20DPDPA
Do I need a DPO under DPDPA?
Only if you are designated as a Significant Data Fiduciary (SDF) by the Central Government under Section 10 of the DPDPA. SDFs must appoint a Data Protection Officer based in India who represents the SDF before the Data Protection Board. Ordinary Data Fiduciaries are not required to appoint a DPO.
Read the full guide →Am I a Significant Data Fiduciary?
You cannot self-classify. SDF designation is exclusively by Central Government notification under Section 10(1) based on factors including volume and sensitivity of data processed, risk to Data Principals, and potential impact on sovereignty. Until notified, you are an ordinary Data Fiduciary.
Read the full guide →Does DPDPA apply to my foreign company?
Yes, if your company processes digital personal data in connection with offering goods or services to Data Principals in India. The DPDPA applies extraterritorially — you do not need a presence in India for the Act to apply. This is similar in concept to the GDPR's extraterritorial reach, though the trigger differs.
Read the full guide →Can I transfer personal data out of India?
Yes, by default. The DPDPA permits transfer to all countries unless the Central Government restricts transfer to specific countries by notification (a negative list approach). As of now, no countries have been restricted. This is the inverse of the GDPR's adequacy model.
Read the full guide →What is verifiable parental consent?
The DPDPA requires verifiable consent from a parent or lawful guardian before processing personal data of any individual under 18. The DPDP Rules, 2025 prescribe the manner of verification. "Verifiable" means the Data Fiduciary must take reasonable steps to confirm that the person providing consent is actually the child's parent or guardian.
Does DPDPA apply to employee data?
Yes. Employee personal data is covered by the DPDPA. However, processing for employment purposes (payroll, benefits, statutory compliance) may qualify as a "legitimate use" under Section 7(e), potentially reducing the consent burden. Processing beyond employment purposes (employee monitoring, analytics) requires separate consent.
Read the full guide →What happens on 13 May 2027?
Full enforcement of the Digital Personal Data Protection Act, 2023 begins on 13 May 2027. From this date, the Data Protection Board of India can receive complaints, adjudicate contraventions, and impose penalties under the Schedule. The Consent Manager framework becomes operational earlier — on 13 November 2026.
Read the full guide →Do I need consent for data I already hold?
The DPDPA requires retrospective notice (Section 5(1) proviso) for personal data collected before the Act's commencement. You must serve a notice to Data Principals informing them of the processing purposes and their rights. If the existing data was collected with consent that meets DPDPA standards, fresh consent may not be required for the same purposes. If not, fresh consent is needed.
Can consent be withdrawn and what happens then?
Yes. Section 6(6) gives every Data Principal the right to withdraw consent at any time with the same ease with which it was given. Upon withdrawal, the Data Fiduciary must cease processing and erase the personal data within a reasonable period, unless retention is required under any law. Withdrawal does not affect the legality of processing done before withdrawal.
How quickly must I report a data breach under DPDPA?
The DPDPA requires notification to the Data Protection Board "without unreasonable delay." The DPDP Rules, 2025 prescribe 72 hours as the operative benchmark. Separate intimation to affected Data Principals is also required. Every breach must be reported — there is no materiality threshold for Board notification.
Read the full guide →What is the maximum penalty under DPDPA?
INR 250 crore per contravention for failure to implement reasonable security safeguards. Other penalties include up to INR 200 crore for breach notification failure, up to INR 200 crore for children's data violations, up to INR 150 crore for SDF obligation non-compliance, and up to INR 50 crore for other obligations. These are per-contravention penalties.
Read the full guide →Am I a Data Fiduciary or a Data Processor?
If you determine the purpose and means of processing personal data, you are the Data Fiduciary. If you process data on behalf of and under the instructions of another entity, you are a Data Processor. The test is functional, not contractual — what you call yourself in a contract does not override the statutory definition.
Read the full guide →Is DPDPA the same as GDPR?
