We align our services with the standards and protocols of India’s Data Privacy Act.
What Is the DPDP Act?
The Digital Personal Data Protection Act, 2023 (the DPDP Act), was enforced on 11 August 2023 as India’s first-ever comprehensive federal data protection law. It is a refined alternative to sectoral rules defined under the Information Technology Act, 2000, and the now-withdrawn IT (Reasonable Security Practices) rules, 2011.
The Digital Personal Data Protection Rules, 2025, were published in the Gazette on 14 November 2025. It was later transformed into concrete, operational duties, covering security safeguards, breach timelines, rights processes, children’s data verification, retention triggers, and the governance of a new intermediary class.
Who Is Covered?
The Act is applicable to the processing of digital personal data in India and extends to foreign data fiduciaries, which process data.
- Related to goods or services to individuals in India
- Profiling of individuals in India
- A US, EU, or SEA company serving in India with an app, website, or analytics stack
Data Principal Rights
These are rights to be evaluated with Indian specifics:
- Right to be informed and to give free, specific, informed, unconditional, and unmistakable consent, which can be simply withdrawn also.
- Right to access the data and the processing details.
- Right to correction of wrong or incomplete detail.
- Right to erasure to pause certain processing.
- Right to grievance redressal via a grievance officer and defined process.
- Right to nominate and make post-incident procedures for one's data (e.g., minor children's data after a parent's death).
From 13 November 2026, consent managers are designated to manage, grant, and withdraw consent across services. They are part of the architecture, with seven-year record-keeping duties on their side.
Data Fiduciary Obligations
Here is the checklist of “what-to-do” as obligations:
- Notice: It must be in a comprehensive language, drafted at or before the time of data collection in the first language.
- Purpose limitation & data minimization: Collect data only to meet the stated purpose, and stop this exercise when the purpose is served.
- Accuracy: Define the workflow for data correction and completion.
- Storage limitation/erasure: Remove data once the purpose is served. The processing logs can be protected for at least a year (unless the law requires it).
- Reasonable security safeguards (Rule 6): Follow protective measures like encryption, masking, obfuscation & access controls.
- Breach notification (Rule 7): On the revelation of a breach likely to harm, notify affected data principals without delay and submit a breach report to the DPBI within 72 hours. It can be extended only by the board.
- Children's data (under 18): Enforce verifiable parental/guardian consent, prohibiting tracking, targeted advertising, profiling of children, and processing that may harm.
- Processor contracts: Outlining terms imposing equivalent duties on processors
- Significant Data Fiduciary (SDF) duties: Organizations delegated with the task of handling data at scale, sensitivity, and risk by the Central Government may need to:
a. Carry out annual Data Protection Impact Assessments (DPIAs) and audits.
b. Report skeptical or significant audit findings to the Board.
c. Ensure no privacy violation of algorithms & technical measures.
d. Set up for possible data localization requirements for specified personal records. - Large-platform inactivity rules: For e-commerce and social media intermediaries with 20M+ users in India and online gaming intermediaries with 5M+ users, three years of inactive status may mean that the data is no longer needed. So, it must be
a. Erased when the purpose is no longer served.
b. Send the individual a 48-hour notice before erasure. - Cross-border transfers: By default, it is allowed except to countries the Central Government notifies as excluded.
How Eminenture Helps
- Applicability & role mapping: Identify your data fiduciary and processor roles, including foreign entities.
- Data mapping & classification: Safely protect personal data after discovering what it is, where it is stored, why it is used, and how long it is to store.
- Consent management: Prepare clear notices, consent, and withdrawal processes along with Consent Manager integration.
- Rights management: Define and safeguard workflows for access, correction, erasure, and grievances with proper documentation.
- Security safeguards (Rule 6): Encrypt, mask, and obfuscate and access controls based on data risks.
- Breach readiness (Rule 7): Outline procedures to detect, notify, and report breaches, including the 72-hour Board reporting requirement, supported by tabletop exercises.
- Children’s data protection: Enforce verifiable parental consent and controls for monitoring, advertising, and profiling.
- Significant Data Fiduciary (SDF) readiness: Draft DPIAs, ensure annual audits, algorithm checks, and data localization plans.
- Processor & vendor contracts: Revise contracts and privacy requirements across your vendor/client network.
- Cross-border transfers: Review permitted destinations and monitor applicable transfer requirements.