DPDP Control Guide: 20 Domains From Collection to Deletion

DPDP Compliance Reference

What the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 require, in plain words: how to follow each provision, who owns it, how to audit it and which tools close the gaps.

This guide turns the DPDP audit checklist into 20 control domains, in the order data moves through a company: governance and collection, processing and sharing, security and breach response, retention and deletion, and proof. Each domain says why it matters, what to implement, what evidence an auditor will ask for, and what the CIO and the CISO each do. A Significant Data Fiduciary (SDF) is a company the Government notifies for extra duties because of the volume and sensitivity of the data it handles.

Rate every domain as not in place, partly in place, defined and working, or evidenced and tested. Count a domain as compliant only when you can produce the evidence listed on its card.

StatutoryThe Act or Rules state the dutyPart statutoryCore duty stated, practices addedSDF onlyApplies if notifiedGood practiceNot stated, makes other duties achievable

Where to start

Work in this order. Each step builds on the one before and follows the penalty exposure: security failures carry up to ₹250 crore, and breach notice and children’s data up to ₹200 crore each.

1. Build the inventory.Every other control depends on knowing what personal data you hold, where it sits and who uses it.Domains 1, 2
2. Secure the data and prepare for a breach.These carry the highest penalties, and the breach clock starts when you become aware.Domains 11, 12
3. Bring processors under control.A vendor’s failure is your failure under the Act.Domain 9
4. Fix lawful basis, notice, consent and processing.Make every use of data traceable to a reason, a notice and a record.Domains 3, 4, 5, 6
5. Automate rights, grievances and deletion.Manual handling breaks down as request volumes grow.Domains 8, 13, 18
6. Cover the exposures that apply to you.Children’s data, overseas transfers, and algorithms if you may be notified as an SDF.Domains 7, 10, 15
7. Prove it and keep it running.Build privacy into delivery, keep evidence, train people and monitor.Domains 14, 16, 17, 19, 20

Domain detail

“Lead” names who leads delivery of the technical and operational work. The accountable owner for each activity follows the RACI matrix further down this page. Use the filter to see the domains each role leads.All 20CIO leads (8)CISO leads (4)Privacy, Legal or business leads (8)1

Governance and accountability

Part statutorys. 8(1), 8(9) · Rule 9Lead: DPO and executive sponsor

The Data Fiduciary is responsible for complying with the Act, including for data its processors handle. A named owner, written policies and board visibility show that responsibility is real.

Controls to implement

• Run a DPDP programme with a charter, budget, owner and steering committee.
• Keep a policy suite (privacy, consent, retention, breach, vendor, AI use) with standards and SOPs mapped to the Act and Rules.
• Define roles with the RACI matrix and publish a privacy contact (Rule 9).
• Appoint a Data Protection Officer if you may be notified as an SDF. The DPO must be based in India. Otherwise a senior privacy lead does the job.
• Report to the board each quarter: top risks, open gaps, incidents and request volumes.

Evidence to keep

Programme charter, approved policies with version history, RACI, committee minutes, board packs.CIOSponsors the technical workstreams and names a data owner for every system.CISOOwns the security policy set and supplies the security metrics for the board report.2

Personal data inventory

Good practiceFoundation for ss. 5, 8, 11–13Lead: CIO

You cannot protect, delete or give people access to data you cannot find. Every later control depends on an accurate inventory.

Controls to implement

• Find personal data in databases, files, email, logs, backups, SaaS tools and employee devices.
• Keep a processing register: data category, purpose, source, lawful basis, recipients, location and retention period.
• Draw data flow maps that include vendors, cloud regions and overseas access.
• Keep a system and application list with a named data owner for each.
• Run automated discovery scans on a schedule and reconcile the results with the register.

Evidence to keep

Processing register, data flow diagrams, discovery scan reports, system list with owners.CIOOwns the system list and discovery tooling, and updates the register when systems change.CISOClassifies data by sensitivity and flags the datasets that need the tightest controls.3

Lawful basis and purpose

Statutoryss. 4, 6, 7Lead: Privacy Office and Legal

Every use of personal data needs either consent or one of the listed legitimate uses in section 7. The Act has no general legitimate-interest ground, so a business reason alone is not enough.

Controls to implement

• Tag every processing activity to consent or to a specific section 7 use, and record the choice.
• State each purpose specifically. A vague purpose such as “to improve our services” gives you no safe footing.
• Block reuse for an incompatible purpose with an approval step before new analytics, marketing or AI use.
• Re-check the basis whenever a purpose, product or vendor changes.
• Read each section 7 use narrowly and document why it applies.

Evidence to keep

Lawful-basis register, purpose statements, change-approval records.CIOBuilds purpose tags into data platforms and access policies so data cannot be queried for an unapproved purpose.CISOConsulted. Enforces purpose limits through access controls.4

Consent management

Statutorys. 6 · Rules 3, 4 · Schedule ILead: CIO

Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action for a stated purpose. People can withdraw it as easily as they gave it.

Controls to implement

• Ask for consent per purpose, with no bundling and no pre-ticked boxes.
• Show the notice at the moment of consent, in clear language.
• Record who consented, when, to which purpose, on which version of the notice and through which channel.
• Make withdrawal as easy as giving consent, stop the processing, and pass the withdrawal to processors.
• Consider supporting registered Consent Managers, which people may use to give, manage and withdraw consent (Rule 4).
• Route children’s consent through verifiable parental consent (domain 7).

Evidence to keep

Consent logs, notice versions, withdrawal test results, integration documents.CIOOwns the consent platform and the APIs that push consent changes to every downstream system.CISOProtects consent records against tampering and secures the consent APIs.5

Notice and transparency

Statutorys. 5 · Rule 3Lead: Legal and Product

People must know what you collect and why before they agree. The notice has to make sense on its own and explain how to withdraw consent, use their rights and complain to the Board.

Controls to implement

• Publish a standalone notice in plain language with an itemised list of the personal data and the specific purpose of each use.
• Include a link or means to withdraw consent, exercise rights and complain to the Board.
• Offer the notice in English or any language in the Eighth Schedule to the Constitution.
• Issue a fresh notice, and seek fresh consent where needed, when you add a new purpose.
• Add good-practice detail such as retention periods and the privacy contact (Rule 9).

