The People and Roles Behind the Act
Five terms do almost all the work in the DPDP Act. Once you know who’s who, everything else in this series gets easier to follow. Role Data Principal Data Fiduciary Data Processor Significant Data Fiduciary (SDF) Consent Manager In plain terms The individual the data is about. In most sentences in this series, that’s simply […]
Who Does the DPDP Act Apply To?
It’s an Indian law, so it’s only for Indian companies” is one of the most common assumptions about the DPDP Act — and it’s wrong. Here’s who’s actually covered In scope Digital personal data processed within India, by anyone Processing outside India, if it involves offering goods or services to people in India Government bodies, […]
What Digital Trust Means — and Why the Government Is Building It
You’ve now seen why personal data needed protecting, how big India’s digital footprint had grown, what the rest of the world was doing, and what was missing before 2023. One idea ties all of it together: digital trust. IN PLAIN TERMS TRANSPARENCY You know what’s collected And why — in language you can actually understand, […]
Before the DPDP Act: India’s Data Protection Gap
For over a decade, narrow provisions of the IT Act and SPDI Rules were doing the job a data protection Act should have been doing, they were never built for that job — here’s what it covered, and what it left out. Before: IT Act, Section 43A + SPDI Rules (2011) Applied only to “body […]
Learning from the World: Global Privacy Developments That Shaped India’s Approach
India wasn’t writing its privacy law in isolation. By 2023, most of the world already had one. Here’s what India was watching — and what it deliberately chose not to copy. THE GLOBAL PICTURE 25 MAY 2018 GDPR takes effect The EU’s General Data Protection Regulation becomes the reference point almost every later privacy law […]
India’s Digital Economy: The Story Behind the Law
By the time the DPDP Act arrived in 2023, India was already one of the most connected countries on earth. The law didn’t create this digital boom — it had to catch up to one that had already happened. Here’s how fast that boom moved. THE SCALE, IN THREE NUMBERS 109.2Cr+ Internet users India now […]
Privacy by Design: Building It In, Not Bolting It On
Everything so far has been about meeting the DPDP Act’s requirements. This is about organisations that go a step further — starting with what “privacy by design” actually means. Bolted on Privacy review happens after a product is basically finished A consent banner gets added to satisfy a legal checklist Fixing a privacy gap means […]
Writing a Notice People Actually Understand
Every consent request under the DPDP Act has to be paired with a notice. The Rules are specific about what that notice needs to say — and clarity itself is part of the requirement. A COMPLIANT NOTICE COVERS WHAT & WHY The data and the purpose Exactly what personal data is being collected, and precisely […]
From Legislation to Implementation: What the DPDP Act Means for Your Organisation
Everything so far has answered “what does the law say”. This module answers a different question: what does it actually mean for the organisation you work at? THREE STARTING QUESTIONS 1 What data do we hold? Not what you assume — what an actual inventory would show, across every system and vendor. 2 On what […]
Why the DPDP Act Needed a Separate Set of Rules
The Act was passed in August 2023. The Rules that actually explain how to follow it didn’t arrive until November 2025 — a gap of more than two years. Here’s why that gap exists. The Act Sets out principles — consent must be free, specific, informed Creates the Data Protection Board States that reasonable security […]