The DPDP Act, for people who have to comply with it
India's Digital Personal Data Protection Act changes who is accountable for personal data and what you have to be able to show. This is what it asks of an operating business, who it applies to, and how much of it an existing security programme already covers.
Where teams get caught out
Consent was collected, but not the way the Act means it
Most consent flows were built for a pre-DPDP world: bundled, implied, or buried in terms. The Act asks for consent that is specific, informed and given by clear affirmative action, with a notice that says what is being collected and why.
Nobody can produce the record
The obligations are hard to meet, but the harder problem is evidence. When the question comes, you need to show what you collected, on what basis, who it went to, and what you did when someone asked for it back.
It is treated as a legal exercise
A policy gets drafted and filed. Meanwhile the systems holding the data are unchanged, nobody knows where personal data sits, and no engineer has been asked to delete anything.
The obligations, grouped the way they actually land on a team
Work out which role you are in
The Act turns on roles. A Data Fiduciary decides why and how personal data is processed; a Data Processor acts on its behalf. Whether an organisation may also be designated a Significant Data Fiduciary, which carries extra duties including an appointed Data Protection Officer and independent audit, is a separate question that turns on the nature and volume of the data it handles.
Notice and consent, as a mechanism rather than a page
Consent has to be free, specific, informed and unambiguous, given by clear affirmative action, and each purpose stands on its own. Withdrawal has to be as easy as giving it. In practice that means a consent record per purpose per person, and a system that can act on a withdrawal rather than a page that records one.
Rights you have to be able to service
Data Principals can ask for access to what you hold, correction, completion and erasure, and you need a grievance route that works and a nomination mechanism. Each of these is an operational process with a clock on it, not a clause.
- A route in that a person can actually find
- An owner, so requests do not sit in a shared inbox
- A record of what was asked and what was done
Reasonable security safeguards
The Act requires reasonable security safeguards to prevent a personal data breach, and it requires you to report one. This is the clause that pulls DPDP into the same territory as an information security programme, and it is why so much of an existing ISMS carries over.
The processors you pass data to
Engaging a processor does not move the accountability. It has to be under contract, and you need to know what each one holds and what happens to it when the relationship ends. This is the same vendor inventory a security programme already keeps, asked a different way.
Deletion, and being able to prove it
Personal data is not kept indefinitely by default. Retention has to be bounded and erasure has to actually happen across systems and backups, which is an engineering problem long before it is a legal one.
If you hold ISO 27001, you are further along than you think
The safeguards, the vendor register, the access controls, the breach process and the evidence discipline an ISMS already demands are the load-bearing parts of DPDP compliance. What an ISMS does not give you is the consent record, the rights-request process and the retention position. That is the real gap, and it is a much smaller piece of work than starting from nothing.
What you should be able to show
- A record of what personal data you hold and where it sits
- Consent captured per purpose, and withdrawal that takes effect
- A rights-request route with an owner and a trail
- Processor contracts and an inventory of who holds what
- A breach process someone has actually walked through
- Bounded retention, and erasure that reaches every copy
The questions we get asked most
Does DPDP apply to us if we are outside India?
The Act reaches processing of the personal data of people in India where that processing is connected to offering goods or services to them, so being incorporated elsewhere does not by itself put you outside it. Where your own situation falls is a question for your counsel.
We already hold ISO 27001. How much of DPDP does that cover?
A substantial part of the security obligations, and much of the vendor, access and incident work. It does not cover consent, notice, rights requests or retention, which are the pieces to plan for.
Does NorthIron support DPDP today?
ISO 27001 and SOC 2 are the live frameworks. DPDP support is in development and will resolve to the same atomic control set when it ships, which is what makes the overlap above worth building on now rather than later.
Find out where you actually stand
The readiness assessment takes about two minutes and scores you across eight domains. It is not DPDP-specific yet, but the security foundations it tests are the ones every DPDP obligation rests on.