Retention
DPDP data retention and erasure: Rule 8 explained
The three retention mechanics in Rule 8: timed erasure for Third Schedule classes, the 48 hour warning, and the 1 year floor for logs and data, plus where other laws take over.
Archive
Articles and updates, page 5
43 articles on the DPDP Act 2023 and the DPDP Rules 2025, newest first. Every legal claim cites the official source it rests on.
Security
DPDP Rule 6 security safeguards, explained control by control
Rule 6 names its minimums: encryption or masking, access control, logs, backups, 1 year retention, contract terms and organisational measures.
Penalties
Voluntary undertakings under section 32: the DPDP settlement track
Section 32 of the DPDP Act 2023 lets the Data Protection Board accept a voluntary undertaking that bars further proceedings on its contents. Breaking it revives the penalty route.
Definitions
Is a name and email address personal data under DPDP?
Usually yes in ordinary business records. The Act's definition turns on identifiability, and in real records names and email addresses identify people. What the definition says and what follows.
Compliance
Significant Data Fiduciary: what changes if you are notified
SDF status arrives by government notification against the section 10 factors, not by crossing a user count. The real numbers in the framework, the duties that follow, and the vendor thresholds that do not exist.
Children
What is verifiable consent under DPDP?
Consent for children must come from a verified parent or guardian. The two verification paths Rule 10 gives and the four cases it illustrates.
Notice
What must a DPDP privacy notice contain?
Rule 3 requires a standalone, plain language notice with an itemised description of the data, the specified purposes, and working paths to withdraw consent, exercise rights and complain to the Board.