Evidence to keep

Dated notice versions, screenshots of every collection point, translation records.CIODelivers notices at every collection point (web, app, forms, call-centre scripts) and versions them.CISOConsulted. Checks that security statements in the notice match the controls in place.6

Data processing controls

Part statutoryss. 6(1), 8(3), 8(4)Lead: CIO

Collect and use only what the stated purpose needs. Keep data accurate where it is used to decide something about a person or is shared with others.

Controls to implement

• Review forms, APIs and schemas, and remove fields you do not need.
• Run accuracy checks and push corrections to every copy of the record.
• Keep processing fair and reasonable. This is good practice and not a stated duty.
• Where automated decisions affect people, keep a human review path and test for bias and error. The Act has no specific rule on automated decisions, so this is also good practice.
• Review processing activities on a set cycle.

Evidence to keep

Field-level review records, data-quality reports, model test results.CIOOwns data minimisation in system design and the data-quality tooling.CISOConsulted. Uses data loss prevention to catch personal data moving where it should not.7

Children’s personal data

Statutorys. 9 · Rules 10–12 · Schedule IVLead: Product and Legal

Anyone under 18 is a child. You need verifiable consent from a parent or lawful guardian. You must not process in ways that harm a child’s well-being, and must not track, monitor behaviour or direct targeted ads at children unless a Schedule IV exemption applies.

Controls to implement

• Add age-gating and age assurance at sign-up.
• Verify that the person giving consent is an identifiable adult who is the parent (Rule 10). Apply the matching rule for a person with a disability who has a lawful guardian (Rule 11). Check Rule 10 for the accepted verification methods.
• Write child-friendly privacy notices.
• Turn off tracking, behavioural monitoring and targeted ads on child-facing surfaces, including third-party SDKs.
• Use an exemption only when it fits Schedule IV, and record why.
• Review child-safety measures on a set cycle.

Evidence to keep

Age-gate design, parental consent records, SDK inventory, exemption rationale.CIOBuilds the age-assurance flow and audits ad and analytics SDKs on child-facing surfaces.CISOProtects the identity evidence collected for parental verification and keeps it only as long as needed.8

Data Principal rights management

Statutoryss. 11–14 · Rule 14Lead: CIO

People can ask what data you hold and who receives it, ask for correction, completion, updating or erasure, nominate someone to act for them, and complain. Finding and changing their data across every system is the hard technical part.

Controls to implement

• Publish request channels (web form, email, in-app) and explain how to use them.
• Verify identity in proportion to the risk before releasing or changing data.
• Fulfil access, correction and erasure across all systems, vendors and backups, unless a law requires you to keep the data.
• Track every request to closure, and respond to grievances within 90 days (Rule 14).
• Audit a sample of closed requests each quarter.

Evidence to keep

Request tracker, identity-check records, response times, sample-audit results.CIOBuilds the workflow and the retrieval and deletion routines that reach every system.CISODesigns identity verification so data is never released to the wrong person, and secures delivery.9

Data sharing and processors

Statutorys. 8(1), 8(2) · Rule 6(1)(f)Lead: CISO with Procurement

You stay responsible for personal data your vendors handle. A processor may be engaged only under a valid contract.

Controls to implement

• Sign a written contract with every processor covering purpose limits, security safeguards, confidentiality, and deletion or return at exit.
• Require the processor to tell you about a breach fast enough for you to meet your own reporting duties.
• Control sub-processors through approval rights.
• Reserve audit rights and assess vendors by risk tier on a set cycle.
• Keep a register of every third-party sharing: what data, to whom, why and under which contract.

Evidence to keep

Contract register, vendor assessment reports, sharing register.CIORuns the technical onboarding gate: data flows, integrations and access methods.CISOAssesses vendor security before signing and monitors it afterwards.10

Cross-border data transfers

Statutorys. 16 · Rule 15 · Rule 13(4)Lead: CIO

Transfers outside India are allowed unless the Government restricts the country. Stricter sector laws still apply, and a notified SDF may face localisation directions.

Controls to implement

• Map every place data leaves India: SaaS regions, support access from abroad, backups, analytics and AI APIs.
• Check the Government’s restricted-country notifications and any conditions under Rule 15.
• Check sector rules, for example RBI, SEBI or IRDAI requirements, where they are stricter.
• Add contractual safeguards with overseas recipients. This is good practice.
• Keep a transfer register and watch for new notifications.

Evidence to keep

Transfer register, data flow maps, contract clauses, regulatory watch log.CIOControls where systems and cloud regions are hosted and who can reach them from abroad.CISOHolds encryption keys and remote-access controls so location rules can be enforced technically.11

Security safeguards

Statutorys. 8(5) · Rule 6Lead: CISO

Failing to take reasonable security safeguards carries the highest penalty in the Schedule, up to ₹250 crore. Rule 6 sets the minimum.

Controls to implement

• Encrypt, obfuscate or mask personal data, or use virtual tokens (Rule 6(1)(a)).
• Control access to the systems that hold personal data, with least privilege, MFA and periodic review (b).
• Log, monitor and review access so unauthorised access can be detected, investigated and remedied (c).
• Keep backups and recovery so processing continues if confidentiality, integrity or availability is lost (d).
• Retain the logs and personal data needed for these purposes for one year, unless another law requires otherwise (e).
• Put security terms in processor contracts (f), and apply technical and organisational measures that you check are working (g).
• Support these with data loss prevention, vulnerability and patch management, and regular security assessments.

Evidence to keep

Configuration baselines, access review records, monitoring use cases, backup restore tests, penetration test reports.CIOProvides the platforms, patching, backup and recovery capability.CISOOwns the control framework, monitoring and testing.12

Personal data breach management

Statutorys. 8(6) · Rule 7Lead: CISO

When you become aware of a breach you must tell each affected person without delay, and tell the Data Protection Board without delay, followed by a detailed report within 72 hours. The Act sets no harm threshold, so plan to assess every personal data breach.

