Question 1

Who must appoint a Data Protection Officer under the DPDP Act?

Accepted Answer

Appointing a Data Protection Officer is an obligation of Significant Data Fiduciaries, not of every Data Fiduciary. Where an organisation is classified as a Significant Data Fiduciary, it must appoint a DPO who is based in India, is answerable to its board or equivalent governing body, and acts as the contact point for the grievance redressal mechanism.

Question 2

What is a RoPA?

Accepted Answer

A Record of Processing Activities, or RoPA, is the documented record of what an organisation does with personal data: each processing activity, its purpose, the categories of personal data and of data principals involved, who receives the data, how long it is kept and on what lawful basis. It is the artefact you produce when asked to demonstrate that you know and control your own processing.

Question 3

What is the difference between a RoPA and a data inventory?

Accepted Answer

A data inventory lists where personal data lives — which databases, object stores, SaaS applications and file shares hold it. A RoPA describes what you do with that data: the processing activity, its purpose, the lawful basis, the recipients and the retention period. The inventory is a map of locations; the RoPA is a record of conduct, and it is built on top of the inventory.

Question 4

What is a Significant Data Fiduciary under the DPDP Act?

Accepted Answer

A Significant Data Fiduciary is a Data Fiduciary, or a class of them, notified as such by the Central Government based on factors including the volume and sensitivity of personal data processed, the risk to data principals, and potential effects on the sovereignty and integrity of India, electoral democracy, security of the State and public order. The classification brings additional obligations: appointing a Data Protection Officer based in India, appointing an independent data auditor, and carrying out Data Protection Impact Assessments and periodic audits.

Question 5

What is a Data Fiduciary under the DPDP Act?

Accepted Answer

A Data Fiduciary is any person who, alone or with others, determines the purpose and means of processing personal data. The obligations of the Act fall primarily on the Data Fiduciary: giving notice, obtaining and honouring consent, keeping data accurate, protecting it with reasonable security safeguards, reporting breaches, and answering data principal requests.

Question 6

What is a Data Principal under the DPDP Act?

Accepted Answer

A Data Principal is the individual to whom personal data relates. Where the individual is a child, it includes their parent or lawful guardian; where the individual is a person with disability, it includes their lawful guardian. Data Principals hold rights of access, correction and erasure, the right to grievance redressal, and the right to nominate another person to exercise their rights.

Question 7

What rights do Data Principals have under the DPDP Act?

Accepted Answer

Under the DPDP Act a Data Principal has the right to obtain a summary of the personal data being processed and the processing activities undertaken, the right to correction, completion, updating and erasure of their personal data, the right to readily available means of grievance redressal, and the right to nominate another individual to exercise these rights in the event of death or incapacity.

Question 8

Who is a Consent Manager under the DPDP Act?

Accepted Answer

A Consent Manager is a person registered with the Data Protection Board of India who gives Data Principals a single, accessible, transparent and interoperable point at which to give, manage, review and withdraw their consent across Data Fiduciaries. It is a defined statutory role that acts on the individual's side of the relationship, not a description of consent software.

Question 9

What is a consent management platform?

Accepted Answer

A consent management platform is software a Data Fiduciary uses to request, record and honour consent for its own processing — presenting the notice, capturing the consent with its purpose and language, storing an auditable record, and propagating a withdrawal so processing actually stops. It is an operational tool, distinct from the statutory Consent Manager role defined in the Act.

Question 10

What makes consent valid under the DPDP Act?

Accepted Answer

Consent under the DPDP Act must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data necessary for the specified purpose. It must be requested with a notice the Data Principal can read in English or any language listed in the Eighth Schedule to the Constitution, and it must be as easy to withdraw as it was to give.

Question 11

What language must a DPDP notice be in?

Accepted Answer

A notice under the DPDP Act must be made available in English or in any language listed in the Eighth Schedule to the Constitution of India. In practice that means a Data Principal must be able to read the notice in a language they understand, which for much of India is not English.

Question 12

What is a Data Protection Impact Assessment (DPIA)?

Accepted Answer

A Data Protection Impact Assessment is a structured review of a processing activity that identifies the rights and risks involved for Data Principals and the measures taken to manage them. Under the DPDP Act it is one of the additional obligations attaching to Significant Data Fiduciaries, alongside appointing a Data Protection Officer and an independent data auditor.

