Expert guides on India's Digital Personal Data Protection Act, consent management, CERT-In obligations, and privacy automation — written for compliance teams and legal officers.
Rule 8(3) requires a minimum one-year retention of personal data and processing logs — even after account deletion. Section 12 gives a right to erasure. Here is how the two obligations actually interact.
A compliant-looking cookie banner sitting on top of tags that load on first paint is a compliance failure with a compliant interface. A ten-minute DevTools test to check your own site.
The Data Protection Board exists and functions, but the substantive obligations and the entire penalty regime commence on 13 May 2027. The three commencement dates, from the gazette notifications.
Consent Mode v2 tells Google what a visitor chose. It doesn't obtain consent, doesn't produce a record you can show a regulator, and doesn't cover non-Google tags. Here's what's missing.
Rule 8(2) requires you to tell a Data Principal 48 hours before their data is erased. Read as an engineer, that is a scheduled job with a clock, a notification, a reset listener and an audit record.
Most DPDP vendors won't publish a price. What the market actually charges — global platforms, Indian entrants, consultancies and free tiers — and which cost drivers move the number.
Under the DPDP Act a Consent Manager is an entity registered with the Data Protection Board, requiring ₹2 crore net worth. Registration does not open until 13 November 2026. A CMP is software.
OneTrust is the category leader and for many organisations the right answer. For Indian mid-market businesses subject only to DPDP, it's often more platform than needed. The alternatives, including where we're not the fit.
Section 8(2) permits engaging a Data Processor only under a valid contract, and section 8(1) makes you accountable for their failures regardless of what the contract says. What a DPDP-ready DPA needs.
A genuinely free DPDP cookie consent banner: one domain, 1,000 cookie consents and 50 form consents a month, unmetered rights requests, no credit card, no expiry. Exactly what is included and what is not.
A data breach is no longer just a cybersecurity incident. For modern businesses, a single breach can become a security event, privacy incident, regulatory matter, communication exercise, legal issue, and executive crisis — all at the same time.
A factual, side-by-side look at India's Digital Personal Data Protection Act 2023 and the EU's General Data Protection Regulation — covering scope, consent standards, penalties, and where Indian businesses actually need to change their approach.
A Consent Management Platform is a lot more than a cookie banner — it's the legal and technical machinery that makes collecting and using personal data lawful under India's DPDP Act 2023.
Indian law — part of which is CERT-In's rules — says you've got to report a cybersecurity breach in under 6 hours of it being spotted, one of the tightest deadlines around the world.
A step-by-step guide for developers and compliance teams — covering DPDP Act 2023 requirements, compliant banner elements, platform implementations, and consent record keeping.
The DPDP Act 2023 grants every Indian data principal five enforceable rights. Businesses must have workflows, SLA timers, identity verification, and audit trails ready for every request — or face penalties up to ₹50 Crore per violation category.
The Digital Personal Data Protection Act 2023 creates concrete obligations for every brand that collects customer data online. This actionable 12-point checklist tells you exactly what to build, review, and automate — so you reach compliance without paralysis.
Automated data discovery is the invisible foundation beneath every DPDP obligation — from accurate ROPA records to 30-day erasure fulfilment under Section 12. If you do not know where personal data sits, you cannot safeguard it, remove it, or show proof of compliance to the Data Protection Board of India.
How do SaaS companies comply with India's DPDP Act of 2023 when they handle data from people in India? The rules touch consent, where data must sit, how to handle DSR requests, and how vendor contracts are set up.
Records of Processing Activities are the backbone of any data protection programme. Under India's DPDP Act 2023, keeping them accurate, complete, and audit-ready is non-negotiable — and automation is the only practical way to do it at scale.
India's Digital Personal Data Protection (DPDP) Act 2023, along with the DPDP Rules that MeitY has been gradually rolling out in 2025 and 2026, has completely flipped the script on privacy compliance.