Questions

The questions businesses actually ask.

Does the Act apply to you, what the penalties really cover, what a compliant cookie banner does, what Rule 3 wants in a notice, the breach clocks, and how the Act compares with GDPR and with the rules it replaced. Answer first, cited to the section.

Does the DPDP Act apply to my business?Question · Scope: Almost certainly yes. The Act applies to any processing of digital personal data within India, and to processing outside India connected with offering goods or services to people in India. There is no size, turnover or sector threshold. The only questions are which obligations apply and when they start.
DPDP Act penalties: what each band actually coversQuestion · Penalties: The Schedule sets seven bands the Board may impose under Section 33: up to Rs 250 crore for failing reasonable security safeguards, Rs 200 crore for failing to intimate a breach, Rs 200 crore for children’s data failures, Rs 150 crore for a Significant Data Fiduciary’s additional duties, Rs 10,000 for a Data Principal’s duties, and Rs 50 crore for any other breach. They are ceilings, decided after an inquiry, on the factors in Section 33(2).
Cookie consent under the DPDP ActQuestion · Consent: A compliant banner does four things: it stops every non-essential script and cookie until the visitor chooses, it offers Reject with the same effort as Accept, it asks for each purpose separately with nothing pre-ticked, and it records the choice. Most banners do none of the first three, because the trackers have already fired by the time the banner appears.
DPDP privacy notice requirements: what Rule 3 asks forQuestion · Notice: Section 5 requires a notice with or before every consent request, and Rule 3 sets what it contains: a standalone, plain-language document that itemises the personal data, states the specified purpose and what it enables, and gives the specific means to withdraw consent, exercise rights and complain to the Board. A pre-2025 privacy policy almost never meets it.
Grievance officer under the DPDP Act: publish, establish, answerQuestion · Grievance: The Act does not use the title, but it requires what the title means: a published contact of a person able to answer questions about the processing (Section 8(9)), an effective grievance mechanism (Section 8(10)), and a response within the period you publish, at most ninety days (Section 13, Rule 14). A name on a page satisfies the first and asserts the other two.
Data Processor agreements under Section 8(2)Question · Processors: Yes. Section 8(2) allows a Data Fiduciary to engage a Data Processor only under a valid contract, and Rule 6(1)(f) requires that contract to bind the Processor to reasonable security safeguards. Every SaaS tool, host, agency or vendor that processes personal data on your behalf is a Data Processor. Section 8(1) keeps you responsible for what they do.
DPDP breach reporting: the seventy-two hour clockQuestion · Breach: Two clocks. On becoming aware of a personal data breach, intimate every affected Data Principal and the Board without delay. Then, within seventy-two hours of becoming aware, send the Board a detailed report. There is no harm threshold and no encryption exception; every breach as defined in Section 2 is reported. Failure sits in the Rs 200 crore band.
DPDP Act compliance checklist, the honest oneQuestion · Checklist: A checklist asks whether things exist. The Act asks whether they do what the section requires. This list is the second kind: each item is a duty, the provision, and the test that a checklist misses. On the Readiness Index, most advisor sites passed the existence test and failed the second.
DPDP Act versus GDPR: the differences that matterComparison · DPDP and GDPR: The DPDP Act borrows the GDPR’s roles and rights and changes the machinery: two grounds for processing instead of six, no special category of sensitive data, a child at eighteen instead of sixteen, penalties in fixed rupee bands instead of a share of turnover, a blacklist for transfers instead of adequacy, and no right to compensation. A GDPR programme is a head start, not a finished job.
DPDP Act versus the 2011 SPDI Rules: what changedComparison · DPDP and SPDI: The SPDI Rules under Section 43A of the IT Act covered only sensitive personal data, required a privacy policy and reasonable security practices, and gave individuals a compensation claim. Section 44 of the DPDP Act removes Section 43A. The new regime covers all personal data, replaces the policy with an itemised notice, sets a statutory consent standard, adds breach clocks and a regulator, and replaces compensation with penalties.