Controls to implement

• Detect: monitoring and alerting that surface unauthorised access, loss or alteration quickly.
• Assess and contain: a decision tree that says whether personal data was affected, and the steps to stop the breach.
• Tell each affected person without delay: what happened, when, the likely consequences, what you are doing, what they can do, and a contact.
• Tell the Board without delay (nature, extent, timing, location, likely impact), then within 72 hours the detailed account: facts and reasons, mitigation, who was responsible if found, remedial steps, and a report on the notices to people. The Board may extend the 72 hours on a written request.
• Keep a breach register and the evidence for every incident, and hold a post-incident review.

Evidence to keep

Playbook, notification templates, drill reports, breach register.CIOProvides logging, forensic readiness and disaster recovery, and keeps contact data usable for notices.CISOLeads detection, containment and the incident record, with Legal and the DPO on notification content.13

Retention and deletion

Statutorys. 8(7), 8(8) · Rule 8 · Schedule IIILead: CIO

Delete personal data when its purpose is served or consent is withdrawn, unless a law requires you to keep it. Processors must delete too.

Controls to implement

• Set a retention schedule per dataset, tied to the purpose and to any legal minimum.
• Automate deletion or anonymisation, and report on job success.
• If you are an e-commerce entity or social media intermediary with at least two crore registered users in India, or an online gaming intermediary with at least fifty lakh, erase data three years after the person last used the service or exercised their rights. Schedule III lists exceptions, and Rule 8(2) requires advance notice before erasure (check the notice period in the official text).
• Define how deletions reach backups and archives, and how long those copies live.
• Dispose of media securely, and obtain deletion confirmations from processors.
• Reconcile the one-year log retention in Rule 6 with deletion duties, so logs holding personal data are not kept longer than allowed.

Evidence to keep

Retention schedule, deletion job logs, processor deletion confirmations, disposal certificates.CIOBuilds lifecycle automation across databases, storage, backups and SaaS tools.CISOSets secure disposal standards and reconciles log retention with deletion.14

Privacy by design and by default

Good practices. 8(4) · Rule 13(1) for SDFsLead: CIO

Building privacy in at design time costs less than fixing it after launch. The Act asks for technical and organisational measures and requires a data protection impact assessment (DPIA) only from notified SDFs, so for others this practice makes the other controls easier to meet.

Controls to implement

• Add a privacy review gate to the software development lifecycle, the architecture board and procurement.
• Minimise data by design: collect less, keep it for less time, pseudonymise where you can.
• Make defaults protective: optional processing stays off until the person opts in.
• Run a DPIA for high-risk processing. It is mandatory every 12 months for a notified SDF and good practice for others.
• Review new projects and features before launch, and record the decision.

Evidence to keep

Design review records, DPIAs, backlog items, launch checklists.CIOEmbeds the review gate in delivery pipelines and architecture standards.CISOJoins design reviews with threat modelling and security requirements.15

Algorithmic accountability

SDF onlys. 10 · Rule 13Lead: CIO, with the DPO accountable

An SDF is a company the Government notifies, based on factors such as the volume and sensitivity of its data and the risk to people’s rights. It must verify that the technical measures and algorithmic software it uses are not likely to risk the rights of the people whose data it processes. Other companies can use this as a benchmark.

Controls to implement

• Assess whether you are likely to be notified, and plan for it.
• If notified, run a DPIA and an independent audit every 12 months, and make sure the auditor’s report of significant observations reaches the Board (Rule 13).
• Keep an inventory of the algorithms and models that handle personal data, and do the due diligence Rule 13(3) requires.
• Assess and reduce risks such as bias, drift and unexplained outcomes. This is good practice.
• Provide human oversight and explanations for decisions that matter to individuals. This is good practice.
• Document testing and decisions.

Evidence to keep

DPIA, audit report, model inventory, test results, oversight records.CIOKeeps the algorithm and model inventory and the testing pipeline.CISOTests the security of models and data pipelines and assesses AI vendors.16

Records, audit and evidence

Part statutorys. 8(1), 36 · Rules 6(1)(e), 13, 23Lead: Privacy Office

The Board can inquire into non-compliance and the Government can call for information. An organisation that can show its records quickly is in a stronger position than one that has to rebuild them.

Controls to implement

• Maintain the processing register and records of consent and rights requests.
• Keep DPIA and audit reports, contracts and vendor assessments.
• Store evidence in one controlled repository with owners, versions and access limits.
• Collect evidence automatically where you can, for example access reviews and deletion logs.
• Set a target to produce an evidence pack for any control within one working day, and test it.

Evidence to keep

Repository index, results of a sample retrieval test.CIOHosts the repository and automates evidence collection.CISOProtects the integrity of the evidence and controls access to it.17

Training and awareness

Good practiceSupports s. 8(4), Rule 6(1)(g)Lead: CISO with HR

Staff mistakes, such as sending data to the wrong person or pasting it into unapproved tools, are a common route to a breach. Training is part of the organisational measures the Rules expect.

Controls to implement

• Give role-based training to employees, contractors and processor staff who handle personal data.
• Have staff acknowledge the DPDP policy.
• Train front-line teams to recognise and route requests from people about their data.
• Teach everyone how to spot and report an incident quickly, since the breach clock starts when you become aware.
• Run refreshers and phishing simulations, and check understanding with short tests.
• Keep training records and scores.

Evidence to keep

Completion reports, test scores, policy acknowledgments, simulation results.CIOTrains engineers and administrators on privacy by design and on handling production data.CISORuns the security awareness and phishing programme.18

Grievance redressal

Statutoryss. 8(10), 13 · Rules 9, 14Lead: Privacy Office

You must run a grievance redressal system, publish a contact for questions about processing, and respond within the time the Rules set. People can approach the Board only after using your system.

Controls to implement

• Name a grievance contact. The Act requires a redressal system, and Rule 9 requires you to publish the contact of a person who answers questions about processing.
• Publish contact details prominently on the website and app and in notices.
• Acknowledge each grievance and respond within 90 days at most (Rule 14). Set a shorter internal target.
• Define an escalation path, and track grievances and outcomes.
• Review grievance patterns regularly to find root causes.

