https://dpdprules.org/blog Articles on India's DPDP framework, every legal claim source backed. Thu, 27 Aug 2026 00:00:00 GMT https://dpdprules.org/blog/dpdp-cookie-consent-what-the-law-says https://dpdprules.org/blog/dpdp-cookie-consent-what-the-law-says Wed, 26 Aug 2026 00:00:00 GMT The word cookie appears 0 times in the DPDP Act 2023 and 0 times in the DPDP Rules 2025. So do explicit, granular and banner. What actually governs a cookie is the personal data inside it. https://dpdprules.org/blog/dpdp-marketing-consent-whatsapp-sms https://dpdprules.org/blog/dpdp-marketing-consent-whatsapp-sms Wed, 26 Aug 2026 00:00:00 GMT Marketing to Indian customers sits under 2 separate regimes. The TRAI regulations are in force now and cover voice calls and messages. The DPDP consent rules are not in force until 2027. https://dpdprules.org/blog/is-the-data-protection-board-operational https://dpdprules.org/blog/is-the-data-protection-board-operational Wed, 26 Aug 2026 00:00:00 GMT The Data Protection Board of India exists in law and has no appointed members. Even fully staffed it could not take a complaint, because section 27 is not in force. Those are 2 different gaps. https://dpdprules.org/blog/dpdp-deemed-consent-does-not-exist https://dpdprules.org/blog/dpdp-deemed-consent-does-not-exist Tue, 25 Aug 2026 00:00:00 GMT The DPDP Act 2023 contains no deemed consent and no legitimate interest ground. Both phrases come from the 2022 consultation draft Bill, which was never introduced in Parliament. What replaced them is section 7, Certain legitimate uses, with 9 clauses. https://dpdprules.org/blog/data-protection-officer-under-dpdp https://dpdprules.org/blog/data-protection-officer-under-dpdp Mon, 24 Aug 2026 00:00:00 GMT Only a notified Significant Data Fiduciary must appoint a DPO under section 10(2)(a). Every other Data Fiduciary owes a published contact person under Rule 9. https://dpdprules.org/blog/dpdp-commencement-date-13-or-14-november https://dpdprules.org/blog/dpdp-commencement-date-13-or-14-november Mon, 24 Aug 2026 00:00:00 GMT Gazette issue No. 760 is printed 13 November 2025; the eGazette file code stamped on that same issue and the Government's own PIB release record 14 November 2025. What that does to every computed DPDP deadline, from the official text. https://dpdprules.org/blog/dpdp-data-breach-kya-karein https://dpdprules.org/blog/dpdp-data-breach-kya-karein Mon, 24 Aug 2026 00:00:00 GMT डेटा ब्रीच के बाद भारत में 2 समयसीमाएँ हैं: CERT In को 6 घंटे, जो आज लागू है, और DPDP नियम 7, जो अभी लागू नहीं है। आधिकारिक हिंदी राजपत्र के पाठ के साथ। https://dpdprules.org/blog/dpdp-for-schools-and-edtech https://dpdprules.org/blog/dpdp-for-schools-and-edtech Mon, 24 Aug 2026 00:00:00 GMT The DPDP education carve out covers tracking and behavioural monitoring only. Admissions, fees and most edtech accounts will still need verifiable parental consent. https://dpdprules.org/blog/dpdp-section-17-exemptions https://dpdprules.org/blog/dpdp-section-17-exemptions Mon, 24 Aug 2026 00:00:00 GMT Section 17(1) disapplies Chapter II, Chapter III and section 16 in 6 named situations, but never sections 8(1) and 8(5). The verified clause by clause map. https://dpdprules.org/blog/dpdp-sensitive-personal-data https://dpdprules.org/blog/dpdp-sensitive-personal-data Mon, 24 Aug 2026 00:00:00 GMT The word sensitive appears nowhere in the DPDP Act, and there is no section 3(d). What actually creates higher duties: SDF notification, children's data and the Third Schedule. https://dpdprules.org/blog/dpdp-act-supreme-court-challenge https://dpdprules.org/blog/dpdp-act-supreme-court-challenge Sun, 23 Aug 2026 00:00:00 GMT Writ petitions in the Supreme Court challenge the DPDP Act's RTI amendment, exemptions and Board design. Notice issued, no stay: what stands in August 2026. https://dpdprules.org/blog/dpdp-childrens-data-rules https://dpdprules.org/blog/dpdp-childrens-data-rules Sun, 23 Aug 2026 00:00:00 GMT Who is a child under the DPDP Act, the section 9 duties including parental consent and the tracking ban, Rule 