Question 1

What is the DPDP Act, 2023?

Accepted Answer

The Digital Personal Data Protection Act, 2023 is India's primary data protection law, enacted in August 2023. It governs how organisations collect, process, store, and delete digital personal data of Indian residents. It establishes rights for data principals (individuals) and obligations for data fiduciaries (organisations processing data).

Question 2

Who must comply with the DPDP Act?

Accepted Answer

Any organisation that processes digital personal data of individuals in India must comply — regardless of where the organisation is headquartered. This includes Indian companies processing customer, employee, or partner data digitally; foreign companies offering goods or services to Indian residents; banks, NBFCs, insurance firms, and other BFSI entities; healthcare providers and healthtech platforms; e-commerce, retail, and logistics companies; and SaaS and technology platforms with Indian users.

Question 3

When did the DPDP Act 2023 come into effect?

Accepted Answer

The DPDP Act was enacted in August 2023. Enforcement began progressively as the Central Government notified the Act's provisions. The Data Protection Board of India (DPBI) is operational and companies are expected to be compliant. The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025, with provisions commencing on a staggered schedule.

Question 4

Who is a Data Fiduciary under the DPDP Act?

Accepted Answer

A Data Fiduciary is any person or organisation (including the State) that alone or with others determines the purpose and means of processing personal data. In practice, this means any company, app, or service that collects and uses personal data of Indian residents — from banks to e-commerce platforms to healthcare providers.

Question 5

What is a Data Principal under the DPDP Act?

Accepted Answer

A Data Principal is the individual to whom the personal data relates. They have rights under the Act: the right to access their data, the right to correct or erase it, the right to withdraw consent, the right to nominate someone to exercise their rights, and the right to grieve to the Data Protection Board.

Question 6

What is the maximum penalty under the DPDP Act?

Accepted Answer

The Data Protection Board can impose penalties up to ₹250 crore per violation (for inadequate security safeguards causing a breach), ₹200 crore for failure to notify a breach, ₹200 crore for non-compliance with children's data obligations, ₹150 crore for SDF-specific failures, and ₹50 crore for other contraventions. Multiple violations may attract separate penalties.

Question 7

Is a Data Protection Officer (DPO) mandatory under the DPDP Act?

Accepted Answer

A DPO is mandatory only for Significant Data Fiduciaries (SDFs). All other Data Fiduciaries are required to appoint a Grievance Officer (who can be the same person) to handle data principal complaints. The Grievance Officer's contact details must be published on the organisation's website or app.

Question 8

What is a Significant Data Fiduciary under DPDP?

Accepted Answer

A Significant Data Fiduciary is a Data Fiduciary designated as such by the Central Government based on the volume and sensitivity of data processed, the risk to data principals, potential impact on national security, sovereignty, or public order, and risk to electoral democracy. SDFs face additional obligations: mandatory DPO, Data Protection Impact Assessments (DPIAs), periodic audits, and potential data localisation requirements.

Question 9

What are the 15 DPDP obligation areas?

Accepted Answer

The 15 obligation areas are grouped into 4 pillars: Foundation (Governance & Accountability, Notice & Consent, Significant Data Fiduciary obligations); Data Lifecycle (Data Discovery & Inventory, Security Safeguards, Retention & Erasure, Personal Data Breach Management, Cross-Border Data Transfers); Rights & People (Data Principal Rights, Children & Persons with Disabilities, Processor & Vendor Management, Grievance Redressal); and Operations (Exemptions & Special Cases, Enforcement & Penalties, Monitoring & Continuous Improvement).

Question 10

What constitutes valid consent under the DPDP Act?

Accepted Answer

Valid consent under the DPDP Act must be: (1) Free — not coerced or bundled as a condition of service; (2) Specific — tied to a clearly defined purpose; (3) Informed — the individual has received a proper notice; (4) Unconditional — not conditional on the individual doing something in return; (5) Unambiguous — expressed through a clear affirmative action. Pre-ticked boxes and implied consent do not meet this standard.

Question 11

How is the DPDP Act different from GDPR?

Accepted Answer

Key differences: DPDP does not require a DPO for most organisations (only SDFs); it does not mandate Data Protection Impact Assessments (DPIAs) for all; it lacks explicit rules on automated decision-making; its penalty structure differs (max ₹250 crore vs GDPR's 4% global turnover); and it gives the Central Government broad exemption powers. However, both share core principles of consent, rights to access/erasure, and breach notification. DPDP is stricter on consent (adds 'unconditional') and on children's data.

Questions teams ask us most.

62 questions. Twelve minutes. Your score, today.