Evidence to keep

Grievance log, response-time reports, escalation records.CIOProvides the ticketing workflow and service-level reporting.CISOConsulted on complaints about security or breaches, and links them to the incident process.19

Compliance and regulatory readiness

Part statutoryss. 27, 32, 36 · Rules 20, 23Lead: Legal and Privacy Office

The Board works as a digital office, can inquire into breaches and non-compliance, and can accept a voluntary undertaking in place of further proceedings. Readiness means tracking the rules as they change and being able to respond fast.

Controls to implement

• Track the Act, Rules, Board orders and notifications, and sector regulator requirements.
• Prepare a response runbook for Board inquiries and information requests, with one coordinator and legal review.
• Keep compliance evidence current and ready.
• Hold periodic compliance reviews and report to the board and senior management.
• Decide in advance who may offer a voluntary undertaking after a serious incident (section 32).

Evidence to keep

Regulatory tracker, response runbook, review reports.CIOCan retrieve data and logs quickly for a regulatory request.CISOPreserves forensic evidence and gives technical input on incidents.20

Continuous monitoring and improvement

Good practiceRule 13 audit cycle for SDFsLead: Privacy Office and Internal Audit

Systems, vendors and rules change, so a one-off audit goes stale. A notified SDF must audit every 12 months, and every other company benefits from the same rhythm.

Controls to implement

• Run internal audits against the checklist at least once a year and after major change.
• Monitor legal and regulatory changes.
• Assess emerging risks such as AI, new cloud services and new uses of data.
• Track metrics: systems mapped, consent coverage, requests open past 60 days, breach drill time to Board report, vendors with DPDP clauses, training completion and deletions completed.
• Track every gap to closure with an owner and a due date, and keep an improvement plan.

Evidence to keep

Audit reports, KPI dashboard, remediation tracker.CIOFeeds telemetry and automation into the dashboard.CISOTests controls independently of the teams that run them, together with Internal Audit.

How to read the labels. Statutory means the Act or Rules state the duty directly. Part statutory means the core duty is stated and the checklist adds practices around it. SDF only means the duty applies if the Government notifies your company. Good practice means the Act and Rules do not state it, but it makes other duties achievable. These labels are a reading of the texts, so have counsel confirm them for your business.

Quick guide: each rule in simple words

The law comes down to one idea: handle people’s personal data the way you would want yours handled. Section and Rule numbers are shown only as a reference.

Rule in simple words	How to follow it	Reference
Have a valid reason to use data. Use personal data only if the person agreed or the law allows it, for example a legal duty, a medical emergency or employment.	Write down the reason for each use of data. If no allowed reason applies, ask for consent.	ss. 4, 7
Tell people first. Before asking for consent, explain what data you take, why, how to withdraw and how to complain.	Publish a short notice in plain English or an Indian language. Show it wherever you collect data.	s. 5, Rule 3
Ask for consent properly. Consent is a clear yes for a stated purpose.	Use unticked boxes, one consent per purpose and no hidden terms. Make withdrawing as easy as agreeing. Keep a record of every consent.	s. 6
Take only what you need.	Remove form fields and data you do not use. Ask “why do we need this?” for every field.	ss. 4, 6
Keep data correct.	Update records when people correct them, and check data before using it to decide something about a person.	s. 8(3)
Protect the data.	Encrypt it, limit who can open it, monitor access, take backups and keep logs for one year.	s. 8(5), Rule 6
Report a breach quickly.	Tell affected people without delay. Tell the Data Protection Board at once and send a detailed report within 72 hours. Keep a ready plan and contact list.	s. 8(6), Rule 7
Delete data when done.	Delete when the purpose is over or consent is withdrawn, unless a law says to keep it. Make your vendors delete it too.	s. 8(7), Rule 8
Control your vendors.	Sign a contract with every vendor that handles data. You stay responsible for what they do.	s. 8(2)
Respect people’s rights. People can ask to see, correct or erase their data, and can name someone to act for them.	Set up a request form and a tracker. Answer complaints within 90 days.	ss. 11–14, Rule 14
Protect children. Under 18 needs a parent’s consent.	Verify the parent. Do not track children, monitor their behaviour or show them targeted ads.	s. 9, Rules 10–12
Show who to contact.	Publish a name or contact for privacy questions on your website and notices.	s. 8(9), Rule 9
Moving data abroad. Allowed unless the Government restricts a country.	List where data goes, check the restricted list and your sector regulator’s rules.	s. 16, Rule 15
Significant Data Fiduciary. A large or high-risk company notified by the Government.	Appoint an India-based DPO and an independent auditor, run a yearly impact assessment and audit, and check that your algorithms do not harm people.	s. 10, Rule 13
Keep proof.	Store notices, consent records, contracts, logs, training and test results in one evidence file.	s. 8(1)

Do

• Ask first, explain clearly and keep records.
• Collect little, protect well and delete on time.
• Practise your breach plan before you need it.

Do not

• Bundle several uses into one consent or hide terms.
• Keep data “just in case”.
• Treat a vendor’s mistake as the vendor’s problem alone.
• Track or target children.

Reference A: DPDP Act, 2023, all sections

Titles follow the published Act. The plain-words column is a summary; the official text prevails. The Data Fiduciary is you, the Data Principal is the person the data is about, and the Data Processor is your vendor.