10 verification and Fourth Schedule exemptions. https://dpdprules.org/blog/dpdp-compliance-requirements-for-businesses https://dpdprules.org/blog/dpdp-compliance-requirements-for-businesses Sun, 23 Aug 2026 00:00:00 GMT Every DPDP duty on a business: the 2 grounds for processing, notice, consent, section 8, rights, children, SDF duties and penalties, cited to the Gazette. https://dpdprules.org/blog/dpdp-consent-managers-explained https://dpdprules.org/blog/dpdp-consent-managers-explained Sun, 23 Aug 2026 00:00:00 GMT The Consent Manager explained from the primary sources: the section 2(g) definition, the section 6 consent channel, registration with the Board under Rule 4, and the First Schedule's Part A conditions and Part B obligations, quoted and cited. https://dpdprules.org/blog/dpdp-data-processing-agreement-clauses https://dpdprules.org/blog/dpdp-data-processing-agreement-clauses Sun, 23 Aug 2026 00:00:00 GMT The DPDP Act prescribes almost nothing about DPA content: a contract, Rule 6(1)(f) safeguards, erasure. Every other clause is drafting. https://dpdprules.org/blog/dpdp-data-protection-audit-requirements https://dpdprules.org/blog/dpdp-data-protection-audit-requirements Sun, 23 Aug 2026 00:00:00 GMT Only notified Significant Data Fiduciaries need a DPDP audit: the independent auditor in section 10(2)(b), on the 12 month Rule 13 cycle. https://dpdprules.org/blog/dpdp-notice-language-requirements https://dpdprules.org/blog/dpdp-notice-language-requirements Sun, 23 Aug 2026 00:00:00 GMT Section 5(3) gives the Data Principal the option of English or any Eighth Schedule language. A readiness duty, not 22 published versions. https://dpdprules.org/blog/dpdp-significant-data-fiduciary-obligations https://dpdprules.org/blog/dpdp-significant-data-fiduciary-obligations Sun, 23 Aug 2026 00:00:00 GMT What section 10 adds once you are notified: an India based DPO answerable to the board, an independent auditor, and the 12 month Rule 13 DPIA and audit cycle. https://dpdprules.org/blog/dpia-under-dpdp-act https://dpdprules.org/blog/dpia-under-dpdp-act Sun, 23 Aug 2026 00:00:00 GMT Only notified Significant Data Fiduciaries must run a DPIA, on the 12 month Rule 13 cycle. What section 10(2)(c) defines, and what GDPR habits do not carry. https://dpdprules.org/blog/dpdp-act-for-hr-teams-employee-data https://dpdprules.org/blog/dpdp-act-for-hr-teams-employee-data Fri, 21 Aug 2026 00:00:00 GMT Section 7(i) of the DPDP Act lets employers process employee personal data for the purposes of employment without consent, but the exemption has edges: it does not cover everything HR touches, and the general obligations still apply. https://dpdprules.org/blog/dpdp-compliance-checklist-small-business https://dpdprules.org/blog/dpdp-compliance-checklist-small-business Fri, 21 Aug 2026 00:00:00 GMT A 10 step DPDP compliance checklist sized for small Indian businesses: map your data, pick the ground for each purpose, fix your notice and consent, prepare for breaches and rights requests, each step cited to the exact provision. https://dpdprules.org/blog/data-breach-at-your-organisation-what-to-do https://dpdprules.org/blog/data-breach-at-your-organisation-what-to-do Thu, 20 Aug 2026 00:00:00 GMT What to do when your organisation becomes aware of a personal data breach: contain and anchor the clock, run the 2 Rule 7 duties in parallel, file the 72 hour Board submission, then stabilise. https://dpdprules.org/blog/dpdp-act-kya-hai https://dpdprules.org/blog/dpdp-act-kya-hai Thu, 20 Aug 2026 00:00:00 GMT DPDP का फुल फॉर्म है Digital Personal Data Protection। DPDP Act 2023 भारत का डेटा संरक्षण कानून है और DPDP Rules 2025 इसे लागू करते हैं। यह कब से लागू है, किस पर लागू होता है और जुर्माने कितने हैं, आधिकारिक राजपत्र के संदर्भ के साथ। https://dpdprules.org/blog/dpdp-breach-72-hours-cert-in-6-hours https://dpdprules.org/blog/dpdp-breach-72-hours-cert-in-6-hours Thu, 20 Aug 2026 00:00:00 GMT India runs 2 separate breach clocks: DPDP Rule 7 gives 72 hours for the detailed Board submission, while the CERT In directions