Section 2(f)
Eighteen, Not Thirteen
Under-18 is a child here, and tracking, behavioural monitoring and targeted advertising at children are prohibited outright
DPDP Act video shorts, mapped to the Act
208 section-by-section explainers of India's DPDP Act (English, with a Hindi dub) and 200 real-life scenario shorts, grouped by chapter. Every card links to the dpdpact.info guide for that section.
73 of 408 are live on YouTube. A new video is published every hour until the full library is live. Cards without a video say so — no placeholder players.
No videos match that search.
Section explainers 208
Chapter I — Preliminary
Section 2(j)
You Are The Data Principal
The Act names *you*, and for a child or a person with disability the name includes the parent or guardian
Section 2(i)
The One Who Decides
The test is purpose and means, never possession — and “alone or in conjunction with other persons” means two deciders are two Data Fiduciaries.
Section 2(k)
One Name Is On The Hook
The Processor works for the Fiduciary; the Fiduciary stays responsible for it no matter what the contract says
Section 2(t)
Your Name Is Not The Test
"any data about an individual who is identifiable by or in relation to such data" — wider than a name
Section 3(a)
Paper Is Not An Escape Hatch
The Act covers digital personal data, and paper that is digitised later
Section 2(x)
Deleting Is Processing
The enacted list runs from collection to destruction and is only illustrative — “includes operations such as” — so storage and erasure are both processing.
Section 2(u)
A Breach Isn't Only A Hack
Accidental disclosure, loss of access, alteration — availability counts, so ransomware and a deleted backup are both breaches
Section 2(y)
The Act Calls Everyone "She"
s.2(y) makes "she" gender-neutral throughout the statute — a drafting choice worth one video
Section 2(s)
The State Is A Person Here
"person" includes an individual, HUF, company, firm, AoP, the State, and every artificial juristic person
Section 2(za)
The Purpose Is What They Wrote
The purpose is whatever the notice stated — so the notice is the boundary of what they may do
Section 2(o)
Why The Act Defines "Gain"
The Act defines *gain* and *loss* — they set the Board's penalty calculus later
Section 2(g)
One Place To Withdraw It All
A registered single point to give, manage, review and withdraw consent
Section 3(a)
Collected In India
Applies to digital personal data processed in India, collected digitally or digitised later
Section 3(b)
Offering Goods To India Is Enough
Processing outside India is covered if it relates to offering goods or services to people in India
Section 3(c)(i)
Your Family Group Chat Is Not Covered
Personal or domestic purpose is outside the Act
Section 3(c)(ii)(A)
You Published It Yourself
Data the Data Principal made public is outside the Act — the Act's own blogging illustration
Section 3(c)(ii)(B)
Published Because The Law Says So
Data someone else is legally obliged to publish is also outside
Section 2(u) Coming soon
Losing Access Is A Breach Too
Ransomware, a wiped backup, an expired key: availability is in the definition
Section 2(g) Coming soon
One Place To Withdraw Everything
The Consent Manager's whole promise: give, manage, review, withdraw — interoperably
Section 2(t) Coming soon
Myth: Anonymised Data Is Covered
"Personal data" needs an identifiable individual
Section 3(a)(ii) Coming soon
Myth: Paper Records Are Safe
Non-digital records digitised later come in
Chapter II — Obligations of Data Fiduciary
Section 6(2)
The Consent That Was Never Valid
A bundled waiver of the right to complain to the Board is invalid to the extent of the infringement — the Act's own insurer illustration
Section 6(1)
Your Contact List Isn't Necessary
Consent is capped at the data necessary for the specified purpose — the Act's own telemedicine illustration
Section 4(1)
Two Grounds. That's All.
Consent, or "certain legitimate uses". There is no third door — no "legitimate interest" balancing test
Section 4(2)
Lawful Means Not Forbidden
"Lawful purpose" is defined negatively: any purpose not expressly forbidden by law
Section 5(1)
The Notice Comes First
Every consent request must be accompanied or preceded by a notice
Section 5(3)
In Your Language
Notice and consent request must be available in English or any Eighth Schedule language
Section 5(2)
Consent Before The Act? Still Owed A Notice
Pre-commencement consent survives, but they must send you the notice "as soon as reasonably practicable"
Section 6(1)
Five Words That Define Consent
Free, specific, informed, unconditional, unambiguous — with a clear affirmative action
Section 6(1)
A Pre-Ticked Box Is Not An Action
"Clear affirmative action" kills the pre-ticked box and the scroll-is-consent pattern
Section 6(1)
Capped At What The Purpose Needs
Consent is limited to the data necessary for the specified purpose — the Act’s own telemedicine contact-list illustration.
Section 6(2)
Invalid To The Extent
An unlawful part of a consent is invalid only to that extent; the rest of the consent survives.
