For practising company secretaries
DPDP compliance for practising company secretaries
By Suryansh Sagar, founder of Gevox. Last updated 6 October 2026.
The DPDP Act gives a company’s board a new set of questions, who is accountable, what has been done and what is still open, and the company secretary is the person expected to answer them. Gevox keeps that record for each client company: the obligations that apply, the rights and breach registers with their clocks, and a report the board can read.
From the Gevox Readiness Index: Of twenty Indian firms that sell DPDP advice, sixteen run their own contact or intake forms through a third party without naming it. The technical obligations are the ones that get missed.
Where accountability sits
Under Section 8 the company, as Data Fiduciary, is responsible for compliance for processing done by it or on its behalf by a Data Processor, whatever any contract says. Outsourcing the processing does not outsource the responsibility. That is a board matter, and it is the sentence that turns a DPDP question from an IT question into a secretarial one.
Where the Central Government notifies a company as a Significant Data Fiduciary, Section 10 requires a Data Protection Officer based in India and responsible to the board of directors, an independent data auditor, and periodic impact assessments and audits. Rule 13 sets those at once in every twelve months. No company has been notified yet, so no such cycle has started.
The records a board will ask to see
The Act does not prescribe registers the way company law does, so the records are the company’s evidence rather than statutory forms. A board will still want the same things: what personal data the company processes and why, which processors receive it under what contract, which requests from individuals are open and how long each has left of the ninety days in Rule 14, and whether any breach has been reported within the seventy-two hours in Rule 7.
- An obligation register, dated, showing what applies to this company and what is evidenced.
- A rights register and a breach register, each with its statutory clock computed live, not typed.
- A gap assessment the board can read, and a monthly report of what has moved since.
- On Suite, a compliance file that exports the whole record when an auditor or the Board asks for it.
Two bodies called the Board
One point of language worth getting right in board papers. The Data Protection Board of India is the regulator. Under Rule 13, a Significant Data Fiduciary’s auditor reports significant observations to the Data Protection Board, not to the company’s board of directors. Board papers that merge the two will mislead the reader about who is being told what.
Questions practitioners ask
- Does the DPDP Act require statutory registers like the Companies Act?
- No prescribed forms. A company keeps records as evidence of compliance: what it processes and why, its processors, its rights requests and its breaches. Gevox keeps those per client company with the statutory clocks computed live.
- Does every company need a Data Protection Officer?
- No. A Data Protection Officer is required of a Significant Data Fiduciary, which is a company the Central Government notifies. Other companies must publish the contact of a person who can answer questions about their processing.
- Who is responsible if a vendor mishandles the data?
- The company remains responsible as Data Fiduciary for processing done on its behalf by a Data Processor, irrespective of any contrary agreement.
- What can I show a client’s board?
- A gap assessment written for a board reader, a monthly report of what moved, and on Suite a compliance file export of the whole record.
Read next
Start with three clients
Run a real engagement on Gevox for thirty days, then decide.
The Starter Pass is Rs 999 once, for 3 client workspaces with every module unlocked. After that, Suite is Rs 375 per client each month.
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.