Know your personal data. Use it lawfully. Protect it.

The Act (No. 22 of 2023) governs the processing of digital personal data in India, and personal data collected offline and later digitised. It also applies to processing outside India where it is connected with offering goods or services to people in India. It sets out when personal data may be processed, the duties of Data Fiduciaries, additional duties for children's data and for Significant Data Fiduciaries, the rights and duties of Data Principals, and the Data Protection Board's powers and penalties.

The DPDP Rules, 2025 were notified on 13 November 2025 (G.S.R. 846(E)), with a commencement notification for the Act (G.S.R. 843(E)). The Board provisions took effect on publication. Rule 4 on Consent Managers takes effect one year later, in November 2026. The core duties, including notice, security safeguards, breach intimation, rights, children's data, Significant Data Fiduciary duties and penalties, apply eighteen months after publication, around 13 May 2027. Clients should check the official notifications for the exact dates.

A Data Fiduciary decides the purpose and means of processing; a Data Processor processes personal data on a Data Fiduciary's behalf. Many organisations are both: a fiduciary for their own customers and employees, and a processor for their clients. The role is decided per processing activity, which is why Codec Networks starts with the processing inventory.

No. The Act allows processing either with consent or for certain legitimate uses listed in section 7, such as where a person voluntarily provides data for a specified purpose and has not objected, certain employment purposes, legal obligations and medical emergencies. Each legitimate use has its own conditions, so Codec Networks maps the ground for each purpose and leaves the legal conclusion to the client's counsel.

The Schedule to the Act provides for penalties of up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach, up to ₹200 crore each for failing to notify a breach and for breaching the additional obligations for children, up to ₹150 crore for breaching Significant Data Fiduciary obligations, and up to ₹50 crore for breaches of other provisions. The Board decides penalties case by case.

Section 44(2) of the DPDP Act omits section 43A of the Information Technology Act, 2000. Under the commencement notification, that omission takes effect along with the core duties, around May 2027. Until then, section 43A and the 2011 rules on reasonable security practices remain relevant.

The Central Government may notify any Data Fiduciary or class of them as Significant Data Fiduciaries, based on factors such as the volume and sensitivity of the data, the risk to the rights of Data Principals, and wider factors such as the security of the State and public order (s.10(1)). They must appoint a Data Protection Officer based in India, appoint an independent data auditor and carry out periodic DPIAs; Rule 13 requires a DPIA and an audit every twelve months and due diligence on algorithmic software.

If you offer goods or services to people in the EU, monitor their behaviour, or process EU personal data for EU clients, GDPR (Regulation (EU) 2016/679) can apply alongside the DPDP Act. The laws overlap but differ, for example on lawful bases, records of processing and international transfers. Codec Networks maps one inventory and control set to both.

With the data. A short scoping exercise identifies the entities, business processes and systems that hold the most personal data or the most sensitive data. The inventory of those processes then drives notices, consents, retention, vendor review and the breach plan.

Organisations that want a first view of readiness usually start with a DPDPA Quick Assessment (2–4 weeks). Those ready to build choose Privacy Implementation (8–16 weeks). DPO-as-a-Service and the Privacy Retainer keep the programme running afterwards. Each can be delivered at a Basic, Medium or Advanced level to fit the organisation's size.

Under the DPDP Act, a DPO is mandatory for Significant Data Fiduciaries, who must appoint one based in India and responsible to the board. Every Data Fiduciary must publish the business contact information of a DPO, if applicable, or a person who can answer questions about processing (Rule 9). GDPR requires a DPO in certain cases (Art. 37). Codec Networks' DPO-as-a-Service supports the person in that role.

No. ISO/IEC 27701:2025 certification shows that a privacy information management system is in place and operating; it does not by itself prove legal compliance. It is valuable evidence for customers and a sound structure for a programme, and Codec Networks maps its controls to the DPDP Act and GDPR so that both are addressed.

Yes. The 2025 edition, published in October 2025, can be implemented and certified as a standalone management system, as well as integrated with an existing ISO/IEC 27001 ISMS. Organisations that already hold ISO/IEC 27001 can usually reuse much of their management system and security controls.

Sector instructions continue to apply alongside the DPDP Act; for example, section 16(2) of the Act preserves laws that provide a higher degree of protection or restriction on transferring personal data abroad. Codec Networks includes the sector instructions that apply to a client, with their reference and year, as general guidance in the control mapping. Applicability is confirmed with the client and its counsel.

Privacy cuts across the organisation: business process owners, IT and security, legal and compliance, HR, marketing and product, customer support, procurement and leadership. Codec Networks plans short, focused workshops so that each team's time is used well.

No. Codec Networks provides privacy, cyber security and compliance advisory and assurance. Formal legal opinions, regulatory submissions and representation are for qualified legal counsel. Codec Networks works alongside the client's counsel and flags the points that need a legal decision.

Rule 3 requires a notice that can be understood on its own and gives, in clear and plain language, an itemised description of the personal data and the specified purpose with a description of the goods, services or uses enabled. It must also link to the means of withdrawing consent as easily as it was given, exercising rights and complaining to the Board.

By keeping a record of who consented, when, through which channel, to which purposes and on which version of the notice, and of any later withdrawal. Codec Networks designs consent records so that they link each consent to the notice the person actually saw.

Consent Managers are entities registered with the Data Protection Board that let Data Principals give, manage, review and withdraw consent through an accessible, interoperable platform. Registration and obligations are set out in Rule 4 and the First Schedule, which take effect in November 2026. Codec Networks assesses whether a client's consent architecture can work with them.

Under sections 11 to 14 of the Act, the right to obtain information about processing, the right to correction, completion, updating and erasure, the right to grievance redressal, and the right to nominate another person to exercise rights in case of death or incapacity. Rule 14 requires organisations to publish how to make requests and to respond to grievances within a period not exceeding ninety days.

A child under the Act is anyone under eighteen. Before processing a child's personal data, a Data Fiduciary must obtain verifiable consent of the parent (s.9(1), Rule 10), must not process data in a way likely to harm the child's well-being, and must not undertake tracking, behavioural monitoring or targeted advertising directed at children (s.9(3)), subject to the exemptions in the Fourth Schedule.

Only as long as needed for the specified purpose, unless a law requires longer (s.8(7)). For large e-commerce, online gaming and social media platforms, the Third Schedule sets a three-year inactivity period, with 48 hours' notice before erasure (Rule 8). Separately, Rule 8(3) requires personal data, traffic data and logs of processing to be retained for at least one year from the processing for the purposes listed in the Seventh Schedule.

Rule 6 sets a minimum: appropriate data security such as encryption, obfuscation, masking or virtual tokens; access control; logs, monitoring and review to detect unauthorised access; measures such as backups for continued processing; retention of logs for a year; security clauses in processor contracts; and appropriate technical and organisational measures.

Only if the use fits a valid ground and the specified purpose, and the data used is limited to what is needed. Data collected for one purpose is not automatically available for model training. For EU data, the EDPB's Opinion 28/2024 sets a high bar for treating models as anonymous. Codec Networks recommends a DPIA before training or fine-tuning on personal data.

Under Rule 7, intimate each affected Data Principal without delay with a description of the breach, its likely consequences, mitigation measures, safety steps they can take and a contact; intimate the Board without delay; and send the Board a detailed report within 72 hours of becoming aware, unless the Board allows longer. CERT-In's Directions of 28 April 2022 separately require listed incidents, including data breaches and data leaks, to be reported within six hours of noticing.

The DPDP Rules apply to any personal data breach, and the Act's definition is broad: unauthorised processing, accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access that compromises confidentiality, integrity or availability. GDPR applies a risk threshold for notifying authorities. Organisations should decide with counsel, case by case, using a pre-agreed classification.

A Data Fiduciary is responsible for complying with the Act in respect of processing by its Data Processors (s.8(1)) and may engage them only under a valid contract (s.8(2)). Contracts should cover safeguards, breach notice to the fiduciary fast enough to meet its own timelines, assistance with investigations and deletion at exit.

The Act allows transfers except to countries or territories the Central Government restricts by notification (s.16(1)); Rule 15 adds that requirements may be specified by general or special order for making data available to foreign states or entities they control. Sector rules that restrict transfers continue to apply (s.16(2)). Significant Data Fiduciaries may face additional localisation of specified data under Rule 13(4).

Usually a GDPR Article 28 processor agreement, a list of subprocessors and their locations, security measures, breach notification to the client without undue delay, help with data subject requests and DPIAs, audit cooperation and deletion or return of data at contract end. Transfers from the EU typically rely on standard contractual clauses (Decision (EU) 2021/914) with a transfer risk assessment.

At least yearly, and after major changes to systems, vendors or the team. A tabletop exercise tests whether people know their roles, whether logs exist to answer the Board's questions, and whether templates and contacts work under time pressure.

Codec Networks' breach readiness work prepares the plan and tests it. When an incident happens, the Digital Forensics, Incident Response and Malware RCA service (Bundle 8) investigates, preserves evidence and supports root-cause analysis, while the privacy team helps prepare the facts the intimations need.

With a tiered approach: vendors are classified by the data they receive and their access; low-risk vendors complete a short questionnaire; high-risk vendors receive a detailed questionnaire, evidence review and, where needed, a call or site visit. Results feed a vendor privacy register with owners and dates.

Banks, NBFCs and fintechs, insurers and brokers, hospitals and healthtech, e-commerce and consumer platforms, SaaS and cloud companies, HR-tech and employers, edtech, telecom, BPO, ITeS and GCCs, and public sector bodies. The method is the same; the data, sector instructions and priorities differ.

A DPDPA Quick Assessment takes two to four weeks. A Privacy Implementation takes eight to sixteen weeks, depending on entities, processes, vendors and the number of DPIAs. DPO-as-a-Service and the Privacy Retainer run monthly or quarterly.

Pricing is scope-based. The main drivers are the number of entities, business processes, jurisdictions, systems, vendors and DPIAs, the level of implementation support, onsite work and urgency. Codec Networks confirms scope and price in a proposal and statement of work after a scoping call.

As little as possible. Most work uses documents, system descriptions, interviews and masked or sample records. Where personal data must be seen, access is limited to the named team, evidence is stored in controlled repositories, and a data processing agreement or equivalent clause is signed.

Client confidential or personal data is not uploaded to public AI tools unless the client explicitly approves it, the data is redacted and the contract permits it.

The client keeps every deliverable in editable form: inventory, register, DPIAs, notices, procedures, breach plan and roadmap. Many clients then move to DPO-as-a-Service or a Privacy Retainer so that the inventory, vendor register and evidence stay current as the business changes.

Yes, through Codec Networks' other services: VAPT, application and API security, cloud security reviews and managed SOC monitoring. These show whether the safeguards protecting personal data hold up in practice, and their findings feed the privacy risk register.

Ask for a scoping call. Codec Networks will discuss the entities, processes and systems in scope, the laws and frameworks that apply, the right model and level, and what the first privacy gap report will show. Contact mktg@codecnetworks.com or call +91 99716 76124.