require reporting cyber incidents within 6 hours. Who reports what, to whom, on which clock. https://dpdprules.org/blog/dpdp-vs-gdpr-key-differences https://dpdprules.org/blog/dpdp-vs-gdpr-key-differences Thu, 20 Aug 2026 00:00:00 GMT How India's DPDP Act 2023 differs from the EU GDPR: scope, lawful bases, Consent Managers, breach clocks, fixed rupee penalties versus turnover percentages, children's data, cross border transfers and DPIA triggers, in one table. https://dpdprules.org/blog/what-is-dpdp https://dpdprules.org/blog/what-is-dpdp Tue, 18 Aug 2026 00:00:00 GMT DPDP stands for Digital Personal Data Protection. The DPDP Act 2023 is India's data protection law and the DPDP Rules 2025 operationalise it, in force in phases from 13 November 2025. https://dpdprules.org/blog/consent-managers-under-dpdp https://dpdprules.org/blog/consent-managers-under-dpdp Mon, 17 Aug 2026 00:00:00 GMT Most ordinary businesses do not need to register as a Consent Manager: it is a registered intermediary, not consent management software. What Rule 4 actually sets up. https://dpdprules.org/blog/data-fiduciary-vs-data-processor https://dpdprules.org/blog/data-fiduciary-vs-data-processor Mon, 17 Aug 2026 00:00:00 GMT The 2 roles in 1 test: who decides why and how the data is used. What each role owes, why one company can hold both roles, and why responsibility never transfers. https://dpdprules.org/blog/does-dpdp-apply-to-b2b-saas https://dpdprules.org/blog/does-dpdp-apply-to-b2b-saas Mon, 17 Aug 2026 00:00:00 GMT Usually yes, twice over: as a Data Fiduciary for your own users and as a Data Processor for customer data. What each role means and what your contracts must carry. https://dpdprules.org/blog/does-dpdp-apply-to-foreign-companies https://dpdprules.org/blog/does-dpdp-apply-to-foreign-companies Mon, 17 Aug 2026 00:00:00 GMT The Act reaches foreign companies serving people in India, and largely steps back from foreign data handled under Indian outsourcing contracts. https://dpdprules.org/blog/does-dpdp-apply-to-startups https://dpdprules.org/blog/does-dpdp-apply-to-startups Mon, 17 Aug 2026 00:00:00 GMT Section 3 carries no turnover, headcount or user threshold, so a 2 person company is inside the Act. Size still decides which duties bite, in 3 named places, and section 17(3) names startups without exempting a single one. https://dpdprules.org/blog/dpdp-act-rules-what-is-in-force-2026 https://dpdprules.org/blog/dpdp-act-rules-what-is-in-force-2026 Mon, 17 Aug 2026 00:00:00 GMT A source backed status check: which parts of India's DPDP framework operate today, which dates are official, and which dates are computed. https://dpdprules.org/blog/dpdp-board-complaint-inquiry-appeal https://dpdprules.org/blog/dpdp-board-complaint-inquiry-appeal Mon, 17 Aug 2026 00:00:00 GMT Sections 27 to 34 and Rules 19 and 22: what starts the Data Protection Board, the 6 month inquiry clock, the section 33(2) factors and the 60 day appeal. https://dpdprules.org/blog/dpdp-breach-reporting-rule-7 https://dpdprules.org/blog/dpdp-breach-reporting-rule-7 Mon, 17 Aug 2026 00:00:00 GMT Rule 7 of the DPDP Rules 2025 sets 2 clocks after a personal data breach: immediate intimation to affected individuals and to the Board, then detailed information to the Board within 72 hours. https://dpdprules.org/blog/dpdp-compliance-checklist-for-ctos https://dpdprules.org/blog/dpdp-compliance-checklist-for-ctos Mon, 17 Aug 2026 00:00:00 GMT The engineering owned slice of a DPDP program: safeguards, retention timers, breach detection, consent withdrawal paths and rights machinery, with the cross functional dependencies made explicit. https://dpdprules.org/blog/dpdp-compliance-checklist-for-startups https://dpdprules.org/blog/dpdp-compliance-checklist-for-startups Mon, 17 Aug 2026 00:00:00 GMT A small team's path through the DPDP framework: settle applicability, map your data, and build the 5 duty clusters in dependency order while the runway lasts. https://dpdprules.org/blog/dpdp-consent-requirements https://dpdprules.org/blog/dpdp-consent-requirements