DPDPA news, guidance & how-tos.
Practical, accurate writing on the DPDP Act 2023 and the DPDP Rules 2025 — from consent management to breach response.
210 Days to May 2027: A Week-by-Week DPDPA Compliance Roadmap
From mid-October 2026 there are roughly 210 days until the DPDP Act’s core obligations and penalties commence. A phased, realistic roadmap that does the long-lead work first.
DPDPA, CERT-In and RBI: Navigating India’s Overlapping Data Rules in 2026
A breach at an Indian fintech can trigger a 6-hour CERT-In report, a DPDPA Board intimation with a 72-hour detailed report, and RBI notifications, all for the same incident. How the regimes interact and how to build one process that satisfies all three.
Verifiable Consent for Children and Persons with Disability After the 2026 Order
Section 9(1), as clarified in October 2026, requires verifiable consent from a parent for children and from a lawful guardian for persons with disability. How Rules 10 and 11 work, the exemptions, and how to design compliant flows.
The SDF “Data Audit”: How Significant Data Fiduciaries Should Prepare
The 2026 Removal of Difficulties Order made it explicit: Significant Data Fiduciaries need a periodic data audit by an independent data auditor, not a repurposed financial or ISMS audit. What the audit should cover and how to get ready.
Will the DPDPA Deadline Move Earlier? MeitY’s 12-Month Proposal Explained
In January 2026 MeitY reportedly asked industry whether the 18-month DPDPA compliance window should shrink to 12 months. Nine months later nothing has been notified, but the proposal shows where the government’s priorities lie.
The Supreme Court Challenge to the DPDP Act: RTI, Journalism and What Businesses Should Watch
Petitions before the Supreme Court challenge the DPDP Act’s amendment to the RTI Act and other provisions. The Court has refused a stay and referred the RTI questions to a larger bench. What is being argued, and what it means for compliance planning.
Data Protection Board of India in 2026: Established, Recruiting, Not Yet Enforcing
The Data Protection Board of India was established on 13 November 2025, and MeitY invited applications for its Chairperson and Members in May 2026. Here is what the Board can and cannot do today, and what to expect once it is staffed.
Is the DPDP Act in Force? What Applies Today and What Switches On in 2026–27
The DPDP Act is partly in force. The Board, definitions and rule-making machinery commenced on 13 November 2025; Consent Managers follow on 13 November 2026; most obligations and penalties land in May 2027. A clear, sourced status check.
Consent Managers Go Live on 13 November 2026: What Data Fiduciaries Must Do Now
The first operational phase of the DPDP Rules 2025 arrives on 13 November 2026, when the Consent Manager provisions commence. Here is what the registration conditions say and what it means for businesses that collect consent.
DPDP (Removal of Difficulties) Order 2026: What Changed for Children’s Data and SDF Audits
MeitY has used its Section 43 power for the first time to correct the text of Sections 9(1) and 10(2)(c)(ii) of the DPDP Act. The edits are small, but they settle two questions that compliance teams were already arguing about.
How-ToDPIA Under DPDPA: A Practical Guide to Data Protection Impact Assessments
Mandatory for Significant Data Fiduciaries and wise for everyone else — how to run a DPIA under the DPDP Act: when to trigger one, what to assess, and how to keep it proportionate.
Vendor and Processor Management Under DPDPA: You Are Accountable for Their Failures
Under Section 8(2), a Data Fiduciary answers for its Data Processors. How to contract, onboard, monitor and exit vendors so a supplier’s breach does not become your ₹250 crore problem.
Employee Data Under DPDPA: What HR Teams Can (and Cannot) Do Without Consent
Section 7(i) lets employers process employee data for employment purposes without consent — but the exemption is narrower than HR teams assume. BGV, monitoring, alumni data and more.
RegulatoryCross-Border Data Transfers Under DPDPA: The Negative-List Model Explained
DPDPA allows personal data to flow to any country not on a government-notified restriction list — no adequacy decisions or SCCs. But sectoral rules and SDF localisation can still bind you.
How-ToData Principal Rights Under DPDPA: Building a Request Workflow That Scales
Access, correction, erasure, grievance redressal and nomination — DPDPA gives Data Principals enforceable rights. Here is how to build a request workflow that meets the statutory clock.
ComplianceAre You a Significant Data Fiduciary? The SDF Test and What It Triggers
The government can notify your company as a Significant Data Fiduciary based on data volume, sensitivity and risk. SDF status triggers a DPO in India, independent audits and periodic DPIAs.
DPDPA vs GDPR: What Global SaaS Teams Must Change for India
GDPR compliance does not equal DPDPA compliance. No legitimate-interest basis, breach notification for every breach, fixed penalty ceilings and 18-as-a-child are just the start.
How-ToChildren's Data Under DPDPA Section 9: Verifiable Parental Consent, Explained
Processing a child’s data in India requires verifiable parental consent — and bans tracking, behavioural monitoring and targeted advertising. What Section 9 and the DPDP Rules 2025 demand.
PenaltiesDPDPA Penalties Explained: How the ₹250 Crore Fines Actually Work
The DPDPA Schedule sets penalty ceilings from ₹10,000 to ₹250 crore. Here is how the Data Protection Board determines penalties, what drives them up, and how to reduce exposure.
Breach ResponseDPDPA Breach Notification: The 72-Hour Playbook Every Indian Business Needs
A personal data breach under the DPDPA triggers notification duties to the Data Protection Board and affected Data Principals. Here is an hour-by-hour playbook to stay inside the statutory window.
How-ToConsent Management Under DPDPA: How to Build a Compliant Consent Flow
Consent is the backbone of the DPDPA. Learn how to design a consent flow that is free, specific, informed and unambiguous — with easy withdrawal and a full audit trail.
RegulatoryDPDP Rules 2025: What Changed and What Indian Businesses Must Do Now
The Digital Personal Data Protection Rules 2025 operationalise the DPDPA. Here is what they mean for consent notices, breach reporting, children’s data and Significant Data Fiduciaries — and the actions to take now.
ComplianceDPDPA Compliance Checklist for 2025: A Step-by-Step Guide for Indian Businesses
A practical, step-by-step DPDPA compliance checklist covering data mapping, consent notices, Data Principal rights, security safeguards and breach response under the DPDP Act 2023 and DPDP Rules 2025.
Get DPDPA-ready before the enforcement window closes.
Start with a free readiness assessment, or book a demo of the Data Adhikaar agent fabric.
Or call +91 87999 15326