No. While both address personal data protection, the DPDPA differs from the GDPR on lawful bases (2 vs 6), breach notification thresholds, consent standards, children's data age (18 vs 16), cross-border transfer mechanisms (negative list vs adequacy), and penalty structure (fixed slabs vs revenue-based). GDPR compliance covers roughly 60% of DPDPA requirements.
Read the full guide →What is a Consent Manager under DPDPA?
A Consent Manager is a person registered with the Data Protection Board who acts as a single point of contact for Data Principals to manage their consent across multiple Data Fiduciaries. The Consent Manager framework becomes operational on 13 November 2026. Consent Managers must be registered with the Board and meet prescribed conditions.
How much does DPDPA compliance cost?
DPDPA compliance cost is driven by four factors: number of systems holding personal data, number of processing purposes, number of third-party processors, and SDF classification status. For small organisations (3-5 systems), initial build costs range from INR 15-40 lakh. For large enterprises (15+ systems, likely SDF), costs can reach INR 1-3 crore initially plus significant recurring costs.
Read the full guide →Can I use legitimate use for marketing under DPDPA?
Generally, no. Marketing does not fall within the enumerated legitimate uses under Section 7 of the DPDPA. Direct marketing, advertising, and promotional activities require consent under Section 6. This differs significantly from the GDPR, where legitimate interests can sometimes support direct marketing to existing customers.
Read the full guide →Does DPDPA give a right to erasure?
Yes. Section 12 provides the right to erasure. Upon request (or upon withdrawal of consent, or when the purpose is fulfilled), the Data Fiduciary must erase personal data and direct the Data Processor to do the same, unless retention is required under any law. The right is not absolute — legal retention requirements override it.
Do Data Principals have duties under DPDPA?
Yes. Section 15 imposes duties on Data Principals: (a) comply with applicable laws when exercising rights, (b) not register false or frivolous grievances, (c) not furnish false particulars or suppress material information, (d) not impersonate another person. Breach of duties can attract a penalty of up to INR 10,000.
Where do I appeal a DPDPA Board order?
Appeals against orders of the Data Protection Board of India lie to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT). This is different from the GDPR framework where appeals go to national courts. The TDSAT has experience with regulatory disputes but is a new appellate forum for data protection matters.
15GST
What do I do when I receive a GST summons?
A GST summons under Section 70 is a legal obligation to attend and produce documents. You cannot ignore it. First, verify the DIN on the CBIC portal. Second, check what documents are demanded. Third, consult with counsel before attending. Fourth, remember that your statement under Section 70 has evidentiary weight and can be used against you.
Read the full guide →Can the department attach my bank account?
Yes, under Section 83 of the CGST Act, the Commissioner can provisionally attach any property including bank accounts during the pendency of proceedings under Sections 62, 63, 64, 67, 73, or 74. However, the attachment expires automatically after one year, and you can file an objection under Rule 159(5) within seven days.
Read the full guide →Why is my ITC blocked?
Your Input Tax Credit is likely blocked under Rule 86A of the CGST Rules. The Commissioner can restrict ITC if there are reasons to believe it was availed on fake invoices, from non-existent suppliers, or in contravention of Section 16. The restriction expires after one year automatically. Challenge through a writ petition under Article 226.
Read the full guide →What is Section 74A?
Section 74A is the new unified GST demand provision introduced by the Finance (No. 2) Act, 2024. It replaces the dual-track system of Section 73 (non-fraud, 3-year limitation) and Section 74 (fraud, 5-year limitation) with a single section having a 42-month limitation period. It applies to FY 2024-25 onwards.
Read the full guide →Can I still appeal to GSTAT?
Yes. The GST Appellate Tribunal became operational on 24 September 2025. You can now file appeals under Section 112 against orders of the First Appellate Authority. The limitation period is three months from the date of communication, extendable by one month. Pre-deposit of 20% of disputed tax is required.
Read the full guide →What is the pre-deposit for a GST appeal?
For the First Appeal (Section 107): full admitted tax + 10% of disputed tax (cap: INR 25 crore CGST, INR 25 crore SGST). For the Tribunal (Section 112): full admitted tax + 20% of disputed tax (cap: INR 50 crore CGST, INR 50 crore SGST). The pre-deposit is mandatory and cannot be waived.