Section	Title	In simple words
Chapter I: Preliminary
1	Short title and commencement	Name of the law. The Government brings it into force in stages.
2	Definitions	Defines terms such as Data Fiduciary, Data Principal, Data Processor, Consent Manager and Significant Data Fiduciary.
3	Application	Covers digital personal data in India, and abroad if you offer goods or services to people in India. Excludes purely personal or domestic use.
Chapter II: Obligations of Data Fiduciary
4	Grounds for processing personal data	Use data only for a lawful purpose, with consent or a listed legitimate use.
5	Notice	Tell people what data, why, how to withdraw consent and how to complain.
6	Consent	Consent must be free, specific, informed and clear, and easy to withdraw. Consent Managers are allowed.
7	Certain legitimate uses	Uses allowed without consent: data volunteered for a purpose, State benefits, legal duty, medical emergency, disasters and employment.
8	General obligations of Data Fiduciary	You are responsible even for vendors. Keep data accurate, secure it, report breaches, erase it, publish a contact and run a grievance system.
9	Processing of personal data of children	A parent’s verifiable consent is needed under 18. No harmful processing, tracking or targeted ads.
10	Additional obligations of Significant Data Fiduciary	Notified large or risky companies need a DPO, an independent auditor and a yearly impact assessment and audit.
Chapter III: Rights and Duties of Data Principal
11	Right to access information about personal data	People can ask what data you hold and who receives it.
12	Right to correction and erasure of personal data	People can ask you to correct, complete, update or erase their data.
13	Right of grievance redressal	People complain to you first, then to the Board.
14	Right to nominate	People can name someone to use their rights if they die or cannot act.
15	Duties of Data Principal	People must not give false information, impersonate others or file false complaints.
Chapter IV: Special Provisions
16	Processing of personal data outside India	Transfers abroad are allowed unless the Government restricts a country.
17	Exemptions	Exemptions for legal claims, courts, crime prevention, State security, research and statistics, and notified startups.
Chapter V: Data Protection Board of India
18	Establishment of Board	Creates the Board as a body corporate.
19	Composition and qualifications for appointment of Chairperson and Members	One Chairperson and Members chosen for their expertise.
20	Salary, allowances payable to and term of office	Pay and terms of Board Members.
21	Disqualifications for appointment and continuation	Who cannot serve, and when a Member must leave.
22	Resignation by Members and filling of vacancy	How Members resign and vacancies are filled.
23	Proceedings of Board	How the Board meets and decides.
24	Officers and employees of Board	Staff of the Board.
25	Members and officers to be public servants	Board people are treated as public servants.
26	Powers of Chairperson	The Chairperson runs the Board’s work.
Chapter VI: Powers, Functions and Procedure of Board
27	Powers and functions of Board	Investigates breaches and non-compliance, directs fixes and imposes penalties.
28	Procedure to be followed by Board	A digital process: complaint, inquiry, hearing, order.
Chapter VII: Appeal and Alternate Dispute Resolution
29	Appeal to Appellate Tribunal	Board orders can be appealed to the Appellate Tribunal (TDSAT).
30	Orders passed by Appellate Tribunal to be executable as decree	Tribunal orders are enforced like court decrees.
31	Alternate dispute resolution	The Board can refer disputes to mediation.
32	Voluntary undertaking	You can promise to fix a breach, and the Board may accept this in place of a penalty.
Chapter VIII: Penalties and Adjudication
33	Penalties	The Board imposes penalties from the Schedule after an inquiry.
34	Crediting sums realised by way of penalties to Consolidated Fund of India	Penalty money goes to the Government.
Chapter IX: Miscellaneous
35	Protection of action taken in good faith	No suit against the Government or Board for good-faith acts.
36	Power to call for information	The Government can ask a Data Fiduciary or intermediary for information.
37	Power of Central Government to issue directions	The Government can direct blocking of access to a Data Fiduciary after repeated penalties.
38	Consistency with other laws	DPDP adds to other laws. Where they conflict, the more protective rule prevails.
39	Bar of jurisdiction	Civil courts cannot hear matters the Board decides.
40	Power to make rules	The Government can make the Rules.
41	Laying of rules and certain notifications	Rules are placed before Parliament.
42	Power to amend Schedule	The Government can change the penalty amounts in the Schedule.
43	Power to remove difficulties	The Government can clear implementation problems by order.
44	Amendments to certain Acts	Changes to the IT Act, 2000 and the RTI Act, 2005.
Schedule
Sch.	Penalties	Maximum penalty per instance for each type of breach. See the penalties table below.

Section 8 in detail

• 8(1) You are responsible for compliance, including for vendors.
• 8(2) Use processors only under a valid contract.
• 8(3) Keep data accurate where it is used for decisions or shared.
• 8(4) Adopt technical and organisational measures.
• 8(5) Take reasonable security safeguards.
• 8(6) Report personal data breaches.
• 8(7) Erase data when it is no longer needed.
• 8(8) Know when the purpose is deemed no longer served.
• 8(9) Publish a contact for questions.
• 8(10) Provide a grievance system.

Reference B: DPDP Rules, 2025, all rules and schedules

Notified as G.S.R. 846(E) on 13 November 2025 under section 40 of the Act. Titles follow the published Rules.

Rule	Title	In simple words	Act section
1	Short title and commencement	Name of the Rules and how they come into force.	s. 40
2	Definitions	Meanings of terms used in the Rules.	s. 40
3	Notice given by Data Fiduciary to Data Principal	Notice must be clear and stand alone, list the data and purpose, and give a link to withdraw consent and use rights.	s. 5
4	Registration and obligations of Consent Manager	Companies that manage consent for people must register with the Board and meet the Schedule I conditions.	s. 6
5	Processing by State for subsidy, benefit, service, certificate, licence or permit	Government bodies follow the Schedule II standards when processing data for benefits.	s. 7
6	Reasonable security safeguards	Encryption or masking, access control, logs and monitoring, backups, one-year log retention and vendor contract terms.	s. 8
7	Intimation of personal data breach	Tell affected people without delay. Tell the Board at once and send a detailed report within 72 hours.	s. 8
8	Time period for specified purpose to be deemed as no longer being served	When data must be erased. Large e-commerce, gaming and social media firms follow Schedule III. Keep logs for one year.	s. 8
9	Contact information of person to answer questions about processing	Publish the contact of a DPO or other person who answers privacy questions.	s. 8
10	Verifiable consent for processing of personal data of child	Check that the person giving consent is the child’s parent and an adult.	s. 9
11	Verifiable consent for processing of personal data of person with disability who has lawful guardian	The same check for the lawful guardian of a person with a disability.	s. 9
12	Exemptions from certain obligations applicable to processing of personal data of child	Some bodies and purposes, such as healthcare and education, are exempt under Schedule IV.	s. 9
13	Additional obligations of Significant Data Fiduciary	Yearly impact assessment and independent audit, a report to the Board, algorithm due diligence, and data localisation if directed.	s. 10
14	Rights of Data Principals	How people use access, correction, erasure and nomination rights. Publish how to apply and reply to grievances within 90 days.	ss. 11–14
15	Transfer of personal data outside the territory of India	Transfers abroad must meet any conditions the Government sets for specific countries.	s. 16
16	Exemption from Act for research, archiving or statistical purposes	Research use is exempt if it follows the Schedule II standards.	s. 17
17	Appointment of Chairperson and other Members	How the Board’s leaders are selected.	s. 19
18	Salary, allowances and other terms and conditions of service of Chairperson and other Members	Pay and conditions (Schedule V).	s. 20
19	Procedure for meetings of Board and authentication of its orders, directions and instruments	How meetings run and orders are signed.	s. 23
20	Functioning of Board as digital office	Complaints and hearings are held online.	s. 28
21	Terms and conditions of appointment and service of officers and employees of Board	Pay and conditions of Board staff (Schedule VI).	s. 24
22	Appeal to Appellate Tribunal	How to file an appeal against a Board order.	s. 29
23	Calling for information from Data Fiduciary or intermediary	The Government can request information for the purposes in Schedule VII.	s. 36

