Governance & Audit
← All postsData Protection Officer in India: Who Needs One and What They Do
Only Significant Data Fiduciaries must appoint a Data Protection Officer under the DPDP Act. The DPO must be based in India, represent the SDF, answer to its board and act as the point of contact for grievances. Every other fiduciary must still publish the business contact details of a DPO or another person who can answer questions about its processing. Many organisations appoint a privacy lead anyway, because someone has to own the programme.
DPIA in India: When You Need One and How to Run It
Under the DPDP Act, DPIAs are mandatory only for Significant Data Fiduciaries, which must run one every 12 months and report significant observations to the Data Protection Board (Section 10, Rule 13). Every other organisation should still assess high-risk processing before launch: children's data, large-scale profiling, new technologies and sensitive data. A good DPIA describes the processing, tests necessity, identifies risks to individuals and records the measures taken.
ReadData Retention Policy for DPDP: Delete on Schedule, Defend on Demand
Under Section 8(7) of the DPDP Act, personal data must be erased when consent is withdrawn or the purpose is no longer served, unless a law requires it to be kept. Rule 8 adds a one-year minimum for logs and related data, and a three-year inactivity limit with 48 hours' warning for large e-commerce, social media and online gaming platforms. A good retention policy assigns every purpose a period, a trigger, a legal basis for keeping and an automated erasure method.
ReadHR Records Retention in India: How Long to Keep Employee Data Under DPDP
The DPDP Act requires personal data to be erased once its purpose ends, unless a law requires it to be kept (Section 8(7)). For HR, many records are covered by such laws: wage and attendance registers under the Labour Codes (five years under the central rules), tax, provident fund and insurance records. Everything else, from unsuccessful candidates' CVs to old monitoring data, needs its own limit. A record-by-record schedule with automated deletion is the answer.
ReadBiometric Attendance Under DPDP: Fingerprints, Face Recognition and the Law
Biometric attendance is common in Indian workplaces, and the DPDP Act does not ban it. Attendance is an employment purpose under Section 7(i), but biometrics cannot be changed if they leak, so the bar for security and proportionality is high. Use templates rather than images, encrypt them, limit access, contract the device vendor properly, offer alternatives where practical and delete biometric data promptly when employees leave.
ReadEmployee Monitoring Under DPDP: What's Lawful, What's Risky
The DPDP Act allows employers to process employee data to safeguard the business from loss or liability, which covers proportionate security monitoring of company systems. It does not make every form of surveillance lawful. Keystroke logging, constant screen capture, webcam monitoring and tracking personal devices are hard to justify as necessary. Define the purpose, tell employees, collect the minimum, restrict access and set short retention.
ReadConsent Audit Trail: Prove Compliance When the Board Comes Asking
Section 6(10) of the DPDP Act puts the burden of proving notice and consent on the business. A consent audit trail is the evidence: an append-only record of every consent event, the notice version shown, the purpose, the method and every later change, including withdrawal. Making it tamper-evident, for example by hash-chaining records, turns it from a database into proof. Keep it for as long as you rely on the consent, plus the period in which it could be disputed.
ReadDPDP Compliance Checklist: A 90-Day Roadmap From Zero to Audit-Ready
A DPDP programme can reach audit-ready in roughly 90 days if work runs in parallel across six streams: governance, data mapping, notice and consent, rights and grievances, security and breach response, and vendors and retention. This roadmap sets out week-by-week tasks, owners and the evidence each step must produce, with a master checklist at the end. The deadline for most obligations is 13 May 2027.
ReadROPA Under DPDP: Map Every Data Flow Before Someone Else Does
Unlike the GDPR, the DPDP Act does not explicitly require a Record of Processing Activities. But without one, you cannot write itemised notices, tell individuals who received their data, erase it on time, scope a breach within 72 hours, or prove compliance. A DPDP ROPA records each processing activity's purpose, data, individuals, lawful basis, systems, recipients, transfers, retention and safeguards. It is the foundation every other DPDP control is built on.
ReadGet started
Get DPDP-ready, well before the deadline
See how ConsentifyAI handles consent and cookies in one place — so you can collect it properly, honour it everywhere, and prove it on demand.