy policy is only one component. An organisation may also need operational processes, relevant security safeguards, processor governance, Data Principal mechanisms and supporting evidence.

The organisation should be able to connect the consent event to the relevant notice/purpose and its processing workflow where the applicable consent requirement calls for it. A stronger evidence chain is: Data Principal → Notice → Purpose → Consent → Timestamp → System → Withdrawal, rather than simply 'Consent = Yes.'

Not automatically. The organisation should understand relevant connected systems, processors, backups and other copies before making a broad deletion claim.

No. The organisation should assess the actual relationship, data flows, contract, access model, security controls and evidence relevant to that processor.

No. The organisation also needs a practical workflow capable of receiving, authenticating, processing and executing applicable rights requests across systems.

Not solely on that basis. Security is important, but DPDP compliance is broader than application security alone.