Schedules to the Rules

Schedule	What it covers	Used by
I	Conditions of registration and obligations of Consent Managers	Rule 4
II	Standards for State processing of personal data, and for research and statistical use	Rules 5, 16
III	Time periods after which specified Data Fiduciaries must erase personal data	Rule 8(1)
IV	Exemptions from the children’s data restrictions in section 9(1) and 9(3)	Rule 12
V	Terms and conditions of service of the Chairperson and Members	Rule 18
VI	Terms and conditions of appointment and service of Board officers and employees	Rule 21
VII	Purposes for which the State may call for information, and who is authorised	Rules 23, 8(3)

Penalties under the Schedule

Maximum penalty per instance, imposed by the Data Protection Board after an inquiry (sections 33 and 34).

₹250 croreFailure to take reasonable security safeguards

₹200 croreFailure to notify a breach

₹200 croreBreach of obligations for children’s data

₹150 croreBreach of Significant Data Fiduciary duties

₹50 croreAny other breach of the Act or Rules

₹10,000Breach of a Data Principal’s duties

Implementation roadmap: 10 steps in sequence

Work the steps in this order. Each depends on the one before, and each has a named owner.

1. Get leadership sponsorship and name an owner.The board or CEO signs off on a programme with one accountable executive and a privacy lead or DPO.Owner: CEO, CIO
2. Map your data.List every personal-data type, purpose, system, vendor and storage location, including cloud and overseas. This inventory feeds every later step.Owner: CIO, business heads
3. Run a gap assessment.Compare current practice with sections 4–9 and Rules 3, 6–8 and 14. Rank gaps by penalty exposure, with security and breach first.Owner: Privacy lead, Legal
4. Fix lawful basis, notice and consent.Rewrite notices in plain language, record the purpose for each dataset, and build consent capture, withdrawal and an audit trail.Owner: Legal, Product, IT
5. Harden security.Apply encryption, access controls, monitoring and backups, and retain logs for one year. This carries the highest penalty.Owner: CISO, CIO
6. Build the breach response playbook.Define detection, escalation, individual notification and the 72-hour Board report. Rehearse it twice a year.Owner: CISO, Legal, Communications
7. Set retention and erasure rules.Define retention periods per dataset, automate deletion and make sure processors delete too.Owner: IT, Records management
8. Bring vendors under contract.Update processor agreements with security, breach-notice, deletion and audit clauses, and assess critical vendors.Owner: Procurement, Legal
9. Operationalise rights, grievances and children’s data.Stand up a request workflow with a 90-day service level and published contact details. Add age-gating and parental consent if you serve minors.Owner: Customer operations, Product
10. Train, test and prove compliance.Train staff by role, check whether you may be notified as a Significant Data Fiduciary, review cross-border flows and keep an evidence file of records, contracts, logs and drills.Owner: Privacy lead, Internal audit

Governance, roles and RACI

Compliance works only when every function that touches personal data owns its part, under one accountable executive and a full-time privacy lead.

Four layers of governance

• Board or Risk Committee reviews the compliance score and top risks each quarter.
• DPDP Steering Committee is chaired by the CEO or MD, with the CIO, CISO, CFO, Legal, CHRO, COO and business heads. It approves budget, priorities and risk decisions.
• Privacy Office is led by the DPO or Privacy Lead. It runs the plan, tracks gaps, owns the evidence file and reports to the Steering Committee.
• Function champions are one named person per department who keeps that team’s data map, processes and training current.

Three lines of defence

• First line, operate: business units, IT, HR, Marketing, Support and Procurement run the controls day to day.
• Second line, oversee: Privacy Office, Legal and the CISO set policy, monitor and challenge.
• Third line, assure: Internal Audit tests independently and reports to the Audit Committee.

Resources and roles to deploy

Time commitments are planning assumptions for a mid-sized company. Size them from your data map.

Role	Who	Core responsibility	Indicative commitment
Executive sponsor	CEO or MD	Chairs the Steering Committee, unblocks budget and decisions	Monthly meeting
DPO or Privacy Lead	Full-time hire or appointee, India-based for Significant Data Fiduciaries	Runs the programme, grievances, evidence file and regulator contact	Full time
Legal and Compliance	General Counsel plus one counsel	Notices, consent wording, contracts, Board filings, breach decisions	About 30 to 50% of one counsel
IT and Engineering	CIO plus architects	Data inventory, consent and rights tooling, deletion automation	Dedicated squad during build
Information Security	CISO and security team	Safeguards, logging, monitoring, breach detection and response	Existing team plus uplift
HR	CHRO	Employee data, role-based training, disciplinary policy	Part time
Marketing, Product and Customer Experience	Heads and product owners	Consent journeys, notices, age-gating, data minimisation	Part time per product
Customer Support	Support head	Intake and resolution of rights requests and grievances within 90 days	Process owner
Procurement and Vendor Management	Procurement head	Vendor register, contract clauses, vendor assessments	Part time
Finance	CFO and controller	Budget, cost tracking, finance-data retention, insurance review	Part time
Internal Audit	Head of Internal Audit	Independent testing of controls and evidence	Annual plan
Data owners and function champions	One per department	Keep the data map and processes current	A few hours a month

External support to budget for: privacy counsel, an assessor or auditor if you may be notified as a Significant Data Fiduciary, and consent and rights-request tooling.

