Everything You Need to Know, Simplified

What is the Digital Personal Data Protection Act, 2023?

The DPDP Act, 2023 is India's principal law governing the processing of digital personal data. It establishes obligations for organisations processing personal data and rights for Data Principals.

Who is a Data Principal under the DPDP Act?

A Data Principal is the individual to whom the personal data relates. For a child, the term refers to the child's parent or lawful guardian in the circumstances specified by the Act.

Who is a Data Fiduciary?

A Data Fiduciary is the person or organisation that determines the purpose and means of processing personal data. Businesses generally become Data Fiduciaries when they decide why and how customer or employee data is processed.

What is a Data Processor under DPDP?

A Data Processor processes personal data on behalf of a Data Fiduciary. Examples can include cloud providers, payroll providers, CRM platforms and outsourced service providers.

What is personal data under DPDP?

Personal data means any data about an individual who is identifiable by or in relation to that data. The Act focuses on digital personal data and certain data that is digitised subsequently.

Does the DPDP Act apply only to Indian companies?

No. The Act can apply to processing outside India where such processing is connected with offering goods or services to Data Principals in India, subject to the Act's scope and conditions.

Does DPDP apply to employee data?

Employee-related processing can fall within the Act depending on the circumstances and applicable provisions. Organisations should assess the purpose, nature and legal basis of each processing activity rather than assuming employee data is automatically excluded.

Does DPDP apply to customer data?

Yes. Customer information that qualifies as digital personal data can fall within the DPDP framework. Businesses should identify what customer data they collect, why they process it, where it is stored and who receives it.

Does DPDP apply to offline data?

The DPDP Act primarily concerns digital personal data. Offline data that is not digitised is generally outside its immediate scope, although digitisation can bring the resulting data within the framework.

What is processing of personal data under DPDP?

Processing broadly covers operations performed on digital personal data, including collection, storage, use, sharing, disclosure and other handling activities.

What is a Significant Data Fiduciary?

A Significant Data Fiduciary is a Data Fiduciary notified by the Central Government based on specified factors. Such entities have additional obligations under the Act.

Does every business need a Data Protection Officer?

Not necessarily. Additional DPO-related obligations apply to Significant Data Fiduciaries. Other organisations should nevertheless establish appropriate responsibility and accountability for privacy compliance.

What is a Consent Manager?

A Consent Manager is a registered entity that enables Data Principals to give, manage, review and withdraw consent through an interoperable platform, subject to the applicable Rules.

What is the Data Protection Board of India?

The Data Protection Board is the statutory body established under the DPDP framework to perform functions including dealing with certain breaches and exercising powers assigned under the Act.

What are the penalties under DPDP?

The Act provides for significant financial penalties for specified breaches. The amount depends on the nature of the breach and the relevant provision in the Schedule.

What problem does the DPDP Act seek to address?

The DPDP Act, 2023 establishes a legal framework for processing digital personal data in India. It seeks to balance an individual's right to protect personal data with the legitimate need of organisations to process data for lawful purposes. It places obligations on Data Fiduciaries and gives Data Principals defined rights and duties. The Act also establishes the Data Protection Board of India and provides a framework for penalties and enforcement.

Why was a separate data protection law needed in India?

India's digital economy has expanded significantly, increasing the volume of personal data collected and processed by organisations. The DPDP Act provides a dedicated statutory framework governing digital personal data processing, including consent, legitimate uses, security safeguards, individual rights, breach-related obligations and accountability. It replaces reliance on a fragmented set of provisions with a dedicated data protection framework.

Is the entire DPDP Act currently in force?

No. The Act has a phased commencement. The notification issued on 13 November 2025 brought certain provisions into force immediately, another set after one year, and the majority of substantive provisions after 18 months. Therefore, organisations should not assume that every obligation in the Act is already enforceable simply because the Act has been enacted.

What is the difference between enactment and commencement of the DPDP Act?

Enactment means the legislation has been formally passed and received assent.
Commencement means a particular provision has legally come into operation. The DPDP Act was enacted in 2023, but the Government's November 2025 notification introduced its provisions in phases. This distinction is important when determining which statutory obligations currently apply to an organisation.

Which provisions of the DPDP Act came into force first?