Section 6(4)
As Easy To Leave As To Join
Withdrawal must be comparable in ease to giving — the Act and the Rules both say it
Section 6(5)
Withdrawing Has A Price, And That's Legal
You bear the consequences; processing before withdrawal stays lawful — the shopping-order illustration
Section 6(6)
They Must Stop, And Make Their Processor Stop
After withdrawal the Fiduciary must cease and cause its Processors to cease — the telecom-billing illustration
Section 6(10)
They Have To Prove You Said Yes
In a proceeding the burden is on the Fiduciary to prove notice and consent
Section 7(a)
You Handed It Over Yourself
Data voluntarily provided for a purpose, with no objection indicated, needs no separate consent — the pharmacy receipt illustration
Section 7(a)
And You Can Switch It Off
The broker illustration: once you say you no longer need help, processing must stop
Section 7(b)
Subsidies And Benefits
The State may process for a subsidy, benefit, service, certificate, licence or permit where you consented before, or where it already holds the data in a notified database.
Section 7(b)
The Maternity-Benefit Example
The Act's own illustration of eligibility-checking for another benefit
Section 7(c)
Functions Of The State
Performance of a legal function, or sovereignty, integrity and security of the State
Section 7(d)
When A Law Makes Them Disclose
Compliance with a statutory disclosure obligation is a legitimate use
Section 7(e)
Court Orders
Judgments and decrees in India, and foreign civil/contractual orders
Section 7(f)
Medical Emergency
A threat to life or immediate threat to health — yours or anyone's
Section 7(g)
Epidemic And Disaster
Public-health measures, and safety during a disaster or breakdown of public order (disaster = Disaster Management Act, 2005 s.2(d))
Section 7(i)
Your Employer's Lane
Employment purposes, and safeguarding the employer from loss or liability — espionage, trade secrets, IP, classified information
Section 8(1)
The Contract Cannot Save Them
Responsibility holds irrespective of any agreement to the contrary and even if *you* broke your duties
Section 8(2)
No Processor Without A Contract
A Processor may only be engaged under a valid contract
Section 8(3)
Accurate If It Decides About You
Completeness, accuracy and consistency are mandatory where the data will drive a decision about you or be shared onward
Section 8(4)
Measures, Not Intentions
Appropriate technical and organisational measures for effective observance
Section 8(5)
The ₹250 Crore Duty
Reasonable security safeguards — the single most expensive obligation in the Act
Section 8(9)
A Human Who Answers
Publish the DPO's or a responsible person's business contact — and repeat it in every reply to a rights request
Section 8(10)
A Grievance Mechanism That Works
An *effective* mechanism is the obligation; "effective" is the operative word
Section 8(6)
Telling You Late Costs ₹200 Crore
Schedule item 2 — failing to notify the Board or you
Section 9(2) Coming soon
Nothing That Harms Their Well-Being
s.9(2) is absolute — no exemption in r.12 touches it
Section 9(3) Coming soon
Not A Toggle. A Prohibition.
Tracking, behavioural monitoring and targeted advertising at children are barred, not consentable
Section 8(1) Coming soon
Duties Don't Excuse Them
Your failure to perform a duty does not reduce the Fiduciary's responsibility
Section 8(7)(a) Coming soon
Purpose Over. Data Gone.
Erase on withdrawal or when the purpose is no longer served, whichever is earlier
Section 8(7)(b) Coming soon
And The Processor's Copy
They must cause the Processor to erase what was handed over
Section 8(7) Coming soon
The Bank That Must Keep It
The Act's own illustration: a ten-year KYC retention law wins
Section 8(7) Coming soon
The Used-Car Listing
The Act's other illustration: sale concluded, data no longer retained
Section 10(1) Coming soon
Nobody Is An SDF Until Notified
s.10(1) is a power to notify — no company is an SDF by size alone
Section 10(1)(a) Coming soon
Six Factors
Volume and sensitivity · risk to rights · sovereignty · risk to electoral democracy · security of the State · public order
Section 10(2)(a) Coming soon
A DPO Based In India
Represents the SDF, answers to the board of directors, and is the grievance contact
Section 10(2)(b) Coming soon
An Independent Auditor
Not the same person as the DPO; evaluates compliance
Section 6(9) Coming soon
Registered, Or It Isn't One
Registration with the Board is mandatory — live 13 Nov 2026
Section 4 Coming soon
Myth: It's India's GDPR
Two grounds only, no "legitimate interest" test, no statutory DSAR clock, penalties to the Consolidated Fund — the differences that actually bite
Section 10(1)(a) Coming soon
Myth: Sensitive Data Is A Category
The Act has no special category of sensitive personal data. The word appears once, in s.10(1)(a); s.33(2)(b)'s nearest equivalent is “the type and nature” of the data.
