Applicability
DPDP Act for ecommerce businesses: checkout, retention and vendors
Apply the DPDP Act to checkout, fulfilment, returns, marketing and vendors, including the special retention rules for large ecommerce platforms.
Tag
Articles tagged Data breach
6 articles on this site carry this tag. Open any of them for the source documents behind their legal claims, with a claim type label on every source.
Penalties
Jan Vishwas Act 2023: what it changed in the IT Act, and what it left alone
On the Gazette prints on file, read as at 6 September 2026. Entry 32 of the Jan Vishwas Act 2023 Schedule amended 11 provisions of the Information Technology Act, 2000 through 11 lettered limbs, multiplied all 3 section 44 penalties by 10, replaced imprisonment with a penalty in 5 provisions, and did not touch section 43A.
Breach response
डेटा ब्रीच हो जाए तो क्या करें? DPDP नियम 7 और 2 समयसीमाएँ
28 अक्टूबर 2026 की स्थिति में CERT In की 6 घंटे की duty named entities और Annexure I incidents पर लागू है; DPDP Rule 7 अभी लागू नहीं है। Official Hindi Gazette और Board को सूचना देने के 2 चरण समझें।
Breach response
A data breach just hit your organisation: the hour by hour response under DPDP
Rule 7 of the DPDP Rules 2025 is not in force, and when it commences 2 clocks start the moment your organisation becomes aware of a personal data breach. Computed commencement is 13 May 2027, interpretation until officially confirmed. Contain and anchor the clock while running the 2 Rule 7 duties in parallel, file the 72 hour Board submission, then stabilise.
Breach response
DPDP breach notification: 72 hours to the Board, 6 hours to CERT In
India runs 2 breach clocks and only 1 is in force today: CERT In, 6 hours. DPDP Rule 7, computed to commence 13 May 2027, interpretation until officially confirmed, gives 72 hours for the detailed Board submission, or longer if the Board allows on a written request; from then, one organisation can be on both. Who reports what, to whom, on which clock.
Breach response
DPDP data breach reporting: what Rule 7 actually requires
DPDP Rule 7, not in force yet, starts 2 clocks on awareness of a breach: intimation without delay, then detailed information to the Board within 72 hours. Computed commencement is 13 May 2027, interpretation until officially confirmed, and the intimation goes to each affected Data Principal and to the Board.
The provisions these articles point to
Each page carries the official text of the provision, its commencement status and the sources behind it.
- Section 8: General obligations of Data Fiduciary
- Section 44: Amendments to certain Acts
- Rule 7: Intimation of personal data breach
- Rule 8: Time period for specified purpose to be deemed as no longer being served
Tools for this topic
Free, no login, and each one shows the provisions its answers rest on.