The November 2025 commencement notification brought provisions including Section 2, Sections 18–26, Section 35, Sections 38–43, and specified provisions of Section 44 into force immediately. Section 6(9) and Section 27(1)(d) were scheduled for commencement after one year, while most substantive obligations were scheduled for commencement after 18 months.

When will the main operational provisions of the DPDP Act come into force?

Under the November 2025 notification, the major substantive provisions—including Sections 3–5, most of Section 6, Sections 7–10, Sections 11–17 and several enforcement-related provisions—are scheduled to come into force 18 months after 13 November 2025. Organisations should therefore use the phased timeline rather than treating the entire Act as immediately operational.

Does the DPDP Act apply only to companies?

No. The Act applies to the processing of digital personal data by Data Fiduciaries and other covered entities according to its scope. The relevant question is not simply whether an organisation is incorporated as a company, but whether its activities fall within the Act's application provisions. Government bodies, businesses and other organisations may therefore need to assess applicability based on their processing activities.

Does the DPDP Act apply to startups?

There is no general blanket exemption for startups merely because they are startups. A startup should assess whether it processes digital personal data within the Act's scope and identify its responsibilities based on its role as a Data Fiduciary or other relevant entity. Size alone should not be treated as a reason to ignore data protection obligations.

Does the DPDP Act apply to MSMEs?

The Act does not create a general exemption for MSMEs simply because of their size. An MSME processing digital personal data should assess its applicability and obligations. However, the Act distinguishes certain categories of organisations and may prescribe additional obligations for entities designated as Significant Data Fiduciaries. Therefore, compliance should be proportionate to the organisation's actual data-processing activities and applicable legal requirements.

Does the DPDP Act apply to foreign companies?

Potentially, yes. The Act can apply to processing of digital personal data outside India when such processing is connected with offering goods or services to Data Principals within India, subject to the Act's scope and applicable provisions. A foreign organisation should therefore assess Indian customer, user and employee data flows rather than assuming that incorporation outside India removes DPDP obligations.

Does an Indian company have to follow the DPDP Act when processing data outside India?

Potentially. The Act's application is determined by its statutory scope rather than simply by where a server or processing activity is physically located. Indian organisations should map their processing activities, Data Principals, processors and cross-border flows to determine which DPDP obligations apply. The Act also contains specific provisions concerning processing of personal data outside India.

What exactly counts as digital personal data under the DPDP Act?

Digital personal data means personal data in digital form. The Act's framework focuses on information relating to an identifiable individual when that information is processed digitally. This can include information collected directly online as well as personal data that is subsequently digitised, subject to the Act's scope and exclusions.

Does the DPDP Act cover paper records?

The DPDP Act primarily addresses digital personal data. Purely offline personal data that has never been digitised generally falls outside the Act's core scope. However, once personal data is digitised and brought within the Act's application, organisations should assess whether the resulting processing is covered. Other laws may independently regulate physical records.

Is publicly available personal information automatically outside the DPDP Act?

Not necessarily in every situation. The Act contains specific provisions concerning personal data made publicly available by the Data Principal or another person under specified circumstances. Organisations should therefore examine the source and manner in which information became publicly available rather than assuming that anything found online can automatically be processed without considering data protection requirements.

Is a person's phone number personal data under the DPDP Act?

Generally, a phone number can constitute personal data when it relates to or can identify an individual. Whether processing it is permitted depends on the applicable legal basis, purpose and other requirements of the DPDP framework. Organisations should not treat commonly available identifiers such as phone numbers as automatically outside data protection obligations.

Is an email address considered personal data?

An email address can be personal data when it relates to an identifiable individual. For example, a named employee or customer's email address would generally warrant personal-data treatment. Organisations should assess how the address is used, who it relates to and whether the processing falls within the DPDP Act's scope.

Is an IP address covered as personal data?

An IP address may constitute personal data depending on whether it relates to an identifiable individual. Organisations should therefore avoid assuming that technical identifiers are automatically outside privacy obligations. The appropriate assessment should consider whether the information relates to an identifiable Data Principal and how it is processed.

Are photographs covered by the DPDP Act?