Section 8(7) Coming soon
E-Commerce, In 40 Seconds
Third Schedule row 1 + the used-car and e-book illustrations
Section 9(3) Coming soon
Social Media
Third Schedule row 3 + the s.9(3) ban on profiling minors
Section 7(f) Coming soon
Healthcare
Fourth Schedule Part A(1),(2) + the medical-emergency and epidemic uses
Section 9(3) Coming soon
Schools And EdTech
Fourth Schedule Part A(3) vs the s.9(3) prohibition — where the line runs
Section 7(i) Coming soon
HR And Employment
s.7(i) — what an employer may process without consent, and what it may not
Section 5 Coming soon
The Startup Checklist
What a small Fiduciary must do on day one, and what s.17(3) might excuse
Section 6(4) Coming soon
Withdraw Everything Today
Using s.6(4) and r.3(c)(i) on the apps you already have
Chapter III — Rights and duties of Data Principal
Section 15
The Fine That Applies To You
The duties of a Data Principal carry their own penalty: ₹250 crore for the company, ₹10,000 for you
Section 13(2)
Ninety Days
The rights clock, corrected: ninety days is the grievance cap, and the s.11 sharing list is the right almost nobody uses
Section 13(2)
Ninety Days Or Nothing? Not Quite
The corrective video — 90 days is the *grievance* cap (r.14(3)); rights requests have no statutory clock
Section 11(1)(a) Coming soon
Ask For The Summary
A summary of your data and of the processing activities
Section 11(1)(b) Coming soon
The Sharing List
s.11(1)(b): the identities of every other Data Fiduciary and Processor your data was shared with, and a description of what was shared.
Section 11(2) Coming soon
Where The Sharing List Stops
It does not cover sharing with an authorised body for prevention/detection/investigation of offences, on a written request
Section 12(1) Coming soon
Correct, Complete, Update
Three separate verbs, all mandatory on request
Section 12(3) Coming soon
Erase
They must erase on request unless retention is needed for the specified purpose or by law
Section 13(3) Coming soon
Grievance First, Board Second
You must exhaust the Fiduciary's grievance route before approaching the Board
Section 13(2) Coming soon
Ninety Days Is The Grievance Cap
The corrected clock, taught properly
Section 14(1) Coming soon
Nominate Someone
On death or incapacity, a nominee exercises your rights; "incapacity" is defined
Section 11(1) Coming soon
Only Where You Consented
A rights request goes to a Fiduciary you previously gave consent to
Section 11 Coming soon
Write The Request In 40 Seconds
A how-to: the six lines an access request needs
Section 15(b) Coming soon
Don't Impersonate
s.15(b), the duty most likely to be broken casually
Section 15(c) Coming soon
Don't Hide Material Information
On any State-issued document, identifier, proof of identity or address
Section 15(d) Coming soon
False Or Frivolous Complaints
s.15(d), and the Board's power to impose costs on the complainant
Section 15(e) Coming soon
Verifiably Authentic
When you ask for correction or erasure, what you furnish must be verifiably authentic
Section 13(3) Coming soon
Complain To The Board
Grievance first (s.13(3)), then the digital complaint
Chapter IV — Special provisions
Section 17(1) Coming soon
Two Duties That Never Switch Off
Even in the s.17(1) exemptions, s.8(1) and s.8(5) — responsibility and security — still apply
Section 17(1)(a) Coming soon
Enforcing A Legal Claim
s.17(1)(a)
Section 17(1)(b) Coming soon
Courts And Regulators
Judicial, quasi-judicial, regulatory and supervisory functions
Section 17(1)(c) Coming soon
Investigating An Offence
Prevention, detection, investigation, prosecution
Section 17(1)(d) Coming soon
Outsourcing For Foreign Clients
Processing data of people outside India under a foreign contract
Section 17(1)(e) Coming soon
Mergers And Demergers
Court- or tribunal-approved schemes
Section 17(1)(f) Coming soon
The Loan Defaulter
Financial information of a defaulter, with the Act's own illustration and IBC definitions
Section 17(2)(a) Coming soon
The State Exemption
A notified State instrumentality can be taken out entirely — and the video says plainly that this is the Act's widest door
Section 17(2)(b) Coming soon
Research, Archiving, Statistics
Exempt only if no decision specific to a Data Principal is taken, and the Second Schedule standards are met
Section 17(3) Coming soon
The Startup Exemption
The Government may exempt notified classes, including startups, from s.5, s.8(3), s.8(7), s.10 and s.11
Section 17(5) Coming soon
Five Years To Postpone Anything
s.17(5) lets the Government suspend any provision for any class within five years of commencement
Section 16 Coming soon
Sending Data Abroad
s.16 blacklist power + r.15 conditions — and the honest note that no list has been notified
Chapter V — Data Protection Board of India
Section 20(2) Coming soon
Two Years At A Time
Term of two years, re-appointment allowed