Question 13

When does the DPDP Act apply?

Accepted Answer

The DPDP Act applies to the processing of digital personal data within India, and to processing outside India where it relates to offering goods or services to Data Principals in India. It covers personal data collected in digital form, and personal data collected in non-digital form that is subsequently digitised. It does not apply to personal data processed by an individual for purely personal or domestic purposes, or to personal data that a Data Principal has made publicly available themselves or that is required by law to be made public.

Question 14

Does the DPDP Act apply to startups and small businesses?

Accepted Answer

Yes. The DPDP Act does not exempt startups or small businesses from its core obligations — notice, valid consent, purpose limitation, security safeguards, breach reporting and data principal rights apply regardless of headcount or revenue. What does scale is the Significant Data Fiduciary regime, whose additional duties (a Data Protection Officer, DPIAs and independent audits) attach only where an organisation is notified as Significant.

Question 15

What are the penalties under the DPDP Act?

Accepted Answer

The DPDP Act provides for financial penalties imposed by the Data Protection Board of India after an inquiry, with the Schedule setting a maximum for each category of breach. The highest exposure attaches to failing to take reasonable security safeguards to prevent a personal data breach, at up to ₹250 crore. Failures relating to breach notification and to obligations concerning children's data sit in the next tier, with lower maxima for the additional obligations of Significant Data Fiduciaries and for other contraventions.

Question 16

What is the breach notification requirement under the DPDP Act?

Accepted Answer

Under the DPDP Act a Data Fiduciary that suffers a personal data breach must give intimation of it to the Data Protection Board of India and to each affected Data Principal, in the form and manner prescribed. The obligation is not conditional on the breach being judged severe, which is why organisations need a defined assessment and notification path rather than an ad hoc response.

Question 17

How long do we have to respond to a data principal request?

Accepted Answer

The DPDP Act and the DPDP Rules require Data Fiduciaries to respond to Data Principal requests within the prescribed period, and to publish a readily available means of making a request and of raising a grievance. Because the period runs from receipt, the practical requirement is an intake route that timestamps every request and a workflow that reaches every system holding the person's data.

Question 18

How much does DPDP compliance cost in India?

Accepted Answer

There is no single figure, and any vendor quoting one from a website is quoting a licence rather than the cost of becoming compliant. Cost is driven by how many systems hold personal data and how old they are, whether you are a Significant Data Fiduciary, your volume of data principal requests, how many processors are in scope, and whether you already run an ISO 27001 or GDPR programme and are therefore buying a delta.

Question 19

Does ISO 27001 or SOC 2 make us DPDP compliant?

Accepted Answer

No. ISO 27001 and SOC 2 assess whether security controls exist and operate. The DPDP Act asks a different set of questions: what personal data you hold, on what lawful basis you process it, who receives it, how long you keep it, and how individuals exercise their rights over it. Strong security is necessary for compliance and nowhere near sufficient for it.

Question 20

Where should we start with DPDP compliance?

Accepted Answer

Start with discovery. Every other obligation under the DPDP Act is defined against the personal data you actually hold, so an inventory that regenerates rather than a one-off spreadsheet is the prerequisite for making any later step defensible. Only once you know what you hold can you state purposes, record lawful bases, publish accurate notices and answer rights requests completely.

Question 21

What is the full form of DPDP?

Accepted Answer

DPDP stands for Digital Personal Data Protection. The Digital Personal Data Protection Act, 2023 is India's data protection law governing the processing of digital personal data, and it is supported by the Digital Personal Data Protection Rules, which set out the operational detail the Act leaves to be prescribed.

Question 22

Can a customer ask us to delete their data under the DPDP Act?

Accepted Answer

Yes — a Data Principal has the right to request erasure of their personal data. But erasure does not override an obligation to retain records for a purpose required by law. Where a statutory retention duty applies, such as KYC or transaction records in financial services, you may continue to hold that data, and you must be able to explain per record which basis applies and for how long.

Question 23

When did the DPDP Act come into force?

Accepted Answer

The Digital Personal Data Protection Act was passed in 2023, but it did not take effect all at once. Commencement was notified subsequently and its provisions come into force in phases, with the Digital Personal Data Protection Rules supplying the operational detail. The practical consequence is that different obligations become enforceable at different times rather than on a single switch-on date.