Read the full guide →Can I file a writ instead of an appeal?
After GSTAT became operational on 24 September 2025, High Courts apply the doctrine of alternative remedy more strictly. Writ jurisdiction is typically exercised only for: vires challenges, jurisdictional errors, natural justice violations, or action without authority. For merits-based challenges, the GSTAT appeal is the correct forum.
Read the full guide →What happens if I ignore a show cause notice?
If you do not respond to a GST show cause notice, the proper officer can pass an ex parte order determining the tax liability without your input. This order will include the full demanded tax, interest, and penalty. You lose the opportunity to present your defence, and while the order is appealable, you start from a significantly weaker position.
My GST registration is cancelled. What do I do?
Apply for revocation within 90 days using Form REG-21 after filing all pending returns and paying outstanding dues. The timeline can be extended up to 270 days total. If the window is missed, a writ petition is the only route. Cancellation stops your ability to issue tax invoices, claim ITC, and file returns.
Read the full guide →What is the difference between Section 73 and 74?
Section 73 covers non-fraud cases (3-year limitation, 10% penalty). Section 74 covers fraud, suppression, or wilful misstatement cases (5-year limitation, 100% penalty). Both continue to apply for FY 2017-18 through FY 2023-24. For FY 2024-25 onwards, both are replaced by Section 74A.
Read the full guide →Does provisional attachment expire?
Yes. Section 83(2) provides that provisional attachment ceases to have effect after one year from the date of the order. This is automatic and by operation of law. The bank must release the account after one year regardless of whether the department has passed a final order.
Read the full guide →Does Rule 86A ITC blocking have a time limit?
Yes. Rule 86A(3) provides that the restriction ceases after one year from the date of imposition. The credit must be unblocked automatically. There is no provision for renewal or extension under the existing framework.
Read the full guide →Is the pre-deposit refundable if I win?
Yes. Under Section 115 of the CGST Act, if the appeal is decided in your favour, the pre-deposit is refundable with interest at 6% per annum from the date of deposit to the date of refund.
What if my e-way bill expired in transit?
Goods with an expired e-way bill face detention under Section 129. The vehicle, goods, and documents can be detained until penalty is paid or security is furnished. You can seek release by paying the applicable penalty or by furnishing security. Challenge the detention if the expiry was due to circumstances beyond your control.
Can I challenge a GST demand as time-barred?
Yes. If the show cause notice was issued beyond the limitation period (3 years for Section 73, 5 years for Section 74, 42 months for Section 74A from the due date of annual return), the demand is without jurisdiction. Time-bar is a jurisdictional issue that can be raised at any stage and is a strong ground for a writ petition.
5Customs
My goods have been seized by Customs. What now?
Apply for provisional release under Section 110A immediately. You will need to execute a bond with bank guarantee. Simultaneously, check the six-month deadline under Section 110(2) — the department must issue a show cause notice within this period or return the goods. Demurrage adds cost every day, so speed is critical.
Read the full guide →Do my imports need BIS certification?
Check whether your product falls under any Quality Control Order issued under Section 16 of the BIS Act, 2016. Over 650 products across 200+ QCOs now require BIS certification (ISI mark or CRS registration) before import clearance. Goods arriving without valid BIS certification face detention, seizure, or re-export.
Read the full guide →What is an SVB investigation?
Special Valuation Branch proceedings are triggered when you import from a related party. The SVB examines whether the relationship has influenced the transaction value. If it concludes the price is not at arm's length, it issues a loading order adding a percentage to your declared value for duty purposes, which applies to all future consignments.
Read the full guide →Who pays demurrage during customs seizure?
The importer bears demurrage and container detention charges during seizure. These accrue from the date the free period expires. For a 20-foot container, costs can reach INR 5-8 lakh over 60 days. Filing for provisional release on Day 1 stops the commercial clock while the statutory process continues.
Read the full guide →How is the bond for provisional release calculated?