Section 22(3) Coming soon
The Cooling-Off Year
No employment for one year after leaving without Central Government approval
Section 25 Coming soon
Public Servants
Members and officers are public servants under IPC s.21
Section 19(1) Coming soon
Who Can Sit On The Board
Ability, integrity and standing, and at least one member must be an expert in law
Section 23(2) Coming soon
A Vacancy Doesn't Void A Decision
No act of the Board is invalid merely for a vacancy, a defective appointment, or an irregularity that doesn't touch the merits
Section 24 Coming soon
The Board Hires Its Own
Officers and employees appointed with the Central Government's prior approval
Section 26(a) Coming soon
What The Chairperson Alone Can Do
General superintendence, authorising scrutiny of any complaint, and allocating proceedings among Members
Chapter VI — Powers, functions and procedure of the Board
Section 27(1)(a) Coming soon
The Board Can Order You Fixed First
On a breach intimation the Board may direct urgent remedial or mitigation measures before any penalty
Section 28(1) Coming soon
A Digital Office
Complaint to decision, online by design
Section 27 Coming soon
Six Months To Finish An Inquiry
Extendable for recorded reasons by up to three months at a time
Section 28(7) Coming soon
Civil-Court Powers
Summons, evidence on affidavit, inspection of documents
Section 28(8) Coming soon
What The Board May Not Do
It may not block premises or seize equipment that would disrupt day-to-day functioning
Section 27(1)(a) Coming soon
How A Complaint Starts
Intimation, complaint, Government reference, or a court's direction
Section 28(3) Coming soon
Sufficient Grounds
The Board decides whether to inquire at all, and must record reasons to close
Section 28(10) Coming soon
Interim Orders
Mid-inquiry orders, in writing, after a hearing
Section 27(2) Coming soon
Directions Bind
The Board may issue directions any person is bound to comply with
Section 27(3) Coming soon
And Can Be Revisited
Modification, suspension, withdrawal or cancellation of a direction on representation
Chapter VII — Appeal and alternate dispute resolution
Section 31 Coming soon
Mediation
The Board may send a complaint to mediation
Section 32(1) Coming soon
The Voluntary Undertaking
Accepting one bars proceedings on its contents — until it's broken
Section 29(1) Coming soon
Sixty Days To Appeal
To TDSAT, extendable for sufficient cause
Section 29(6) Coming soon
Six Months, Or Reasons
The Tribunal must try to finish in six months and record why if it doesn't
Section 30 Coming soon
Enforceable As A Decree
Tribunal orders execute like a civil court decree
Section 29(9) Coming soon
Beyond The Tribunal
Appeals from TDSAT follow TRAI Act s.18
Chapter VIII — Penalties and adjudication
Section 33(1) Coming soon
Seven Penalty Slabs
The Schedule, read straight
Section 33(2)(a) Coming soon
How The Number Is Chosen
Nature, gravity, duration, type of data, repetition, gain or loss, mitigation, proportionality, impact
Section 34 Coming soon
Where The Money Goes
Penalties are credited to the Consolidated Fund of India — not to victims
Section 33 Coming soon
Myth: Compensation For Victims
The Act provides penalties, not damages to you
Chapter IX — Miscellaneous
Section 38
The Act Beats The Other Law
On conflict, this Act prevails to the extent of the conflict — but it is *in addition to*, not in derogation of, other laws
Section 39
No Civil Court Will Hear It
Civil courts are barred where the Board is empowered; no injunctions either
Section 37(1) Coming soon
Blocked After Two Penalties
s.37: two or more penalties can lead to a Central Government blocking order that intermediaries must obey
Section 42(1) Coming soon
Penalties Can Be Doubled, Not More
The Schedule may be amended by notification, capped at twice the original figure
Section 44(3) Coming soon
RTI Just Changed
s.8(1)(j) of the RTI Act now exempts "information which relates to personal information"
Section 44(2)(a) Coming soon
Section 43A Is Gone
s.44(2)(a) omits the IT Act's s.43A compensation provision — but s.44(2) is in the eighteen-month tranche, so 43A stands until 13 May 2027.
Section 44(1) Coming soon
TDSAT Got A Third Hat
TRAI Act s.14(c) amended to add the DPDP Appellate Tribunal
Section 39 Coming soon
Myth: You Can Sue Them
Civil courts are barred; the Board is the route
Section 35 Coming soon
Good Faith Protection
No suit against the Government, the Board or its officers for acts done in good faith
Section 36 Coming soon
The Government Can Ask The Board Anything
s.36 — the Centre may require the Board, any Data Fiduciary or any intermediary to furnish information
Section 40(1) Coming soon
Where The Rules Come From
s.40(2) runs (a) to (z) — twenty-five named rule-making subjects and one catch-all — so the Rules you are governed by are the exercise of a list written into the Act.
