This covers nine specific fundamentals — notices, consent, purpose, rights, grievances, children, processors, security, records. Here’s how they fit together.
THE FUNDAMENTALS, IN ONE PLACE
BEFORE
Notice, consent, purpose limitation
Set the terms honestly before any data is collected at all.
DURING
Rights, children's safeguards, processor contracts
Keep the relationship fair while the data is actively in use.
THROUGHOUT
Security and recordkeeping
Run continuously, underneath everything else, the whole time.
None of these fundamentals work well in isolation — a great notice paired with no real rights process, or strong security with no audit trail, both leave gaps. Everyday governance is what happens when all nine become routine practice instead of nine separate projects finished on nine separate days.
Compliance that has to be reassembled from memory every time isn’t governance. Compliance that runs quietly, on its own, is.
SOURCES The DPDP Act, 2023 — official text, MeitY — https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf · The DPDP Rules, 2025 — official text, MeitY — https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf