DPDP

Requirements and controls

• Chapter II Obligations of Data Fiduciary

  • s. 4 Grounds for processing personal data

    Personal data is processed only for a lawful purpose, either with the individual's consent or for one of the legitimate uses the Act recognises.

    • Data Protection Policy & Procedure
    • Personal Data Inventory
    • Consent Management

  • s. 5 Notice

    • s. 5(1) Notice with every consent request

      Each request for consent comes with or after a notice describing the personal data and the purpose, how to withdraw consent and exercise rights, and how to complain to the Data Protection Board.

      • Published Privacy Policy
      • Privacy Notices on Data Collection Forms
      • Consent Management

    • s. 5(2) Notice for consent given before commencement

      People who consented before the Act took effect receive, as soon as reasonably practicable, a notice of the data and purpose, their rights and how to complain, and processing may continue until they withdraw.

      • Published Privacy Policy
      • Consent Management
      • Personal Data Inventory

    • s. 5(3) Notice language options

      Individuals can read the notice in English or in any language listed in the Eighth Schedule to the Constitution.

      • Published Privacy Policy
      • Privacy Notices on Data Collection Forms

    • r. 3 Content and form of the notice

      The notice can be understood on its own, uses clear and plain language, itemises the personal data and the specific purposes and services, and gives a link and other means to withdraw consent, exercise rights and complain to the Board.

      • Privacy Notices on Data Collection Forms
      • Published Privacy Policy
      • Consent Management

  • s. 6 Consent

    • s. 6(1) Valid consent

      Consent is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action and limited to the data needed for the stated purpose, and any part of it that breaches the law is void.

      • Consent Management
      • Personal Data Inventory
      • Privacy by Design Policy

    • s. 6(3) Plain-language consent requests with a contact point

      Consent requests use clear and plain language, are available in English or a scheduled language, and give the contact details of the Data Protection Officer or another person authorised to respond to the individual.

      • Consent Management
      • Privacy Notices on Data Collection Forms
      • Privacy Officer

    • s. 6(4) Withdrawal of consent

      Individuals can withdraw consent at any time as easily as they gave it, after which the organization and its processors stop processing within a reasonable time unless the law requires or permits it.

      • Consent Management
      • Processor Data Protection Agreements
      • Data Subject Requests

    • s. 6(7) Consent through a Consent Manager

      Individuals may give, manage, review or withdraw consent through a Consent Manager registered with the Board, so consent and withdrawals received that way must be handled like direct ones.

      • Consent Management

    • s. 6(10) Proof of notice and consent

      Where processing relies on consent, the organization must be able to prove that it gave the notice and obtained consent as the Act and Rules require.

      • Consent Management
      • Personal Data Inventory

  • s. 7 Legitimate uses without consent

    Processing without consent is limited to the uses the Act lists, such as data an individual volunteered for a specified purpose without objecting, legal obligations, court orders, medical emergencies, disasters and employment-related purposes.

    • Personal Data Inventory
    • Data Protection Policy & Procedure

  • s. 8 General obligations of Data Fiduciary

    • s. 8(1) Accountability for all processing

      The organization is responsible for complying with the Act for all processing done by it or by a processor on its behalf, whatever any agreement says and even if the individual fails in their own duties.

      • Data Protection Policy & Procedure
      • Privacy Officer
      • Information Security & Privacy Policies

    • s. 8(2) Processors only under a valid contract

      Data Processors handle personal data on the organization's behalf only under a valid contract.

      • Processor Data Protection Agreements
      • Vendor Management Policy & Procedure
      • Third-Party Criticality Assessments

    • s. 8(3) Accuracy for decisions and disclosures

      Personal data likely to be used for a decision about an individual, or disclosed to another Data Fiduciary, is kept complete, accurate and consistent.

      • Personal Data Inventory
      • Data Subject Requests

    • s. 8(4) Technical and organisational measures

      Appropriate technical and organisational measures are in place so that the Act and the Rules are observed effectively.

