The DPDP Act 2023 is India's most significant data regulation since the IT Act 2000, and the compliance landscape is still being misread by most organisations. The most common mistake is treating DPDP compliance as a data mapping exercise. It is not. It is a governance exercise. The six obligations that matter most in practice.
First: consent management. The Act requires 'free, specific, informed, unconditional, and unambiguous' consent. Bundled consent buried in terms and conditions does not meet this standard. You need a consent management architecture. Second: data principal rights. The Act gives individuals the right to access, correction, erasure, and grievance redressal.
You need operational processes to fulfil these rights within the prescribed timelines. Third: data fiduciary obligations. Every significant data fiduciary must appoint a Data Protection Officer, conduct Data Protection Impact Assessments, and maintain processing records. Fourth: cross-border transfer restrictions.
The Act empowers the government to restrict personal data transfer to certain countries. Your data localisation strategy must account for this. Fifth: breach notification. The Act requires notification to the Data Protection Board and affected individuals in the event of a breach, without specifying a timeline.
Treating this as a future concern is a compliance risk today. Sixth: children's data. The Act imposes significant restrictions on processing personal data of children under 18. If you operate any consumer-facing digital service, this affects you directly..
Discuss this insight with us
If this insight is relevant to a challenge you are facing, we welcome a confidential conversation.
Engage Us