Sources last verified on 24 August 2026. Methodology
Archive
43 articles on the DPDP Act 2023 and the DPDP Rules 2025, newest first. Every legal claim cites the official source it rests on.
Breach response
Rule 7 of the DPDP Rules 2025 sets two clocks after a personal data breach: immediate intimation to affected individuals and to the Board, then detailed information to the Board within 72 hours.
Compliance
The engineering owned slice of a DPDP program: safeguards, retention timers, breach detection, consent withdrawal paths and rights machinery, with the cross functional dependencies made explicit.
Compliance
A small team's path through the DPDP framework: settle applicability, map your data, and build the five duty clusters in dependency order while the runway lasts.
Consent
Free, specific, informed, unconditional and unambiguous, given by clear affirmative action, limited to what the purpose needs, withdrawable with comparable ease, and yours to prove.
Transfers
Transfers are allowed by default, subject to two government levers: foreign state access requirements and notified country restrictions.
Rights
Individuals get a right to readily available grievance redressal, organisations must publish a response period not exceeding 90 days, and the Board only comes after this channel is exhausted.
Rights
Four rights every Data Principal holds: access to what is held and shared, correction and erasure, grievance redressal, and nomination, with the duties that come along.
Penalties
The DPDP Act 2023 caps penalties in its Schedule, up to 250 crore rupees for failing security safeguards. Section 33 sets who imposes them and how.
Vendors
Engaging a Data Processor is lawful only under a valid contract, and the safeguards rule requires safeguard provisions in it. The 2 anchors, and what to add.