Bond value typically covers: assessable value of goods + estimated duty differential + potential penalty + estimated redemption fine. Bank guarantee is usually 25-50% of the bond for dutiable goods, up to 100% for restricted goods. The exact amount is determined by the adjudicating authority based on the nature of the case.
Read the full guide →5Contracts
Is my NDA enforceable in India?
An NDA is enforceable in India as a contract under the Indian Contract Act, 1872, provided it meets the requirements of a valid contract: free consent, lawful object, and consideration. The key enforceability issues are: overbroad scope (courts may hold unreasonable restrictions void), perpetual duration (Indian courts prefer reasonable time limits), and injunctive relief availability (specific performance of negative covenants is available under Section 42 of the Specific Relief Act).
What is a valid arbitration clause under Indian law?
Under the Arbitration and Conciliation Act, 1996, an arbitration clause must: (a) be in writing, (b) clearly express the parties' intention to submit disputes to arbitration, (c) specify the seat of arbitration (this determines the supervising court), and (d) ideally specify the number of arbitrators and the appointing authority. Pathological clauses (ambiguous, contradictory) are the most common source of enforcement problems.
Do I need a data processing agreement?
Under the DPDPA, while the statute does not use the term "data processing agreement," the Data Fiduciary remains responsible for processing carried out by the Data Processor. Contractual documentation governing the Processor's obligations, security measures, breach notification, audit rights, and data return/deletion is essential for risk allocation. Under the GDPR, a written DPA is mandatory.
Read the full guide →Who owns IP created by a vendor?
Under Indian law (Copyright Act, 1957 and Patents Act, 1970), the default position is that the creator owns the IP unless there is a written assignment. For works made in the course of employment, the employer owns the copyright (Section 17). For commissioned works and vendor-created IP, ownership must be explicitly assigned in the contract. Without an assignment clause, the vendor retains IP rights.
Can I terminate for convenience under Indian law?
Indian law does not inherently provide a right to terminate for convenience. Unlike common law jurisdictions where this right may be implied, Indian contract law requires the right to be expressly stated in the agreement. Without a termination for convenience clause, unilateral termination without cause may constitute breach, exposing the terminating party to damages.
5Foreign Investment
Should I set up a branch or subsidiary in India?
A subsidiary (separate Indian company) offers limited liability, lower tax rates (22% vs 40%), and full operational flexibility. A branch office is simpler to set up but carries unlimited parent liability and higher tax rates. A liaison office has the narrowest scope — no commercial activity permitted. The choice depends on intended activities, liability appetite, and tax planning.
Read the full guide →Does my investment qualify for the automatic route?
Most sectors permit 100% FDI under the automatic route (no government approval needed). Key exceptions requiring government approval include: defence (above 74%), media/broadcasting (above 49%), multi-brand retail (51% cap), and telecommunications. Check the FDI Policy (consolidated annually by DPIIT) for your specific sector and activity.
What can a liaison office actually do in India?
A liaison office is limited to: representing the parent company, promoting exports/imports, promoting technical or financial collaborations, and acting as a communication channel. It cannot engage in commercial, trading, or industrial activity and cannot earn income in India. Violating these restrictions invites tax consequences (PE risk) and regulatory action.
Read the full guide →How do I repatriate profits from India?
For a subsidiary: dividend payments to the foreign parent (no Dividend Distribution Tax post-2020, but TDS under Section 195 applies). For a branch office: profits after tax can be freely remitted through the AD bank. For both: ensure compliance with transfer pricing regulations to avoid adjusted assessments that increase tax outflow.
What creates a Permanent Establishment in India?
Under most tax treaties, a PE is created by: a fixed place of business (office, factory, workshop), a building or construction site exceeding a specified duration, a dependent agent who habitually exercises authority to conclude contracts, or substantial equipment. A branch office creates a PE by definition. A subsidiary generally does not, unless it acts as a dependent agent.
Question Not Listed Here?
These are the starting sixty. If your question is not here, it probably deserves a conversation, not a paragraph.
Ask Us Directly