How ready are you for DPDP?

Every DPDP duty (notices, consent, erasure, breach response) depends on knowing what you hold.

Rule 3 requires an itemised notice with links to withdraw consent, exercise rights and complain to the Board.

Consent must be free, specific, informed, unconditional and unambiguous (s.6), and withdrawal as easy as giving it.

Section 9 and Rule 10 require verifiable consent from a parent who is an identifiable adult. Penalty: up to ₹200 crore.

Rule 6 sets these as minimum safeguards. Failure carries the Act’s highest penalty: up to ₹250 crore.

Rule 7: notify the Board and each affected person without delay, then a detailed report within 72 hours. CERT-In separately expects incident reports within 6 hours.

Section 8(7) and Rule 8 require erasure when the purpose ends; Rules 6 and 8 require logs to be kept for at least a year.

You stay responsible for processors. Section 8(2) and Rule 6 require a valid contract with safeguards.

Rule 14 requires a published way to exercise rights and grievance resolution within 90 days at most.

Section 8(9) and Rule 9 require it. Significant Data Fiduciaries also need an India-based DPO and an annual audit and DPIA.