Section 41 Coming soon
Parliament Can Strike A Rule Down
Every rule and s.16/s.42 notification is laid before both Houses for thirty days and can be modified or annulled
Section 43(1) Coming soon
Three Years To Fix A Mistake
The difficulty-removal power expires three years after commencement, and every such order is laid before Parliament
DPDP Rules, 2025
Rule 3(b)(i)
Itemised
The notice must carry an itemised description of the personal data
Rule 3(b)(ii)
And What You Actually Get
It must describe the specific goods, services or uses the processing enables — not just "to improve services"
Rule 3(a)
It Must Stand On Its Own
The notice has to be understandable independently of anything else on the page
Rule 3(c)
Three Links They Owe You
Withdraw consent · exercise rights · complain to the Board — as an actual link, in the notice
Rule 5(2)
What "Using Public Funds" Means
Consolidated Fund, public account, or a local authority's funds — the Rules define the phrase
Rule 6(1)(a)
Encrypt, Mask, Tokenise
The Rules' minimum list starts with encryption, obfuscation, masking or virtual tokens
Rule 6(1)(c)
Who Looked At Your File
Logs, monitoring and review, so unauthorised access can be detected, investigated and stopped from recurring
Rule 6(1)(e)
Keep The Logs A Year
One-year retention of logs and data for detection and investigation
Rule 6(1)(d)
Backups Are A Legal Duty
Reasonable measures for continued processing if confidentiality, integrity or availability is compromised
Rule 6(1)(f)
It Has To Be In The Contract
The Processor contract must carry the safeguards clause
Rule 7(2)(b)
Seventy-Two Hours
72 hours is the Board's deadline; your own intimation is "without delay" with no number
Rule 7(1)(a)
Five Things The Email Must Say
Description · consequences for you · mitigation · what you should do · a human contact
Rule 7(1)
"We Take Security Seriously" Is Not Notice
Measured against r.7(1)'s five items, the standard PR breach email fails four of them
Rule 7(2)(a)
What The Board Gets First
Without delay: nature, extent, timing, location, likely impact
Rule 7(2)(b)(i)
And What It Gets In 72 Hours
Six items including findings on who caused it and a report on what victims were told
Rule 7(2)(b)
The Extension Must Be Asked For
The 72 hours extends only on a written request the Board allows
Rule 7(1) Coming soon
Your Account Is The Delivery Address
Intimation goes through your user account or a channel you registered — so a dead email address is their problem, not a defence
Rule 2(1)(d) Coming soon
Verifiable Means Rule 10 Or Nothing
"Verifiable consent" is a defined term: it means r.10 or r.11, and nothing else
Rule 10(1) Coming soon
Proving A Parent Is An Adult
Details the Fiduciary already holds, details she provides, or a virtual token from an authorised entity
Rule 10(2)(b) Coming soon
DigiLocker Counts
An authorised entity includes a Digital Locker service provider
Rule 10 Coming soon
Four Cases The Gazette Wrote
Child-declares vs parent-opens × already-a-user vs not — the Rules' own worked matrix
Rule 11 Coming soon
Guardians Of Adults
r.11: the guardian must be appointed by a court, a designated authority (RPwD Act s.15) or a local level committee (National Trust Act s.13)
Rule 14(1) Coming soon
Find The Request Form
They must publish the means and the identifier they need
Rule 14(5) Coming soon
Which ID They Can Ask For
Customer ID, enrolment ID, application reference, email, mobile, licence number — an identifier they issued
Rule 8(2) Coming soon
Forty-Eight Hours' Warning
They must tell you 48 hours before erasing — log in, or lose it
Rule 8(3) Coming soon
The Cloud Provider Keeps It Too
Illustration case 2: the Fiduciary must ensure its Processor also holds the year
Rule 13(1) Coming soon
DPIA And Audit Every Twelve Months
The Rules put a clock on it, and require significant observations to go to the Board
Rule 13(3) Coming soon
Audit Your Algorithm
Due diligence that algorithmic software is not likely to pose a risk to Data Principals' rights
Rule 13(4) Coming soon
Some Data Stays In India
Specified personal data and its traffic data may be barred from leaving the country
Rule 13(5) Coming soon
Who Decides That
A Central Government committee including MeitY officials
Rule 4(5) Coming soon
The Board Can Switch It Off
Suspension or cancellation of registration, after a hearing, in your interests
Rule 17(1) Coming soon
How Members Are Picked
Two Search-cum-Selection Committees — Cabinet Secretary for the Chairperson, MeitY Secretary for Members
Rule 19(3) Coming soon
One-Third Is A Quorum
Quorum, majority vote, and the Chairperson's casting vote
Rule 19(5) Coming soon
Interested? Then Don't Vote.
A Member with an interest may not participate or vote on that item
Rule 19(6) Coming soon
Emergency Powers, Seven Days
Chairperson may act alone in an emergency; must inform Members within 7 days and get ratification
Rule 22(1) Coming soon
Pay The Fee By UPI
Digital filing; TRAI-Act-equivalent fee, payable over UPI, waivable by the Chairperson
Rule 22(3) Coming soon
Not Bound By The CPC
Natural justice, own procedure, digital office
Rule 1(2) Coming soon
Three Dates, Not One
13 Nov 2025 · 13 Nov 2026 · 13 May 2027 — what is live in each tranche
Rule 1(2) Coming soon
The Law Is Live. Most Of It Isn't.
The Board's own provisions (ss.18-26) are live; consent, notice, rights, the breach duties and the penalties in ss.28-34 all wait for 13 May 2027.
Rule 14(3) Coming soon
One Page, Every Right You Have
The closer: the whole of Chapter III on one board, with the 90-day grievance cap in its correct place
DPDP Rules, 2025 — Schedules
Second Schedule
The Standards The State Still Owes
Second Schedule: lawful, purpose-limited, minimal, accurate, retention-limited, secured, accountable — plus an intimation to you and a contact person
Fourth Schedule Coming soon
School Can Track. Advertisers Can't.
Fourth Schedule Part A(3): educational institutions, for educational activities or the child's safety
Fourth Schedule Coming soon
The School Bus Exception
Transport operators may track location during the journey in the interest of safety
Fourth Schedule Coming soon
Doctors And Crèches
Health, mental-health, allied-health professionals and day-care carers, each capped by necessity
Fourth Schedule Coming soon
Six Purposes That Bend The Rule
Legal duties · s.7(b) benefits · an email-only account · real-time location for safety · blocking harmful content or ads · age-assurance itself
Third Schedule Coming soon
Three Years Of Silence
The Third Schedule clock for big e-commerce, gaming and social platforms
Third Schedule Coming soon
Two Crore And Fifty Lakh
The user thresholds: e-commerce 2 crore · gaming 50 lakh · social media 2 crore
Third Schedule Coming soon
What Survives The Erasure
Account access and a virtual token redeemable for money, goods or services are carved out
Seventh Schedule Coming soon
Deleted Your Account? They Keep A Year.
r.8(3) + Seventh Schedule: one-year minimum retention of data, traffic data and logs — the e-book illustration
First Schedule Coming soon
An Indian Company, ₹2 Crore Net Worth
First Schedule Part A conditions in one video
First Schedule Coming soon
Certified Before It Starts
Independent certification against the Board's published standards and assurance framework
First Schedule Coming soon
It Must Not Be Able To Read It
The Consent Manager moves your data without being able to read the contents
First Schedule Coming soon
Seven Years Of Receipts
Records of consents given, denied and withdrawn, the notices, and every sharing — kept 7 years, given to you in machine-readable form
First Schedule Coming soon
It Owes You A Fiduciary Duty
Part B(8) — and it may not sub-contract its obligations
First Schedule Coming soon
Who Owns Your Consent Manager
It must publish promoters, directors, KMP and every 2%+ shareholder
First Schedule Coming soon
It Cannot Be Sold Quietly
Control cannot change hands without the Board's prior approval
Fifth Schedule Coming soon
₹4.5 Lakh, No Car
The Fifth Schedule's consolidated salary, and no pension or gratuity for Board service
Third Schedule Coming soon
Online Gaming
Third Schedule row 2, and the virtual-token carve-out that matters most here
Fifth Schedule Coming soon
What The Board Is Paid
The Fifth Schedule's consolidated salary, without house or car — and no pension and no gratuity for service in the Board.
Sixth Schedule Coming soon
Deputation, Not A Career
Board staff come on deputation for not more than five years, including from the National Institute for Smart Government
Seventh Schedule Coming soon
The Order You Are Never Told About
r.23(2): where disclosure would prejudice sovereignty, integrity or security, the Government may forbid the Fiduciary from telling you it handed your data over
Sixth Schedule Coming soon
Sixth Schedule, In Plain Words
Gratuity, travel, medical, leave and conduct rules for Board staff — the boring half of independence
Real-life scenarios 200
Short English videos that start from an ordinary situation — a sign-up screen, an HR file, a school app — and show which section or Rule decides it.
Chapter I — Preliminary
Section 2(i) Coming soon
Which Founder Is The Fiduciary
"Which of us is the Data Fiduciary?" is not the question the Act asks. s.2(i) defines a Data Fiduciary as "any person who alone or in conjunction with other persons determines the purpose and means of processing of…
Section 3(c)(ii)(A) Coming soon
The Recruiter Reads Public Posts
s.3(c)(ii)(A) turns on who put the data into the open.
Section 2(u) Coming soon
The Reports Are Simply Gone
A "personal data breach" under this Act does not need an attacker and does not need anything to leave the building. s.2(u)'s second limb is accidental — and it names "destruction or loss of access to personal data"…
Section 2(i) Coming soon
We Are Not A Tech Company
A principal says the law is for technology companies, not schools.
Section 3(a)(ii) Coming soon
Scanning The 2019 Admission Forms
s.3(a)(ii). The Act shall apply to the processing of digital personal data within the territory of India where the personal data is collected in non-digital form and digitised subsequently.
Section 2(f) Coming soon
Seventeen Ticks The Adult Box
The Act's "child" is fixed by one measurement and one number. s.2(f): "'child' means an individual who has not completed the age of eighteen years".
Section 2(u) Coming soon
Friday Night, Everything Encrypted
s.2(u) defines a personal data breach by two things at once: a kind of event — "any unauthorised processing of personal data" or "accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of…
Section 2(u) Coming soon
The Wrong Rahul In Autocomplete
A staffer emails the customer list to the wrong Rahul in the address book.
Section 2(i) Coming soon
Two People And A Brand
The Act's definition of "Data Fiduciary" is a test about decisions: "any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data".
Section 3(a) Coming soon
Customers In A Broadcast List
Keeping a list is one of the operations s.2(x) names.
Section 3(c)(i) Coming soon
Friends On The Same Phone
The same shop owner keeps her friends' numbers on the same handset.
Section 3(c)(ii)(A) Coming soon
She Blogged It Herself
A woman blogs her own details and a company scrapes the page.
Section 3(c)(ii)(B) Coming soon
Published Because A Statute Says So
A company officer's details are public because a statute requires them to be.
Section 3(c)(i) Coming soon
The Society Group Shares A Number
A neighbourhood group chat passes around a member's number.
Section 1(2) Coming soon
Demand Deletion From Any App Today
The Act did not switch on all at once. s.1(2) says it comes into force "on such date as the Central Government may, by notification in the Official Gazette, appoint" and that "different dates may be appointed for…
Section 2(a) Coming soon
Which Tribunal Hears The Appeal
A company asks which tribunal will hear its appeal.
Chapter II — Obligations of Data Fiduciary
Section 6(1) Coming soon
Meera Uploads Her Aadhaar
Consent does not stretch to cover whatever was handed over with it.
Section 5(1) Coming soon
The Notice Came After The OTP
A shopping app puts its privacy notice on the screen after the OTP is entered.
Section 6(1) Coming soon
The Box Was Already Ticked
Nikhil opens a bank onboarding form and 'I agree to marketing' is already ticked.
Section 6(2) Coming soon
The Waiver Inside The Policy
An insurer bundles 'issue my policy' with 'I waive my right to complain to the Board'.
Section 6(3) Coming soon
English Only In Bhubaneswar
Sunita in Odisha finds the consent request offered only in English.
Section 6(3) Coming soon
Nobody To Ask About It
Under s.6(3) every request for consent shall be presented in clear and plain language, giving the option to access it in English or a language specified in the Eighth Schedule, and providing the contact details of a…
Section 6(4) Coming soon
One Tap In, Five Emails Out
Where consent is the basis of processing, the Data Principal has the right to withdraw it at any time, with the ease of doing so being comparable to the ease with which such consent was given (s.6(4)); and the notice…
Section 5(2) Coming soon
Consents From Before The Act
An app has held the same users since 2021 and wonders whether those consents survive.
Section 6(1) Coming soon
No Ride Without Live Location
s.6(1) states what a consent has to be before it is a consent under the Act: "free, specific, informed, unconditional and unambiguous with a clear affirmative action", and it caps what that consent reaches — "limited…
Section 6(10) Coming soon
Prove That She Said Yes
When consent is the basis of the processing and a question about it arises in a proceeding, s.6(10) puts the obligation to prove on one named party: "the Data Fiduciary shall be obliged to prove".
Section 6(7) Coming soon
Three Banks, One Dashboard
Consent can travel through a middleman without being given to the middleman.
Section 7(i) Coming soon
The Background Check Nobody Mentioned
HR runs a background check on a new hire and never asks for consent.
Section 7(i) Coming soon
Every Keystroke, For Trade Secrets
A company switches on keystroke logging and calls it trade-secret protection.
Section 8(2) Coming soon
Payroll On A Handshake
Payroll goes out to a vendor on a handshake and no paperwork.
Section 8(3)(a) Coming soon
Stale Appraisal, New Premium
An HRMS pushes an out-of-date appraisal to a group insurer, who prices on it.
Section 8(5) Coming soon
The Backup On An Open Share
An old laptop backup of the employee database turns up on an open share.
Section 7(f) Coming soon
Nobody Can Consent For Her
Consent is not the only lawful ground the Act offers. s.4(1) says a person may process personal data "only in accordance with the provisions of this Act and for a lawful purpose, — (a) for which the Data Principal has…
Section 7(g) Coming soon
The Outbreak Contact List
A district hospital builds a contact list during an outbreak.
Section 7(h) Coming soon
Registering Families After The Flood
Section 7 lists certain legitimate uses for which "A Data Fiduciary may process personal data of a Data Principal".
Section 6(1) Coming soon
The Telemedicine App Wants Contacts
A telemedicine app asks to read the patient's phone contact list.
Section 8(7)(a) Coming soon
Kept Just In Case
s.8(7)(a) names two moments at which personal data is to be erased and then picks between them: "upon the Data Principal withdrawing her consent or as soon as it is reasonable to assume that the specified purpose is no…
Section 7(a) Coming soon
The Pharmacy Texts A Receipt
s.7(a). A Data Fiduciary may process personal data for "the specified purpose for which the Data Principal has voluntarily provided her personal data to the Data Fiduciary, and in respect of which she has not indicated…
Section 9(3) Coming soon
Recommended Courses For A Fourteen-Year-Old
An ad-funded learning app serves 'recommended courses' to a fourteen-year-old. s.9(3) names two things a Data Fiduciary shall not undertake, and the second is targeted advertising directed at children.
Section 9(1) Coming soon
The Parent Signs, Not The Student
A school app asks the parent, not the student, to approve the account.
Section 9(2) Coming soon
The Leaderboard On The Wall
s.9(2) is not a consent rule. It is a flat prohibition addressed to the Data Fiduciary: "A Data Fiduciary shall not undertake such processing of personal data that is likely to cause any detrimental effect on the…
Section 8(7)(a) Coming soon
Every Alumnus, Kept Forever
A school keeps every alumnus's file 'for the archive'.
Section 7(b) Coming soon
The Fee Waiver Portal
A State scholarship portal enrols children for a fee waiver.
Section 9(3) Coming soon
Profiling A Sixteen-Year-Old's Scroll
s.9(3) is written as a prohibition on the Data Fiduciary, not as a permission the Data Principal or her parent can grant: "A Data Fiduciary shall not undertake tracking or behavioural monitoring of children or targeted…
Section 9(3) Coming soon
Personalised Offers For Under-Eighteens
s.9(3) is a single sentence that names three things a Data Fiduciary "shall not undertake", and the third is "targeted advertising directed at children".
Section 9(5) Coming soon
Prove You Are Verifiably Safe
An exemption from the children's obligations is not something a Data Fiduciary reaches by satisfying itself.
