Everything you need to know about DPDP
Comprehensive guides, practical strategies, and expert insights on India's data protection landscape. From compliance fundamentals to role-specific guidance.
Start here
Essential reading to understand DPDP fundamentals.
Browse articles
Everything we've published, filterable by topic.
Data Protection Officer in India: Who Needs One and What They Do
Only Significant Data Fiduciaries must appoint a Data Protection Officer under the DPDP Act. The DPO must be based in India, represent the SDF, answer to its board and act as the point of contact for grievances. Every other fiduciary must still publish the business contact details of a DPO or another person who can answer questions about its processing. Many organisations appoint a privacy lead anyway, because someone has to own the programme.
ReadDPDP Act for SaaS and IT Services Companies: A Compliance Guide
SaaS and IT services firms are usually Data Processors for their customers' data and Data Fiduciaries for their own: leads, users, employees and product analytics. Under the DPDP Act, customers stay liable and will push obligations down through contracts, so DPDP readiness becomes a sales requirement. Using customer data to train AI features can turn you into a fiduciary. Indian firms processing foreign individuals' data for foreign clients may fall within the Section 17(1)(d) exemption, but security duties remain.
ReadDPDP Act for E-commerce and D2C Brands: A Compliance Guide
For e-commerce and D2C brands, the DPDP Act bites hardest on marketing, cookies and retention. Order data can be processed to fulfil orders, but promotions, retargeting and ad audiences need consent. Marketplaces with two crore or more Indian users must erase inactive users' data after three years with 48 hours' notice. Sellers, logistics partners and payment gateways must be governed by contract, and consent flows must avoid the dark patterns India's consumer regulator prohibits.
ReadDPDP Act for Insurance Companies: A Compliance Guide
Insurers process health, financial and family data at scale, through long chains of agents, brokers, banks, TPAs and hospitals. The DPDP Act applies on top of IRDAI rules. Policy and claims processing can generally rely on data customers provide for that purpose, but cross-selling, lead buying and intermediary sharing need care. Records rules from IRDAI survive erasure requests, and large insurers should prepare as likely Significant Data Fiduciaries.
ReadDPDP Compliance Cost: What an SME Should Actually Budget For
There is no fixed price for DPDP compliance. Cost depends on how much personal data you hold, how many systems and vendors it touches, your channels, whether you process children's data, and where you start. The main components are internal time, tooling, legal review, engineering integration, training and ongoing operations. The biggest savings come from collecting less data and acting early, not from cutting corners.
ReadBuild vs Buy Consent Management: The Real Cost of Doing It In-House
A DPDP-ready consent system is far more than a checkbox and a database column. It needs a purpose registry, versioned multilingual notices, a consent ledger, withdrawal propagation, parental consent, cookie handling, rights requests and a tamper-evident audit trail, all maintained as the Rules and guidance evolve. Building can make sense for organisations with unusual needs and spare engineering capacity. For most, buying is faster and cheaper over three years.
ReadDPIA in India: When You Need One and How to Run It
Under the DPDP Act, DPIAs are mandatory only for Significant Data Fiduciaries, which must run one every 12 months and report significant observations to the Data Protection Board (Section 10, Rule 13). Every other organisation should still assess high-risk processing before launch: children's data, large-scale profiling, new technologies and sensitive data. A good DPIA describes the processing, tests necessity, identifies risks to individuals and records the measures taken.
ReadCross-Border Data Transfers Under DPDP: Where Your Data Can Go
The DPDP Act takes a permissive, negative-list approach to transfers: personal data may go outside India unless the government restricts a specific country (Section 16). Rule 15 lets the government set requirements on making data available to foreign states. But stricter sector rules still apply, including RBI's payment data localisation, and Significant Data Fiduciaries may face specified localisation. Know where every vendor stores and accesses your data.
ReadData Retention Policy for DPDP: Delete on Schedule, Defend on Demand
Under Section 8(7) of the DPDP Act, personal data must be erased when consent is withdrawn or the purpose is no longer served, unless a law requires it to be kept. Rule 8 adds a one-year minimum for logs and related data, and a three-year inactivity limit with 48 hours' warning for large e-commerce, social media and online gaming platforms. A good retention policy assigns every purpose a period, a trigger, a legal basis for keeping and an automated erasure method.
ReadGuides for your role
Find the DPDP guidance written for what you're responsible for.
Guides for your industry
Sector-specific compliance guidance, from banking to edtech.
Get started
Get DPDP-ready, well before the deadline
See how ConsentifyAI handles consent and cookies in one place — so you can collect it properly, honour it everywhere, and prove it on demand.