RACI matrix: who does what

R Responsible, does the workA Accountable, one owner who signs offC ConsultedI Informed

Activity	CEO / Board	DPO	Legal	CIO	CISO	HR	Business / Product	Procure-ment	Support	Finance	Internal Audit
1. Governance and sponsorship	A	R	C	C	C	I	C	I	I	C	I
2. Data mapping and inventory	I	A	C	R	C	R	R	C	C	C	I
3. Gap assessment	I	A	R	R	R	C	C	C	C	I	C
4. Notice and consent	I	R	A	R	C	C	R	I	C	I	I
5. Security safeguards and logging	I	C	C	R	A	C	C	C	I	I	C
6. Breach response and Board reporting	C	R	R	R	A	I	C	I	C	I	I
7. Retention and erasure	I	A	R	R	C	R	R	I	C	C	I
8. Vendor contracts and assessment	I	C	R	C	C	I	C	A	I	C	I
9. Rights, grievances, children’s data	I	A	C	R	C	C	R	I	R	I	I
10. Training and awareness	I	R	C	C	C	A	C	I	C	I	I
11. Significant Data Fiduciary assessment, DPIA and audit	I	A	C	R	R	I	C	I	I	I	C
12. Budget and cost tracking	C	R	I	C	C	C	C	C	I	A	C
13. Independent assurance and evidence review	I	R	C	C	C	C	C	C	C	I	A/R

Adopt the matrix at the first Steering Committee, name a person for each R and A cell, and review it every quarter or after a reorganisation. Breach response is led by the CISO, while Legal and the DPO decide the notification content and the 72-hour Board report. The CEO is consulted on major incidents.

How to keep control after go-live

Steering Committee dashboard

• Share of systems mapped
• Consent coverage
• Rights requests open past 60 days
• Breach drill time to Board report (target under 72 hours)
• Vendors with DPDP clauses
• Training completion
• Deletion jobs completed

Standing controls

• Evidence file: one repository of data maps, notices, consent logs, contracts, access reviews, drills and training records.
• Change gate: no new product, system or vendor goes live without a privacy review.
• Escalation: unresolved gaps and incidents go from function champion to the DPO within 48 hours, then to the Steering Committee.
• Assurance: Internal Audit tests controls at least annually.

DPDP audit approach and checklist

Audit yourself at least once a year. If the Government notifies your company as a Significant Data Fiduciary, Rule 13 makes an annual impact assessment and independent audit mandatory, and the auditor sends a report of significant observations to the Data Protection Board.

Seven audit stages in sequence

1. Scope and criteria.List the entities, systems, vendors and datasets in scope, and fix the audit criteria as the Act sections and Rules in the checklist below.
2. Evidence request.Collect the data map, notices, consent records, policies, contracts, logs, tickets and training records from each function.
3. Control testing.Sample real records. Trace a customer’s consent from capture to deletion, test access controls and replay a breach drill.
4. Gap rating.Mark each control Compliant, Partial or Gap, and rank by penalty exposure: security and breach first, then children’s data, then the rest.
5. Remediation plan.Assign an owner from the RACI, a deadline and a tool or process fix for each gap.
6. Re-test and sign-off.The Privacy Office verifies fixes and Internal Audit samples the closure evidence.
7. Continuous monitoring.Move the high-risk controls onto the dashboard and re-audit annually or after major change.

Audit checklist

One row per control. Record status, owner and evidence reference for each.

#	Control area	Reference	What to verify	Evidence
1	Governance	s. 8(1), 8(9); Rule 9	Named owner, steering committee, published contact for privacy queries	Charter, minutes, website page
2	Data inventory	s. 8(1)	Every personal-data set, purpose, system, vendor and location is listed	Data map, processing register
3	Notice	s. 5; Rule 3	Itemised, plain-language notice before or at consent, in English or an Eighth Schedule language	Notice versions, screenshots
4	Consent and legitimate uses	ss. 6, 7; Rule 3	Consent is free, specific, informed, unambiguous and limited to the purpose. Withdrawal is as easy as giving it	Consent logs, withdrawal tests
5	Purpose and data minimisation	ss. 4, 6	Only data needed for the stated purpose is collected and used	Field-level review, form audit
6	Accuracy	s. 8(3)	Data used for decisions about a person is complete, accurate and consistent	Data-quality checks
7	Security safeguards	s. 8(5); Rule 6	Encryption, masking or tokens, access control, logging and monitoring, backups, logs kept for one year	Config evidence, access reviews, SIEM reports
8	Breach management	s. 8(6); Rule 7	Detection, notice to affected individuals without delay, detailed report to the Board within 72 hours	Playbook, drill report
9	Retention and erasure	s. 8(7); Rule 8	Retention schedule, automated deletion, processor deletion confirmed	Schedule, deletion logs
10	Vendors and processors	s. 8(2); Rule 6	Valid contract with security, breach, deletion and audit terms	Contract register, vendor assessments
11	Rights and grievances	ss. 11–14; Rule 14	Access, correction, erasure and nomination handled. Grievances answered within 90 days	Request tracker, response times
12	Children’s data	s. 9; Rules 10–12	Verifiable parental consent for under-18s. No tracking, behavioural monitoring or targeted ads	Age-gate flow, consent records
13	Cross-border transfers	s. 16; Rule 15	Flows mapped, no transfer to restricted countries, sector rules checked	Transfer register
14	Significant Data Fiduciary duties, if notified	s. 10; Rule 13	India-based DPO, independent auditor, annual DPIA and audit, algorithmic due diligence	DPIA, audit report
15	Training and awareness	s. 8(1)	Role-based training completed and policy acknowledged	Completion records
16	Evidence and reporting	s. 8(1)	Evidence file is current and the dashboard is reviewed by the Steering Committee	Repository index, minutes

Check rows 7, 8 and 12 first. They carry the highest penalties: ₹250 crore for security, and ₹200 crore for breach notice and children’s data.

Main controls and tools, chosen by gap

Buy tools only for gaps the assessment confirms. Deploy in this order, because each layer depends on the one before. Tool names are examples of each category, not endorsements.