A photograph can constitute personal data when it relates to an identifiable individual and is processed digitally within the Act's scope. Organisations using photographs for websites, employee records, identification, marketing, events or other purposes should determine the applicable processing basis and obligations rather than treating photographs as ordinary non-personal content.

Are biometric identifiers covered by the DPDP Act?

Biometric information relating to an identifiable individual can constitute personal data under the Act. The DPDP Act does not create a separate general category equivalent to the GDPR's "special categories" terminology. However, organisations processing biometric information should conduct a careful risk and legal assessment because of the sensitivity and potential consequences associated with such processing.

Is financial information covered by the DPDP Act?

Financial information relating to an identifiable individual can fall within the concept of personal data when processed digitally and within the Act's scope. Examples may include information associated with customers, employees or account holders. Organisations should determine the applicable processing basis and also consider sector-specific laws that may impose additional requirements.

Is employee information covered by the DPDP Act?

Yes, employee information can constitute digital personal data. Examples include contact details, identification information, payroll information, attendance records and other information relating to employees. Employers should assess the purpose and legal basis for processing employee data and apply appropriate governance, security and lifecycle controls.

Is customer information covered by the DPDP Act?

Yes, customer information can be personal data when it relates to an identifiable individual. Organisations may process customer data for various legitimate business purposes, but the processing still needs to fall within an applicable ground under the DPDP framework and comply with relevant obligations once those provisions become applicable.

Can a company be a Data Principal?

Generally, no. The DPDP Act defines a Data Principal in relation to an individual to whom personal data relates. Organisations can instead have roles such as Data Fiduciary or Data Processor depending on how they determine or perform processing activities.

Can the same organisation be both a Data Fiduciary and Data Processor?

Yes, depending on the processing activity. An organisation can determine the purposes and means of one processing activity and therefore act as a Data Fiduciary, while processing another organisation's data according to that organisation's instructions and therefore acting as a Data Processor. Role classification should be performed activity by activity.

Does every large company automatically become a Significant Data Fiduciary?

No. Size alone does not automatically make an organisation an SDF. The Act provides criteria that the Central Government may consider when notifying a Data Fiduciary as significant. Organisations should therefore distinguish between being a large enterprise and being formally designated as a Significant Data Fiduciary.

What additional responsibilities can apply to Significant Data Fiduciaries?

The DPDP Act provides additional obligations for SDFs, including appointing a Data Protection Officer based in India, appointing an independent data auditor, conducting periodic audits and undertaking specified assessments. The detailed operational framework is supplemented by the Rules. These requirements are intended to impose stronger accountability on entities presenting greater data-protection risks.

What is the Data Protection Board of India?

The Data Protection Board of India is the statutory body established under the DPDP framework. The Act provides for its establishment, composition, proceedings, powers and functions. Among other responsibilities, the Board is intended to perform regulatory and enforcement functions under the Act.

Can an individual complain about a data protection violation?

The DPDP framework provides a grievance-redressal mechanism for Data Principals and establishes the Data Protection Board as the statutory authority for specified matters. Organisations should therefore maintain an appropriate internal grievance mechanism and processes for responding to Data Principal complaints in accordance with applicable provisions and Rules.

Does the DPDP Act require consent for every type of processing?

No. Consent is one ground for processing, but the Act also provides for certain legitimate uses. Organisations should therefore identify the applicable processing ground rather than assuming that every activity must always be supported by consent. The precise requirements depend on the purpose and circumstances of processing.

What are legitimate uses under the DPDP Act?

The Act identifies circumstances in which personal data may be processed for specified legitimate uses without relying on consent. These include defined situations such as voluntary provision of data for a specified purpose and certain statutory, governmental, employment and other circumstances identified by the Act. Organisations should map each processing activity to the applicable statutory provision rather than broadly labelling processing as a "legitimate use."

Can a business process personal data without obtaining consent?

Potentially, yes. Consent is not the only processing ground under the DPDP Act. Section 7 identifies certain legitimate uses in which processing may take place without consent. Whether a particular activity qualifies depends on the facts and the applicable statutory conditions. Organisations should document the legal basis for processing rather than assuming consent is either always required or never required.

Does the DPDP Act replace all other privacy laws in India?