Mon, 17 Aug 2026 00:00:00 GMT Section 6 sets 5 qualities, a clear affirmative action, a necessity limit and a proof burden that lands on you. 10 sub sections, 4 illustrations, and none of it in force yet. https://dpdprules.org/blog/dpdp-cross-border-transfers https://dpdprules.org/blog/dpdp-cross-border-transfers Mon, 17 Aug 2026 00:00:00 GMT Transfers out of India are permitted by default under Rule 15. But Rule 13(4) does impose localisation, once it commences, on Significant Data Fiduciaries for data the Central Government specifies, including its traffic data. https://dpdprules.org/blog/dpdp-grievance-redressal-90-days https://dpdprules.org/blog/dpdp-grievance-redressal-90-days Mon, 17 Aug 2026 00:00:00 GMT Individuals get a right to readily available grievance redressal, Rule 14(3) names 90 days in a sentence that lost its object, and the Board only comes after this channel is exhausted. https://dpdprules.org/blog/dpdp-individual-rights-explained https://dpdprules.org/blog/dpdp-individual-rights-explained Mon, 17 Aug 2026 00:00:00 GMT The 4 Chapter III rights, plus section 6(4) withdrawal. What each one reaches, the consent gate on 2 of them, and the 3 exemptions that remove all 4. https://dpdprules.org/blog/dpdp-penalties-schedule-explained https://dpdprules.org/blog/dpdp-penalties-schedule-explained Mon, 17 Aug 2026 00:00:00 GMT The DPDP Act 2023 caps penalties in its Schedule, up to 250 crore rupees for failing security safeguards. Section 33 sets who imposes them and how. https://dpdprules.org/blog/dpdp-processor-contracts https://dpdprules.org/blog/dpdp-processor-contracts Mon, 17 Aug 2026 00:00:00 GMT Engaging a Data Processor is lawful only under a valid contract, and the safeguards rule requires safeguard provisions in it. The 2 anchors, and what to add. https://dpdprules.org/blog/dpdp-retention-rule-8-explained https://dpdprules.org/blog/dpdp-retention-rule-8-explained Mon, 17 Aug 2026 00:00:00 GMT The DPDP framework sets no retention period. It sets a purpose test, 1 deemed timer for 3 named classes, and 2 rules that make you keep data for a year. https://dpdprules.org/blog/dpdp-rule-6-security-safeguards https://dpdprules.org/blog/dpdp-rule-6-security-safeguards Mon, 17 Aug 2026 00:00:00 GMT Rule 6 names its minimums: encryption or masking, access control, logs, backups, 1 year retention, contract terms and organisational measures. https://dpdprules.org/blog/dpdp-voluntary-undertakings-section-32 https://dpdprules.org/blog/dpdp-voluntary-undertakings-section-32 Mon, 17 Aug 2026 00:00:00 GMT Section 32 of the DPDP Act 2023 lets the Data Protection Board accept a voluntary undertaking that bars further proceedings on its contents. Breaking it revives the penalty route. https://dpdprules.org/blog/is-name-email-personal-data-dpdp https://dpdprules.org/blog/is-name-email-personal-data-dpdp Mon, 17 Aug 2026 00:00:00 GMT Usually yes in ordinary business records. The Act's definition turns on identifiability, and in real records names and email addresses identify people. What the definition says and what follows. https://dpdprules.org/blog/significant-data-fiduciary-explained https://dpdprules.org/blog/significant-data-fiduciary-explained Mon, 17 Aug 2026 00:00:00 GMT SDF status arrives by government notification against the section 10 factors, not by crossing a user count. The real numbers in the framework, the duties that follow, and the vendor thresholds that do not exist. https://dpdprules.org/blog/what-is-verifiable-consent-dpdp https://dpdprules.org/blog/what-is-verifiable-consent-dpdp Mon, 17 Aug 2026 00:00:00 GMT Consent for children must come from a verified parent or guardian. The 2 verification paths Rule 10 gives and the 4 cases it illustrates. https://dpdprules.org/blog/what-must-a-dpdp-privacy-notice-contain https://dpdprules.org/blog/what-must-a-dpdp-privacy-notice-contain Mon, 17 Aug 2026 00:00:00 GMT Section 5 names 3 things the notice must inform. Rule 3 sets its shape and 2 minimums. Neither is in force yet. What the text requires, and what it does not.