Question 1

What is DPDPA?

Accepted Answer

The Digital Personal Data Protection Act (DPDPA) 2023 is India's comprehensive law governing how organisations collect, store, process, and share personal data of individuals. It was enacted on August 11, 2023, and is supplemented by the DPDP Rules, 2025.

Question 2

When does DPDPA come into full effect?

Accepted Answer

The Act was enacted in 2023. The DPDP Rules, 2025 were notified in April 2025. Most remaining obligations under the Rules come into effect 18 months after the Rules' publication — estimated around October 2026.

Question 3

Does DPDPA apply to my foreign company?

Accepted Answer

Yes, if you process digital personal data of individuals in India — or offer goods or services to people in India — DPDPA applies regardless of where you are incorporated.

Question 4

How is DPDPA different from GDPR?

Accepted Answer

DPDPA uses consent as the primary legal basis (no 'legitimate interest' catch-all), imposes fixed maximum penalties up to ₹250 crore (not turnover-based), introduces a unique right to nominate, and creates a digital-first Data Protection Board. The Act is shorter and more principles-based, with details left to Rules.

Question 5

What is a Data Principal under DPDPA?

Accepted Answer

A Data Principal is the individual whose personal data is being processed. For children (under 18), the parent or guardian acts as the Data Principal.

Question 6

What is a Data Fiduciary under DPDPA?

Accepted Answer

A Data Fiduciary is any person or entity — company, organisation, or government body — that determines the purpose and means of processing personal data. Most businesses that collect customer or employee data are Data Fiduciaries.

Question 7

What is a Significant Data Fiduciary (SDF)?

Accepted Answer

An SDF is a Data Fiduciary notified by the Central Government based on factors like volume of data, sensitivity, risk to Data Principals, national security implications, or impact on sovereignty. SDFs have additional obligations including appointing a DPO and conducting DPIAs.

Question 8

What is the Data Protection Board of India?

Accepted Answer

The Data Protection Board of India (DPBI) is the regulatory authority established under DPDPA. It adjudicates complaints, investigates data breaches, and imposes penalties. It operates as a digital-first body — hearings and proceedings are conducted online.

Question 9

What type of consent does DPDPA require?

Accepted Answer

DPDPA requires consent that is free, specific, informed, unconditional, and unambiguous. Pre-ticked checkboxes, bundled consent, or consent buried in terms and conditions are not valid. Consent must be a clear, affirmative action by the Data Principal.

Question 10

Can consent be withdrawn under DPDPA?

Accepted Answer

Yes. Data Principals can withdraw consent at any time. Withdrawal must be as easy as giving consent. Processing done lawfully before withdrawal remains valid, but the Data Fiduciary must stop processing after withdrawal.

Question 11

What is a Consent Manager under DPDPA?

Accepted Answer

A Consent Manager is a registered entity that provides a platform for Data Principals to give, manage, review, and withdraw consent across multiple Data Fiduciaries through a single interface. Consent Managers must be registered with the Data Protection Board.

Question 12

Do I need consent for processing employee data?

Accepted Answer

Not necessarily. Section 7 permits processing without consent for employment-related purposes such as background verification, payroll, or compliance with labour laws. The processing must still be lawful and proportionate.

Question 13

What rights do individuals have under DPDPA?

Accepted Answer

Data Principals have four key rights: (1) Right to Access, (2) Right to Correction and Erasure, (3) Right to Grievance Redressal, and (4) Right to Nominate a representative.

Question 14

How quickly must a Data Fiduciary respond to a Data Principal's request?

Accepted Answer

The DPDP Rules specify response timelines. For most requests, the Rules prescribe a reasonable timeframe (details confirmed in the final notified rules).

Question 15

What is the Right to Nominate under DPDPA?

Accepted Answer

A unique right under India's DPDPA that allows individuals to nominate another person to exercise their data rights in the event of their death or incapacity. This is not found in GDPR or most other data protection laws.

Question 16

How does DPDPA handle children's data?

Accepted Answer

Before processing any personal data of a child (under 18), a Fiduciary must obtain verifiable parental consent, must not engage in behavioural tracking or targeted advertising directed at children, and must not process data in a manner detrimental to the child.

Question 17

What counts as 'verifiable parental consent'?

Accepted Answer

The DPDP Rules provide mechanisms for verifying parental consent, expected to involve digital verification methods. The exact standards are defined in the Rule provisions covering children's data.

Question 18

What are the penalties for violating DPDPA?

Accepted Answer

Penalties range from ₹50 crore to ₹250 crore depending on the violation. The highest penalty — ₹250 crore — applies to failure to take reasonable security safeguards to prevent a breach. Penalties for children's data breaches can reach ₹200 crore.

Question 19

Are DPDPA penalties per incident or annual?

Accepted Answer

Penalties under DPDPA are per violation, imposed by the Data Protection Board following an inquiry. They are not calculated as a percentage of annual turnover like GDPR.

Question 20

Can a company face multiple penalties for the same breach?

Accepted Answer

The Data Protection Board has discretion to determine penalties based on nature and severity. Multiple violations in a single incident could theoretically attract separate penalties.

Question 21

What is a Record of Processing Activities (RoPA) and do I need one?

Accepted Answer

A RoPA is a documented inventory of all personal data processing activities — including data types, purposes, retention periods, and third parties involved. The Act requires maintaining such records; the DPDP Rules specify the exact format.

Question 22

Does DPDPA require a Data Protection Officer (DPO)?

Accepted Answer

A DPO is mandatory only for Significant Data Fiduciaries notified by the Central Government. However, all organisations are expected to have a point of contact for Data Principals to address grievances.

Question 23

What is a Data Protection Impact Assessment (DPIA)?

Accepted Answer

A DPIA is a process to identify and mitigate privacy risks in a new project or processing activity. DPIAs are mandatory for SDFs under DPDPA. Non-SDFs are encouraged to conduct them for high-risk processing.

Question 24

How should I notify users of a data breach?

Accepted Answer

Fiduciaries must notify the Data Protection Board and affected Data Principals in a manner prescribed by the Rules. The notification must describe the nature of the breach and steps taken to address it.

Question 25

Does DPDPA restrict cross-border data transfers?

Accepted Answer

The Act allows transfer of personal data outside India, but the Central Government may restrict transfers to certain countries by notification. The list has not yet been published; monitor MeitY notifications.

Question 26

What is the difference between a Data Fiduciary and a Data Processor under DPDPA?

Accepted Answer

A Data Fiduciary decides why and how personal data is processed and carries primary legal responsibility. A Data Processor processes data on behalf of a Fiduciary, under their instructions. Fiduciaries are responsible for ensuring their Processors comply.

Question 27

Are startups exempt from DPDPA?

Accepted Answer

The Act gives the Central Government power to exempt certain classes of Fiduciaries (including potentially startups) from specific provisions. No startup exemption has been formally notified yet — assume full applicability until exemptions are announced.

Question 28

What is the DPDP Rules, 2025?

Accepted Answer

The DPDP Rules, 2025 (Digital Personal Data Protection Rules, 2025) were notified by MeitY and provide detailed procedures for implementing the DPDPA — covering consent notices, Consent Managers, children's data, Data Principal rights, and breach notifications.