No. The DPDP Act is a major general framework for digital personal data, but organisations may also be subject to sector-specific legislation, contractual requirements, cybersecurity requirements and other applicable laws. DPDP compliance should therefore be assessed as part of the organisation's broader legal and regulatory environment.

Is DPDP compliance the same as cybersecurity compliance?

No. There is significant overlap, particularly around security safeguards, but the two are not identical. Cybersecurity focuses primarily on protecting systems, networks and information from threats, while data protection also addresses lawful processing, notice, consent, Data Principal rights, governance and accountability. An organisation can have strong cybersecurity controls and still have privacy compliance gaps.

Is DPDP compliance the same as GDPR compliance?

No. Both frameworks regulate personal-data processing, but they differ in scope, terminology, rights, lawful grounds, obligations and regulatory structures. Organisations operating internationally may use GDPR controls as a foundation, but they should perform a specific DPDP assessment rather than assuming GDPR compliance automatically equals DPDP compliance.

Does DPDP apply only to data collected through websites?

No. The framework is not limited to websites. Digital personal data may be processed through mobile applications, enterprise systems, CRM platforms, HR systems, cloud services, APIs, customer-support systems, databases and other digital environments. Organisations should therefore assess their complete data-processing ecosystem rather than focusing solely on their public website.

Does DPDP apply to mobile applications?

Potentially, yes. Mobile applications can collect and process substantial amounts of digital personal data. Organisations operating apps should identify what data is collected, why it is processed, the applicable processing ground, third-party recipients, retention practices and mechanisms available to Data Principals. Website and app compliance should therefore be assessed separately where their data flows differ.

Does DPDP apply to SaaS companies?

Potentially, yes. A SaaS company may act as a Data Fiduciary for information it determines how to process and as a Data Processor for customer-controlled data. Its role should be determined based on the actual processing arrangement. SaaS providers should therefore map data flows, contractual roles, processing purposes, subprocessors and security responsibilities.

Does DPDP apply to cloud-hosted personal data?

Potentially, yes. Storing personal data with a cloud provider does not automatically take the processing outside the DPDP framework. Organisations should identify whether the cloud provider acts as a Data Processor, understand where and how the data is processed, and establish appropriate contractual and security controls.

What are the DPDP Rules 2025?

The DPDP Rules, 2025 provide detailed operational requirements for implementing the Digital Personal Data Protection Act, 2023. They were notified by MeitY on 14 November 2025.

Are the DPDP Rules 2025 final?

Yes. The Rules notified on 14 November 2025 are the final Rules. Earlier draft Rules should not be treated as the current legal position.

When do the DPDP Rules 2025 take effect?

The Rules have a phased commencement structure. Certain provisions take effect on publication, while specified provisions take effect after the prescribed transition period. Organisations should therefore check the applicable commencement provision before assessing a current obligation.

What does the DPDP Rules say about privacy notices?

The Rules require notices to be clear, standalone and understandable, including information about the personal data being processed, purpose and mechanisms for exercising rights and withdrawing consent.

What do the Rules require for consent withdrawal?

The framework requires mechanisms that allow Data Principals to withdraw consent through accessible means. The Rules also require notices to explain how consent can be withdrawn and rights exercised.

What do the DPDP Rules say about security safeguards?

The Rules prescribe reasonable security safeguards and organisational and technical measures intended to protect personal data from specified risks.

What do the Rules say about personal data breaches?

The Rules establish requirements concerning intimation of personal-data breaches, including communications to affected Data Principals and the Board in specified circumstances.

Do the Rules apply differently to children?

Yes. The Rules provide additional requirements concerning processing of children's personal data and verification of consent from parents or lawful guardians in applicable circumstances.

What do the Rules say about Consent Managers?

The Rules establish requirements for registration, operation, security, interoperability, record keeping and governance of Consent Managers.

Can organisations still rely on the draft DPDP Rules?

No. The final Rules should be the primary reference for current compliance planning. Draft Rules may be useful for understanding the consultation history but should not be presented as the operative framework.

Where can businesses find the official DPDP Rules?

The official Rules are available through MeitY's website and India Code. Businesses should rely on the notified text rather than unofficial summaries.

How can a company start DPDP compliance?