Question 24

Does the DPDP Act apply to companies outside India?

Accepted Answer

Yes, in defined circumstances. The DPDP Act applies to processing of digital personal data outside India where that processing relates to offering goods or services to Data Principals within India. Incorporation abroad and hosting data abroad do not put a business outside the Act if it is serving customers in India.

Question 25

Can we transfer personal data outside India under the DPDP Act?

Accepted Answer

The DPDP Act permits transfer of personal data outside India, subject to any restriction the Central Government may notify in respect of particular territories. It is a permissive regime with a power to restrict, rather than a general prohibition — but sector regulators such as the RBI may impose their own localisation requirements that continue to apply alongside it.

Question 26

What is verifiable parental consent under the DPDP Act?

Accepted Answer

Before processing the personal data of a child, a Data Fiduciary must obtain verifiable consent from the child's parent or lawful guardian. The Act also prohibits processing that is likely to cause any detrimental effect on a child's wellbeing, and restricts tracking, behavioural monitoring and targeted advertising directed at children.

Question 27

How long can we retain personal data under the DPDP Act?

Accepted Answer

Personal data should not be kept beyond the point at which the purpose it was collected for is served, unless retention is required for compliance with a law. Once the purpose is exhausted and no legal retention duty applies, the data — and copies held by processors — should be erased.

Question 28

Do we need consent to process employee data?

Accepted Answer

Generally no. The DPDP Act recognises certain legitimate uses for which personal data may be processed without consent, including purposes related to employment and to safeguarding an employer from loss or liability. Relying on consent for employment processing is usually the wrong choice, because consent must be freely given and an employee is rarely in a position to refuse.

Question 29

Is the DPDP Act the same as GDPR?

Accepted Answer

No. They share a family resemblance — notice, consent, individual rights, security obligations, breach reporting — but they are different statutes with different definitions, different lawful bases, different terminology and a different regulator. A GDPR programme gives you a substantial head start on DPDP; it does not discharge it.

Question 30

Who enforces the DPDP Act?

Accepted Answer

The Data Protection Board of India enforces the Act. It inquires into personal data breaches and complaints, may direct urgent remedial or mitigation measures, and can impose financial penalties in accordance with the Schedule. Its proceedings are digital by design, and its orders are appealable.

Question 31

Do we need a privacy policy under the DPDP Act?

Accepted Answer

The Act's specific requirement is a notice accompanying the request for consent, telling the Data Principal what personal data is sought, for what purpose, how to exercise their rights and how to complain. A published privacy policy is the normal way of making that information available, but a generic policy on its own does not satisfy the notice obligation if the person was never shown it at the point consent was taken.

Question 32

Does the DPDP Act cover B2B and business contact data?

Accepted Answer

Yes, in substance. The Act governs personal data — data about an identifiable individual — and a named employee's work email, direct line or job title identifies a person. There is no general carve-out for data collected in a business context, so B2B contact databases are within scope.

Question 33

What happens if we ignore a data principal request?

Accepted Answer

The Data Principal can escalate. Having used your grievance mechanism without a satisfactory response, they may complain to the Data Protection Board, which can inquire, direct remedial measures and impose financial penalties. Ignoring requests also removes your best mitigation, because the Board weighs whether the organisation acted responsibly.

Question 34

What is a consent artefact?

Accepted Answer

A consent artefact is a structured, machine-readable record of a single consent: who consented, to what purpose, over what data, for how long, against which version and language of the notice, and when. It is what turns a claim that consent was obtained into evidence that it was.

Question 35

What is the difference between a DPIA and a PIA?

Accepted Answer

In Indian practice a DPIA is the assessment contemplated by the DPDP Act as an obligation of Significant Data Fiduciaries, while PIA is the older, general term for any privacy impact assessment an organisation chooses to run. The substance — identifying risks to individuals from a processing activity and the measures managing them — is the same; the difference is whether it is a statutory duty or good practice.

Question 36

What is the grievance redressal timeframe under the DPDP Rules?

Accepted Answer

A Data Fiduciary must publish a readily available means for a Data Principal to raise a grievance and must respond within the period prescribed by the DPDP Rules. The grievance route is separate from, though often served by the same intake as, a rights request, and a Data Principal is generally expected to use it before approaching the Data Protection Board.

DPDP Act FAQ