Data governance for listed entities
The Digital Personal Data Protection Act 2023 (DPDPA) permits processing for a lawful purpose on consent under Section 6 or a specified certain legitimate use under Section 7, subject to its scope, exclusions and phased commencement. A Consent Manager is an optional route for the Data Principal under Section 6(7), not a compulsory intermediary for every consent. Notices, direct consent, withdrawal and purpose limitation require separate assessment. The substantive processing duties and penalty adjudication provisions are in the eighteen-month commencement phase after Gazette publication and are not yet operative. Existing obligations under other laws continue independently.
Under Section 3, the DPDPA covers digital personal data processed in India when collected digitally or digitised later, and overseas processing connected with offering goods or services to Data Principals in India, subject to statutory exclusions. Citizenship alone does not determine scope. Significant Data Fiduciary status requires Central Government notification under Section 10, taking account of the statutory factors; processing children’s data or crossing an assumed volume threshold does not itself confer that status. Once applicable and operative, additional duties include an India-based DPO, an independent data auditor, impact assessments and periodic audits.
Mapping the personal-data processing activities, determining Data Fiduciary and Data Processor roles, and building the compliance framework under the DPDPA and the DPDP Rules 2025.
Structuring direct consent, withdrawal and notices, assessing any applicable Section 7 certain legitimate use, and providing an optional Consent Manager route where chosen by the Data Principal, subject to commencement.
Assessing any Central Government notification designating an entity as a Significant Data Fiduciary and, once applicable and operative, its DPO, independent auditor, DPIA and audit duties.
Establishing the breach-notification protocol — notifying the Data Protection Board and each affected Data Principal — and coordinating the technical and legal response.
Advising on the obligations relating to processing children’s data, including verifiable parental consent and the prohibition on behavioural monitoring and targeted advertising.
Representing Data Fiduciaries and Data Processors in proceedings before the Data Protection Board of India, including responses to complaints, directions and penalty proceedings.
The Schedule to the DPDPA sets tiered ceilings: up to two hundred and fifty crore rupees for failure to take reasonable security safeguards, up to two hundred crore rupees each for failure to notify a personal data breach and for breach of obligations relating to children, up to one hundred and fifty crore rupees for breach of Significant Data Fiduciary obligations, and up to fifty crore rupees for breach of any other provision. The amount is determined by the Board after inquiry, having regard to the factors in Section 33(2). There is no provision for imprisonment.
The Central Government notifies the criteria for Significant Data Fiduciaries based on the volume and sensitivity of personal data processed, the risk to the rights of Data Principals, the potential impact on sovereignty, integrity and security of the State, and other prescribed factors. Once notified, a Significant Data Fiduciary must appoint a Data Protection Officer based in India and comply with enhanced obligations.
A Consent Manager is a person registered with the Data Protection Board under Rule 4 of the DPDP Rules 2025, with a minimum net worth of two crore rupees, who acts as a single point of contact for a Data Principal to give, manage, review and withdraw consent. The Consent Manager is accountable to the Data Principal and must interoperate with other Consent Managers.
Yes. The DPDPA applies to the processing of digital personal data outside India if the processing is in connection with any activity related to offering goods or services to Data Principals within India. This extra-territorial reach is similar in structure to the GDPR, though the specific conditions differ.
No. No engagement is treated as accepted until conflicts, scope and terms are confirmed in writing. An initial discussion is confidential and is used only to understand the matter and assess fit.
Share the key facts for a confidential preliminary assessment of your India matter.