Start by identifying personal data, processing activities, purposes, Data Fiduciaries, processors, systems and data flows. Then assess gaps against applicable obligations and create a prioritised remediation plan.

Does every business need a DPDP compliance policy?

A written privacy and data-governance framework is a practical way to establish accountability and consistent processes. The exact documents required should depend on the organisation's processing activities and applicable obligations.

Is having a privacy policy enough for DPDP compliance?

No. A privacy notice is only one component. Compliance also involves governance, consent or other applicable processing grounds, security, rights handling, processor management, retention and evidence.

How long does DPDP compliance take?

There is no universal timeline. Complexity depends on data volume, systems, vendors, industry, processing activities and existing controls. A structured gap assessment can establish a realistic implementation roadmap.

Does a small business need DPDP compliance?

Businesses should assess whether and how the Act applies to their processing. Small size does not automatically mean that personal-data obligations can be ignored.

What documents should a business maintain for DPDP compliance?

Depending on the organisation, documentation can include privacy notices, consent records, data inventories, processing records, contracts, retention policies, breach procedures, rights-request records and security evidence.

What is a DPDP compliance gap assessment?

It is a structured review comparing an organisation's current data practices, controls and documentation against applicable DPDP requirements.

Can DPDP compliance be automated?

Some activities can be supported by technology, including data discovery, consent management, cookie scanning, rights requests and compliance monitoring. Technology does not replace governance or accountability.

How often should DPDP compliance be reviewed?

Organisations should establish periodic reviews and reassess compliance when there are material changes to products, systems, vendors, regulations or processing activities.

Should DPDP compliance be integrated with cybersecurity?

Yes. Privacy and cybersecurity are different disciplines but overlap significantly in areas such as access control, data security, incident response and protection of personal data.

What is a DPDP data inventory?

A data inventory identifies what personal data an organisation processes, where it resides, why it is processed, who accesses it and which third parties receive it.

Why is data mapping important for DPDP?

Data mapping helps organisations understand how personal data moves across applications, departments, vendors and locations. Without visibility, organisations may struggle to implement retention, security and rights processes effectively.

Should Excel files be included in a data inventory?

Yes, if they contain digital personal data. Spreadsheets are often overlooked repositories and should be considered during data discovery and classification.

Should email systems be included in data discovery?

Yes. Emails and attachments can contain substantial amounts of personal data. Organisations should consider appropriate discovery, retention and access controls.

How should businesses identify unnecessary personal data?

Review each category of data against its purpose, business need, legal requirements and retention requirements. Data without a continuing legitimate purpose should be evaluated for deletion or appropriate handling.

What is data minimisation under DPDP?

Data minimisation means avoiding unnecessary collection or processing of personal data. Organisations should assess whether every data field collected is genuinely necessary for the stated purpose.

How should businesses handle duplicate personal data?

Identify where duplicate records exist, determine the authoritative source and establish appropriate synchronisation, correction and deletion processes.

What should happen to personal data in legacy systems?

Legacy data should be identified, assessed for ongoing necessity and handled according to applicable retention, security and deletion requirements.

Should personal data in backups be deleted?

Backup handling requires a risk-based and technically informed approach. Organisations should establish retention, restoration and deletion procedures that address personal data contained in backup environments.

Who should own the company's data inventory?

Ownership should be clearly assigned. Depending on the organisation, responsibility may sit with privacy, compliance, security, IT, data governance or a coordinated cross-functional team.

Can a customer withdraw consent under DPDP?

Yes, where processing is based on consent, the Data Principal has the right to withdraw consent, subject to the framework's provisions and consequences.

Does withdrawal of consent have to be as easy as giving consent?

Yes. The Act requires withdrawal to be as easy as giving consent. The Rules also require notices to explain how consent can be withdrawn.

What happens after consent is withdrawn?

Where processing depends on consent, the Data Fiduciary must cease processing within a reasonable time unless processing is otherwise authorised or required under the Act or another applicable law.

Does withdrawing consent make previous processing unlawful?

No. Withdrawal generally does not affect the legality of processing that occurred before withdrawal.

What if a customer says they never gave consent?

The organisation should review its consent records, notice, collection mechanism and evidence. Where the organisation cannot establish the relevant basis for processing, it should assess the appropriate remediation.

