Moving from informal privacy to statutory accountability
For over a decade, many Indian technology businesses operated with little more than a generic privacy policy copied from a foreign website. The Digital Personal Data Protection Act fundamentally changes this posture. Under the Act, any business that determines the purpose and means of processing personal data is classified as a Data Fiduciary, carrying direct statutory liabilities that cannot be disclaimed through website terms.
Compliance is not achieved simply by uploading a new legal document to your website footer. It requires operational alignment across your engineering, product, customer support, and vendor management teams:
- Purpose limitation: Personal data may only be processed for specific, lawful purposes explicitly notified to the individual (the Data Principal) before or at the time of collection.
- Unbundled, granular notices: Notice must be provided in clear language, specifying what data is collected, for what exact purpose, how rights can be exercised, and how to file a complaint with the Data Protection Board.
- Demonstrable consent: Where processing relies on consent, the burden of proof rests on the Data Fiduciary to show that consent was free, specific, informed, unconditional, and unambiguous with a clear affirmative action.
- Mandatory breach reporting: In the event of a personal data breach, the Data Fiduciary must intimate the Data Protection Board of India and notify every affected individual without delay.
Who must comply? Distinguishing roles under the Act
The law establishes distinct legal categories. Correctly identifying your role in each data processing activity is the first step of our assessment:
| Role under DPDP | Definition & Operational Context | Core Statutory Duties |
|---|---|---|
| Data Fiduciary | Any person or entity that determines the purpose and means of processing personal data (e.g. an e-commerce company, a B2B SaaS handling its own user accounts, an employer). | Issuing notices, collecting valid consent, securing data, managing rights requests, executing processor contracts, and reporting breaches. |
| Data Processor | Any person or entity that processes personal data on behalf of a Data Fiduciary under a valid contract (e.g. a cloud infrastructure host, customer support SaaS, analytics provider). | Processing data only under the instructions of the Data Fiduciary, maintaining technical safeguards, and notifying the Fiduciary of any security incident. |
| Significant Data Fiduciary (SDF) | Organisations notified by the Central Government based on factors such as volume of personal data, risk of harm, potential impact on sovereignty, or use of new technologies. | Must appoint a resident Data Protection Officer (DPO), engage an independent data auditor, carry out periodic Data Protection Impact Assessments (DPIA), and maintain comprehensive audit trails. |
The DPDP Act and Rules follow a phased implementation schedule notified by MeitY. While foundational administrative rules establishing the Data Protection Board take effect early, substantive compliance mandates for Data Fiduciaries (including notices, consent workflows, and breach reporting) operate on phased rollout windows (ranging from 12 to 18 months from official notification). We structure your roadmap so your team builds controls systematically without rushing engineering sprint cycles.
The seven core pillars of our DPDP compliance support
Our engagements address the concrete operational requirements of the Act across seven areas:
-
1. Personal data inventory & flow mapping
We trace how personal data enters your organisation (web forms, mobile SDKs, APIs, offline sign-ups), where it is stored (databases, object storage, third-party SaaS), who has access to it, and how it flows to external vendors.
-
2. Notice and consent architecture review
We review your public notices and in-product consent touchpoints. We help product teams replace bundled, take-it-or-leave-it consent with clear, itemised purposes, and design straightforward mechanisms for users to withdraw consent.
-
3. Data principal rights & grievance redressal
Individuals have statutory rights to obtain a summary of their personal data, seek correction or completion of inaccurate records, request erasure, and register grievances. We design internal routing workflows and SLAs for these requests.
-
4. Data retention schedules & automated deletion
Under Section 8(7), once the specified purpose is served or consent is withdrawn, personal data must be erased unless retention is required under other statutory laws (such as tax or financial record-keeping mandates). We establish clear retention matrices.
-
5. Subprocessor & vendor contract audit (DPAs)
A Data Fiduciary remains accountable for actions taken by its processors. We audit your third-party SaaS tools, cloud providers, and contractors, ensuring valid Data Processing Agreements (DPAs) are executed with clear confidentiality and audit clauses.
