Advisory on data-processing obligations in vendor and outsourcing arrangements under DPDPA
The Digital Personal Data Protection Act 2023 (DPDPA) and the Digital Personal Data Protection Rules 2025 establish India’s comprehensive data-protection framework. The Act applies to digital personal data processed within India and to processing outside India if it relates to offering goods or services to Data Principals in India. Data Fiduciaries must obtain free, specific, informed and unambiguous consent (or rely on a “certain legitimate use” ground), implement reasonable security safeguards, appoint a Data Protection Officer where required, respond to Data Principal rights (access, correction, erasure, grievance redressal, nomination) and notify the Data Protection Board of India of breaches. Significant Data Fiduciaries bear additional obligations including Data Protection Impact Assessments, periodic audits and algorithmic transparency. AMLEGALS advises on the full lifecycle of DPDPA obligations.
Penalties under the DPDPA are tiered — up to two hundred and fifty crore rupees for failure to take reasonable security safeguards, up to two hundred crore rupees each for failure to notify a personal data breach and for breach of obligations relating to children, up to one hundred and fifty crore rupees for Significant Data Fiduciary obligations, and up to fifty crore rupees for other contraventions, as determined by the Board after inquiry. The Data Protection Board of India adjudicates complaints and imposes penalties; appeals lie to the Appellate Tribunal. The DPDP Rules 2025 prescribe Consent Manager obligations (Rule 4, net-worth requirement of two crore rupees), cross-border transfer restrictions, children’s data protections, and the procedure for breach notification. AMLEGALS maps the regulatory surface, builds advisory frameworks and represents clients before the Data Protection Board.
Mapping the organisation’s data flows, processing purposes and lawful bases under the DPDPA and identifying gaps against the Rules.
Designing notice-and-consent mechanisms, preference management dashboards and Consent Manager integration under Rule 4.
Implementing processes for access, correction, erasure, grievance redressal and nomination requests within the prescribed timelines.
Advising on breach detection, assessment, notification to the Data Protection Board and communication to affected Data Principals.
Advising on DPIA, algorithmic audits, periodic compliance reporting and Data Protection Officer appointment for SDFs.
Representing organisations before the Data Protection Board of India in complaints, penalty proceedings and appeals to the Appellate Tribunal.
The DPDPA prescribes penalties of up to two hundred and fifty crore rupees for failure to take reasonable security safeguards to prevent a personal data breach, up to two hundred crore rupees for failure to notify the Board and affected Data Principals of a breach, up to two hundred crore rupees for breach of obligations relating to children (including verifiable parental consent), up to one hundred and fifty crore rupees for breach of Significant Data Fiduciary obligations, and up to fifty crore rupees for breach of any other provision, such as notice or Data Principal rights obligations. The amount is determined by the Board after inquiry, having regard to the factors in Section 33(2).
A Consent Manager is a person registered with the Data Protection Board who acts as an intermediary between the Data Principal and the Data Fiduciary. Under Rule 4 of the DPDP Rules 2025, a Consent Manager must be a company incorporated in India with a net worth of at least two crore rupees.
The Central Government notifies certain Data Fiduciaries as Significant Data Fiduciaries based on the volume and sensitivity of personal data processed, risk to the rights of Data Principals, and other relevant factors. SDFs have additional obligations including appointing a DPO, conducting DPIAs, periodic audits and algorithmic transparency.
Yes. The DPDPA applies to the processing of digital personal data outside India if such processing is in connection with any activity related to offering goods or services to Data Principals within the territory of India, or in connection with profiling of Data Principals within India.
No. No engagement is treated as accepted until conflicts, scope and terms are confirmed in writing. An initial discussion is confidential and is used only to understand the matter and assess fit.
Share the key facts for a confidential preliminary assessment of your India matter.