      • Data Protection Policy & Procedure
      • Privacy by Design Policy
      • Information Security & Privacy Policies
      • Internal Audit

    • s. 8(5) Reasonable security safeguards

      Reasonable security safeguards protect personal data in the organization's possession or control, including data handled by its processors, to prevent personal data breaches.

      • Encryption of Data at Rest
      • Transmission Confidentiality
      • Production Database Access Restriction
      • Multi-Factor Authentication
      • Centralized Security Logging

    • r. 6 Minimum security safeguards

      Safeguards include at least encryption, masking or tokenisation, access control over computer resources, logging and monitoring that can detect and investigate unauthorised access, backups for continued processing, one-year retention of those logs, security terms in processor contracts and supporting organisational measures.

      • Encryption of Data at Rest
      • Production Database Access Restriction
      • Centralized Security Logging
      • Data Backups
      • Processor Data Protection Agreements
      • Unauthorized Activity Monitoring

    • s. 8(6) Intimation of personal data breaches

      Every personal data breach is reported to the Data Protection Board and to each affected individual in the form and manner the Rules prescribe.

      • Breach Risk Assessment & Notification
      • Data Breach Notification Policy
      • PII Breach Notification Guidelines
      • Incident Tracking

    • r. 7(1) Intimation to affected individuals

      Affected individuals are told without delay, in plain language through their account or registered contact, what happened, the likely consequences for them, the mitigation under way, the steps they can take and whom to contact.

      • Breach Risk Assessment & Notification
      • PII Breach Notification Guidelines
      • Data Breach Notification Policy

    • r. 7(2) Intimation to the Board within 72 hours

      The Board receives a description of the breach without delay and, within 72 hours of the organization becoming aware unless the Board extends it, a detailed report on causes, mitigation, findings about who caused it, remedial measures and the notices sent to individuals.

      • Breach Risk Assessment & Notification
      • Data Breach Notification Policy
      • Incident Tracking
      • Incident Management Policy & Procedure

    • s. 8(7) Erasure when the purpose is served

      Unless the law requires retention, personal data is erased, and processors are made to erase it, once consent is withdrawn or it is reasonable to assume the specified purpose is no longer served.

      • Data Retention Policy
      • Data Subject Requests
      • Processor Data Protection Agreements
      • Media Disposal Policy

    • r. 8(1) Erasure after inactivity for listed platforms

      Large e-commerce, online gaming and social media platforms listed in the Third Schedule erase personal data after three years without contact from the individual, and warn the individual at least 48 hours before erasure.

      • Data Retention Policy
      • Data Subject Requests

    • r. 8(3) One-year retention of processing logs

      Personal data, traffic data and logs of each processing activity are kept for at least one year so they are available for the government purposes listed in the Seventh Schedule, then erased unless another law requires longer retention.

      • Centralized Security Logging
      • Data Retention Policy

    • s. 8(9) Published contact for processing questions

      The business contact details of the Data Protection Officer, or of a person able to answer questions about the processing, are published.

      • Privacy Officer
      • Published Privacy Policy

    • r. 9 Prominent display of the contact details

      Those contact details are shown prominently on the website or app and included in every response to a request to exercise rights.

      • Privacy Officer
      • Published Privacy Policy
      • Conspicuous Privacy Notice Link

    • s. 8(10) Grievance redressal mechanism

      An effective mechanism is in place to redress the grievances of individuals.

      • Privacy Grievance Redressal
      • Privacy Officer

  • s. 9 Processing of personal data of children

    • s. 9(1) Verifiable parental or guardian consent

      Before processing personal data of a child, or of a person with a disability who has a lawful guardian, verifiable consent of the parent or guardian is obtained.

      • Children's Personal Data Safeguards
      • Consent Management

    • r. 10 Verifying the parent

      Technical and organisational measures check that the person consenting as a parent is an identifiable adult, using reliable identity and age details already held or provided, including virtual tokens issued by authorised entities.