-
6. Technical security safeguards (Section 8(5))
The Act mandates reasonable security safeguards to prevent personal data breaches. We evaluate encryption at rest and in transit, multi-factor authentication on administrative consoles, role-based access controls, and logging practices.
-
7. Incident & personal data breach readiness (Rule 7)
In the event of a personal data breach, organisations must submit an initial intimation and a detailed report within 72 hours to the DPBI and affected individuals. We create playbooks, severity classification guidelines, and draft notification templates.
Dedicated DPDP service modules
Depending on your current state of readiness, you can engage our advisory team for a focused diagnostic or an end-to-end implementation programme:
DPDP Gap Assessment
A diagnostic review of your current databases, vendor tools, notices, and internal security controls. Delivers a prioritized risk register and a 30-60-90 day remediation roadmap.
DPDP Implementation Support
Hands-on operational support: drafting customized policy suites, reviewing product consent UI, establishing rights request ticketing, and structuring vendor DPAs.
DPDP for SaaS Companies
Specialized advisory for multi-tenant software platforms. Addresses customer data boundaries, product telemetry, subprocessor lists, and enterprise vendor security questionnaires.
Data Breach Response Planning
Establishing incident response protocols, evidence preservation procedures, communication workflows, and tabletop exercises to ensure 72-hour readiness under Rule 7.
What your organisation receives
Every DPDP engagement concludes with documented working artifacts tailored to your business, not generic boilerplate templates:
- Data Flow & Asset Inventory mapping personal data inputs, processing logic, database repositories, and outbound transfers.
- Clause-by-Clause Gap Assessment Report detailing current compliance status against statutory requirements.
- Executive Risk Register prioritising operational gaps by likelihood, regulatory exposure, and engineering complexity.
- Consent & Notice Architecture Guide providing exact wording and UX recommendations for sign-up funnels and cookie banners.
- Data Principal Rights SOP detailing step-by-step procedures, identity verification rules, and response templates.
- Vendor Due Diligence Framework including a vendor risk questionnaire and Data Processing Agreement (DPA) templates.
- Data Retention & Disposal Matrix outlining statutory retention minimums and deletion schedules.
- Incident Escalation Playbook aligned with Rule 7 reporting formats and DPBI notification requirements.
3 Arrows Consulting provides operational, technical, and management consulting to help companies build and maintain privacy controls. We collaborate closely with your appointed in-house or external legal counsel. Our services do not constitute formal legal representation or legal advocacy before courts or regulatory tribunals. Where a novel statutory question requires formal legal opinion, we highlight the requirement and work alongside your qualified legal advisors.
Frequently asked questions about DPDP compliance
Does the DPDP Act apply if our company only has B2B corporate clients?
Yes. Even pure B2B organisations process personal data: employees' details, job applicants, business contact details of client representatives, website visitors, and billing contacts. Furthermore, if you host or process end-user personal data on behalf of your B2B customers, you act as a Data Processor under the Act and must maintain rigorous contractual and security safeguards.
Can we rely on existing GDPR documentation for Indian DPDP compliance?
While an existing GDPR programme provides a good foundation, it cannot be adopted without modification. The Indian DPDP Act differs in key aspects: it has distinct statutory notice requirements, does not recognise "legitimate interests" in the broad European sense for commercial processing, requires specific mechanisms for children's data verification, and imposes unique 72-hour breach reporting rules under Rule 7 with significant statutory penalties.
How long does a DPDP gap assessment typically take?
For a typical startup or mid-sized software company with 1 to 3 primary applications, a comprehensive gap assessment takes between 2 to 3 weeks from kick-off to final deliverable presentation. Larger enterprises with complex legacy infrastructure or multiple business divisions typically require 4 to 6 weeks.
What internal team members need to be involved in the assessment?
A typical engagement involves short, structured discovery interviews (typically 45 to 60 minutes each) with key functional owners: engineering/DevOps leads (for data storage and security controls), product managers (for notice and consent UI), HR/admin leads (for employee data), and legal or procurement managers (for vendor agreements).