Can a business continue processing after consent is withdrawn?

Potentially, if another lawful basis or legal requirement permits or requires the processing. The organisation should identify and document the applicable basis rather than assuming consent is the only possible basis.

What should a business do if consent records are missing?

Investigate whether evidence exists elsewhere, assess the relevant processing basis and remediate the affected process. Consent should not simply be assumed because data was collected in the past.

Can consent records be stored in Excel?

Technically they can, but organisations should ensure that records are accurate, secure, traceable and sufficient to demonstrate the relevant consent and its history.

Can a Data Principal request correction of personal data?

Yes. The Act provides rights concerning correction and updating of personal data, subject to applicable provisions and procedures.

Can a Data Principal request deletion of personal data?

Yes, subject to the Act and applicable legal requirements. Businesses should assess the request against their continuing obligations and processing purposes.

Can someone exercise Data Principal rights through an authorised person?

The Act provides mechanisms for exercising rights through an authorised person in specified circumstances. Organisations should verify the authority and follow their documented rights-handling process.

How should a business handle a Data Principal request involving several systems?

Establish a central request-management process, identify relevant systems and processors, verify the requester and coordinate the response across responsible teams.

How quickly should a Data Principal request be handled?

Organisations should follow the applicable requirements under the Act and Rules and establish internal service timelines that allow sufficient time for verification, investigation and response.

What is a personal data breach under DPDP?

"Personal Data Breach" means any unauthorized processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data.

What should I do if personal data is sent to the wrong person?

Contain the incident, determine what data was disclosed, identify the recipient, assess the risk and follow the organisation's breach-response and notification procedures.

What if an employee accidentally shares customer data?

Treat it as a potential security incident, investigate the scope, contain further disclosure, preserve evidence and assess whether the incident meets the applicable personal-data breach requirements.

What if a customer database is exposed online?

Immediately restrict access, preserve evidence, investigate the exposure, identify affected data and individuals, assess the incident and follow applicable breach-intimation requirements.

What if a breach is discovered several days later?

The organisation should begin response immediately upon discovery. It should document when the incident occurred, when it was detected and what actions were taken.

Is every cybersecurity incident a DPDP breach?

No. A cybersecurity incident becomes relevant to DPDP when it involves personal data and falls within the applicable breach framework. Proper incident classification is therefore important.

What if a laptop containing personal data is lost?

Assess whether personal data was stored on the device, whether it was encrypted or otherwise protected, whether remote controls are available and whether the incident triggers breach-response obligations.

What security measures should businesses implement for personal data?

Appropriate measures may include access controls, authentication, encryption where appropriate, logging, monitoring, backups, vulnerability management, secure development and incident-response processes.

Should DPDP breach response be part of the cyber incident-response plan?

Yes. Organisations should integrate privacy considerations into incident response so that personal-data exposure can be identified, assessed and escalated quickly.

What evidence should be maintained after a personal data breach?

Maintain relevant incident timelines, investigation records, affected-data analysis, containment actions, communications, remediation and decision records consistent with applicable requirements and internal policies.

Who should be responsible for DPDP compliance?

Responsibility should be formally assigned rather than left to one department by default. Privacy, legal, compliance, security, IT, HR and business teams may all have defined responsibilities.

Does an SME need a dedicated privacy team?

Not necessarily. SMEs can allocate privacy responsibilities across existing teams or appoint external expertise, provided accountability and operational ownership are clear.

What is a DPDP compliance audit?

A DPDP compliance audit evaluates whether an organisation's data practices, controls and documentation align with applicable legal and internal requirements.

How often should DPDP audits be conducted?

Frequency should depend on risk, processing volume, regulatory obligations, business changes and the organisation's governance framework.

What evidence should a company maintain for DPDP compliance?

Evidence can include consent records, notices, data inventories, contracts, security assessments, training records, rights-request logs, breach records and audit reports.

Can ISO 27001 help with DPDP compliance?

Yes. ISO 27001 can provide a structured information-security management framework that supports several DPDP security and governance objectives. It does not, however, automatically establish DPDP compliance.

Can SOC 2 compliance help with DPDP?

SOC 2 controls can support privacy and security governance, but SOC 2 and DPDP address different frameworks and should not be treated as equivalent certifications.