Order	If the gap is	Main control to adopt	Tool category (examples)
1	You do not know where personal data sits	Data discovery, classification and inventory	Data discovery and DSPM (Microsoft Purview, BigID, Securiti)
2	Weak access control	Least privilege, MFA, privileged-access management, periodic access review	IAM and PAM (Okta, Microsoft Entra, CyberArk)
3	Data not protected at rest and in transit	Encryption, masking, tokenisation, key management	Cloud KMS or HSM, database masking, tokenisation tools
4	No visibility into access or leaks	Central logging with one-year retention, alerting, data-loss prevention	SIEM (Splunk, Microsoft Sentinel, Elastic), DLP (Purview, Forcepoint)
5	Slow or untested breach response	Incident playbook, ticketing, 72-hour Board report template, drills	SOAR or ITSM (ServiceNow, Jira Service Management), tabletop exercises
6	Consent and notice not auditable	Consent capture, withdrawal, purpose tagging, multilingual notices	Consent management platform (OneTrust, Usercentrics, India-hosted consent tools)
7	Rights requests handled by email	Request workflow with identity check and 90-day tracking	Privacy request automation (OneTrust, Securiti, ServiceNow)
8	Data kept forever	Retention schedule with automated deletion and processor confirmation	Records management, lifecycle policies in cloud storage and databases
9	Vendors unmanaged	Vendor register, DPDP clauses, risk tiering, assessments	Third-party risk tools or a GRC platform
10	Minors served without age checks	Age-gating and verifiable parental consent	Age-assurance and parental-consent flows (check Rules 10–12 for accepted methods)
11	No evidence trail	Control library, tasks, evidence repository, dashboard	GRC platform (ServiceNow GRC, Archer, or a controlled shared repository)
12	Low awareness	Role-based training and phishing simulation	Learning platform (KnowBe4 or an in-house LMS)

Selection tests for any tool: data stays in India where your sector rules require it, it logs every action for audit, it integrates with your identity and ticketing systems, and the vendor will sign a DPDP-compliant processor contract.

DPDP and AI: what applies and what does not

The DPDP Act has no AI-specific provisions, and India has no AI statute yet. The Act applies fully whenever an AI system processes digital personal data. MeitY’s India AI Governance Guidelines (5 November 2025) are principles-based and non-binding, and rely on existing laws, including the DPDP Act, instead of a new AI law.

What DPDP already requires of your AI use

AI situation	DPDP provision	What to do
Training or fine-tuning on customer or employee data	ss. 4, 5, 6	Have a lawful basis and a notice that covers AI training. Do not reuse data for a new purpose without fresh consent or a listed legitimate use.
Staff pasting personal data into public AI tools	s. 8(5); Rule 6	Restrict by policy, DLP rules and approved tools. This is a likely breach route.
Third-party AI or LLM providers	s. 8(2); Rule 6	Treat as processors: contract, security terms, no training on your data, deletion on exit.
Prompts or APIs sent to servers abroad	s. 16; Rule 15	Map the flow and check restricted-country notifications and sector localisation rules.
AI-driven decisions about people, such as credit, hiring or pricing	s. 8(3)	Keep inputs accurate, complete and consistent, and keep a human review path.
Erasure or consent withdrawal	ss. 6(6), 8(7)	Be able to remove data from datasets and stop further use. Document how trained models are handled.
AI used on children’s data	s. 9; Rules 10–12	No tracking, behavioural monitoring or targeted advertising directed at children.
Notified Significant Data Fiduciaries	s. 10; Rule 13(3)	Due diligence that algorithmic software does not risk Data Principals’ rights, plus an annual DPIA and audit.
Breaches involving AI systems or training data	s. 8(6); Rule 7	Include AI platforms and data stores in breach playbooks and logging.

Where DPDP is silent or unsettled

• It gives no general right to object to automated decisions or profiling, as some other laws do.
• Whether scraped public data can be used for training is debated. The Act excludes personal data made public by the individual or under a legal duty, but that may not cover all web-scraped data. Take legal advice before relying on it.
• Copyright in training data, bias and deepfakes sit under other laws and sector regulators, such as the RBI for financial firms.

DPDP compliance is necessary for AI but not sufficient on its own. Treat the MeitY guidelines as good practice and check your sector regulator.

AI-on-DPDP checklist

• ☐ AI inventory: every model, tool and vendor, with the personal data each uses
• ☐ Lawful basis and notice cover each AI purpose, including training
• ☐ Approved-tools list and a policy on personal data in unapproved AI tools
• ☐ Processor contracts with AI vendors: no training on your data, deletion, breach notice
• ☐ Cross-border flows from AI APIs mapped and approved
• ☐ Accuracy, bias and drift testing for models that affect individuals, with human review
• ☐ Process to honour erasure and withdrawal in training and retrieval data
• ☐ DPIA for high-risk AI use cases
• ☐ AI incidents included in the breach playbook and dashboard

How access0day can help

Support at each stage of the roadmap, so your team does not have to build the capability alone.

Stage	Support
Assess	Data mapping workshops, DPDP gap assessment and Significant Data Fiduciary readiness review
Plan	Governance set-up, RACI design, budget and tool selection from the gap results
Secure	Security safeguards review (Rule 6), logging and monitoring design, breach playbook and drills (Rule 7)
Build	Consent, notice and rights-request workflow design, vendor contract clauses, retention and erasure rules
Audit	Independent DPDP audit against the checklist above, DPIA support and a Board-ready evidence file
AI	AI inventory, AI-on-DPDP review and approved-tool policy
Sustain	Dashboard, quarterly reviews and annual re-audit

Official portals and sources

Use government sources for the legal text. Use commentary only to understand it.

Source	Use it for	Type
MeitY	Act, Rules, notifications, FAQs and Board announcements	Official
eGazette of India	Authentic gazette notifications (G.S.R. 843(E) to 846(E), 13 November 2025)	Official
India Code	Consolidated text of the DPDP Act, 2023	Official
DPDP Wiki	Section and Rule index with plain-English explainers	Third party
DSCI FAQ on Data Fiduciaries and SDFs	Section-by-section FAQ on Significant Data Fiduciary duties	Industry body
SFLC.in on SDF obligations	Commentary on Rule 13 and cross-border transfers	Third party
Mondaq on India’s AI Governance Guidelines	How the guidelines relate to the DPDP Act	Third party