      • Children's Personal Data Safeguards

    • r. 11 Verifying a lawful guardian

      When a guardian consents for a person with a disability, due diligence confirms the guardian was appointed by a court, a designated authority or a local level committee.

      • Children's Personal Data Safeguards

    • s. 9(2) No processing harmful to children

      Children's personal data is not processed in ways likely to harm their well-being.

      • Children's Personal Data Safeguards
      • Data Protection Impact Assessments

    • s. 9(3) No tracking or targeted advertising of children

      Children are not tracked, behaviourally monitored or targeted with advertising, except for the classes of fiduciaries and purposes the Rules exempt.

      • Children's Personal Data Safeguards

  • s. 10 Additional obligations of Significant Data Fiduciary

    • s. 10(2)(a) Data Protection Officer in India

      A Significant Data Fiduciary appoints a Data Protection Officer based in India, answerable to its board, who is the point of contact for grievances.

      • Privacy Officer
      • Privacy Grievance Redressal

    • s. 10(2)(b) Independent data auditor

      A Significant Data Fiduciary appoints an independent data auditor to evaluate its compliance with the Act.

      • Internal Audit
      • Security & Privacy Program Review

    • s. 10(2)(c) Periodic impact assessment and audit

      A Significant Data Fiduciary carries out periodic data protection impact assessments and audits and any other measures the Rules prescribe.

      • Data Protection Impact Assessments
      • Internal Audit

    • r. 13(1) Yearly assessment and audit reported to the Board

      Every twelve months a Significant Data Fiduciary completes a data protection impact assessment and an audit, and the person who carried them out gives the Board a report of significant observations.

      • Data Protection Impact Assessments
      • Internal Audit

    • r. 13(3) Due diligence on algorithmic software

      A Significant Data Fiduciary checks that the technical measures it uses to handle personal data, including algorithmic software, are not likely to put individuals' rights at risk.

      • Data Protection Impact Assessments
      • Privacy by Design Policy

    • r. 13(4) Keeping specified data in India

      A Significant Data Fiduciary ensures that personal data specified by the Central Government, and the traffic data about its flow, is not transferred outside India.

      • Cross-Border Data Transfers

• Chapter III Rights and duties of Data Principal

  • s. 11 Right to access information about personal data

    Individuals who gave consent can obtain a summary of their personal data and its processing, the identities of the other fiduciaries and processors it was shared with, and other prescribed information.

    • Data Subject Requests
    • Personal Data Inventory

  • s. 12 Right to correction and erasure

    Individuals can have their personal data corrected, completed, updated or erased, and erasure is carried out unless the data is still needed for the specified purpose or by law.

    • Data Subject Requests
    • Data Retention Policy

  • s. 13 Right of grievance redressal

    Individuals have readily available means to raise grievances about the organization's handling of their data, which are answered within the prescribed period before any complaint to the Board.

    • Privacy Grievance Redressal
    • Data Subject Requests

  • s. 14 Right to nominate

    Individuals can nominate another person to exercise their rights if they die or become incapable, using the means the organization provides.

    • Data Subject Requests

  • r. 14(1) Published means to exercise rights

    The website or app prominently explains how to make a request to exercise rights and which identifiers are needed to identify the individual.

    • Data Subject Requests
    • Published Privacy Policy

  • r. 14(3) Grievance response period of at most 90 days

    The published period for responding to grievances is no longer than ninety days, and technical and organisational measures make sure it is met.

    • Privacy Grievance Redressal

• Chapter IV Special provisions

  • s. 16 Processing of personal data outside India

    Personal data may be transferred abroad except to countries the Central Government restricts by notification, and stricter sectoral rules on transfers still apply.

    • Cross-Border Data Transfers
    • Processor Data Protection Agreements

  • r. 15 Conditions on transfers to foreign States

    Transfers abroad respect any requirements the Central Government sets by order on making personal data available to a foreign State or to entities it controls.

    • Cross-Border Data Transfers