What should management review for DPDP compliance?

Management should review major processing activities, compliance gaps, risks, incidents, rights requests, vendor issues, audit findings and remediation progress.

What happens if a company ignores DPDP requirements?

Non-compliance can create legal, financial, operational and reputational risks, including penalties for specified breaches. Organisations should therefore assess and address applicable obligations proactively.

Is a vendor processing customer data a Data Processor?

It may be, if it processes personal data on behalf of the Data Fiduciary. The exact relationship should be assessed based on the parties' roles and processing activities.

Should businesses have a data-processing agreement with vendors?

A suitable contractual framework is an important governance mechanism for defining responsibilities, security, processing instructions, confidentiality, incident handling and other relevant requirements.

What if a vendor refuses to sign a data-processing agreement?

Assess the vendor's role and risk. If adequate contractual safeguards cannot be established, the organisation should consider whether the processing arrangement can safely and appropriately continue.

What is a sub-processor?

A sub-processor is generally a third party engaged by a Data Processor to process personal data in connection with services provided to the Data Fiduciary.

Should businesses assess sub-processors?

Yes. Organisations should understand material third-party data flows and establish appropriate contractual and governance controls for relevant processing arrangements.

What if a vendor suffers a data breach?

The Data Fiduciary should coordinate with the vendor, establish the scope and impact, contain the incident and assess applicable notification and remediation obligations.

What if a vendor retains personal data after the contract ends?

Review the contract, purpose and applicable retention requirements, then require appropriate deletion, return or continued protection according to the applicable framework.

Should SaaS vendors be assessed for DPDP compliance?

Yes. SaaS platforms may process significant amounts of personal data, so organisations should assess data location, processing, security, subprocessors, retention and contractual protections.

Can a company use cloud providers to process personal data?

Cloud providers can process personal data, subject to the organisation's applicable legal obligations and appropriate security, governance and contractual controls.

Can vendors process personal data outside India?

Cross-border processing must be assessed against the DPDP Act, Rules and applicable restrictions or requirements. Businesses should not assume that location alone determines legality.

Can employees upload customer data to ChatGPT?

Organisations should not permit employees to upload personal data to external AI tools without assessing the purpose, legal basis, vendor terms, security, data handling and organisational controls.

What is Shadow AI in a DPDP context?

Shadow AI refers to employees using AI tools without formal organisational approval or oversight. It can create privacy, security, data-transfer and governance risks.

Can personal data be used to train AI models?

It depends on the processing purpose, legal basis, applicable obligations and how the model and data are handled. Organisations should conduct a specific privacy assessment rather than assume training is permitted.

Can AI agents access customer personal data?

They can technically be designed to access data, but organisations should control access according to purpose, necessity, authorisation, security and applicable DPDP obligations.

What if an AI vendor cannot explain where personal data is stored?

Treat the lack of transparency as a vendor-risk issue. Obtain sufficient information to assess processing, security, data flows, retention and applicable legal requirements before approving the use case.

Can customer data be entered into AI-powered CRM tools?

Potentially, but the organisation should assess the CRM provider's processing activities, AI functionality, security, retention, third parties and applicable legal requirements.

Can production customer data be used for software testing?

Organisations should carefully assess whether production personal data is necessary. Where possible, synthetic, anonymised or appropriately de-identified test data may reduce privacy risk.

Are cookies covered under DPDP?

Cookies themselves are technology rather than automatically personal data. The relevant question is whether the information collected through them constitutes personal data and how it is processed.

Do analytics tools create DPDP obligations?

They can, depending on the data collected and how the tool processes or transfers it. Organisations should assess analytics configurations, identifiers, purposes and third-party processing.

Is a cookie banner enough for DPDP compliance?

No. A banner is only one component of a broader consent and website-data governance process. Organisations should assess notices, consent mechanisms, cookies, trackers and actual data flows.

Can website forms collect personal data before consent?

Businesses should assess the applicable processing basis and ensure their collection mechanism, notice and consent process are aligned with the DPDP framework.

Can WhatsApp be used to share customer personal data?

Organisations should assess whether the sharing is necessary, authorised, secure and consistent with their data-processing practices, contractual requirements and applicable DPDP obligations.