Section 6(4) Coming soon
The Mother Asks For Deletion
For a child, the Data Principal is not only the child. s.2(j) says the Data Principal "means the individual to whom the personal data relates and where such individual is — (i) a child, includes the parents or lawful…
Section 8(6) Coming soon
What Staying Silent Costs
Counsel is asked what saying nothing could cost.
Section 8(1) Coming soon
It Happened At The Vendor
Section 8(1) makes the Data Fiduciary responsible for complying with the Act and the rules in respect of any processing undertaken by it or on its behalf by a Data Processor — and it says so irrespective of any…
Section 4(1) Coming soon
What She Owes On Day One
A founder's "day one" list is written in the Act itself, in three places: s.4(1) — process only in accordance with the provisions of this Act and for a lawful purpose, for which consent has been given or for certain…
Section 4(1) Coming soon
Just Use Legitimate Interest
Section 4 names its grounds itself. Processing is permitted "only in accordance with the provisions of this Act and for a lawful purpose", and that purpose must be one "(a) for which the Data Principal has given her…
Section 8(2) Coming soon
A Cloud Vendor In One Click
s.8(2) sets a condition on involving a Data Processor at all: a Data Fiduciary may "engage, appoint, use or otherwise involve a Data Processor to process personal data on its behalf for any activity related to offering…
Section 8(7) Coming soon
The Accountant Will Not Delete
Erasure under the Act is not unconditional.
Section 8(1) Coming soon
The Contract Says It Is Theirs
The vendor contract says the vendor bears all data liability, so the founder stops reading.
Section 10(1)(a) Coming soon
The Six Factors Behind Designation
Being big is not the test, and there is no number in the test. s.10(1) lets the Central Government notify a Data Fiduciary — or a class of Data Fiduciaries — as a Significant Data Fiduciary "on the basis of an…
Section 10(1) Coming soon
Is That Company Significant Yet
"Significant Data Fiduciary" is a status conferred by an instrument, not a description you can work out from a company's size. s.2(z) defines it as a Data Fiduciary or class of Data Fiduciaries "as may be notified by…
Section 10(2)(a)(i) Coming soon
A DPO Based In Singapore
s.10(2)(a) does not just say "appoint a Data Protection Officer".
Section 10(2)(b) Coming soon
Internal Audit Signs Its Own Work
s.10(2)(b) puts one adjective in front of the auditor.
Section 10(2) Coming soon
One Hundred And Fifty Crore
The number in the Schedule is a ceiling, and it is the last step, not the first.
Section 7(b) Coming soon
Enrolling For The Maternity Benefit
There is a lane in the Act for the State. s.7(b) makes it a certain legitimate use for "the State and any of its instrumentalities to provide or issue to the Data Principal such subsidy, benefit, service, certificate,…
Section 7(b)(i) Coming soon
The Same Department Checks Again
The first gate into the s.7(b) lane is a consent she already gave — and it is written wide.
Section 7(b)(ii) Coming soon
Already In The Notified Register
The second gate into the s.7(b) lane has nothing to do with consent.
Section 7(c) Coming soon
The Municipality Does Its Job
A municipal body processes data to run a statutory function.
Section 7(d) Coming soon
The Law Says Report It
A law requires a company to report a customer's details to a regulator.
Section 7(e) Coming soon
Because The Decree Says So
A company processes data to obey a court decree.
Section 8(7)(a) Coming soon
The Car Finally Sold
A used car finally sells on a listings site.
Section 8(7) Coming soon
She Closed The Account
A customer closes her savings account and asks the bank to erase everything.
Section 6(5) Coming soon
Withdrawn After The Order Was Paid
A shopper withdraws consent after paying for an order that has not shipped.
Section 4(1) Coming soon
India's GDPR, Says The Post
s.4(1) names two grounds for processing — consent, or certain legitimate uses — and s.4 sets no balancing test.
Chapter III — Rights and duties of Data Principal
Section 11(1) Coming soon
She Resigned, The File Stayed
The access right and the correction-and-erasure right are written against a defined counterparty. s.11(1) gives the right to obtain from "the Data Fiduciary to whom she has previously given consent, including consent…
Section 13(1) Coming soon
She Went Straight To The Board
An employee takes her complaint about her own record straight to the Board.
Section 11(1)(b) Coming soon
The Insurer Already Had It
s.11(1)(b) gives the Data Principal, against the Data Fiduciary to whom she has previously given consent and upon making to it a request in such manner as may be prescribed, the right to obtain "the identities of all…
Section 11(1)(a) Coming soon
Who Has Seen My File
s.11(1) names what the Data Principal may obtain: under clause (a) a summary of the personal data being processed and of the processing activities, and under clause (b) the identities of all other Data Fiduciaries and…
Section 11(2) Coming soon
The Request That Never Appears
Police make a written request to a hospital during an investigation.
Section 13(2) Coming soon
We Will Reply In A Day
r.14(3) puts two conditions on the grievance period a company publishes, not one: it must be a reasonable period, and it must be not exceeding ninety days.
Section 11(1)(a) Coming soon
Anita Asks Her Bank
Anita asks her bank what it actually holds on her.
Section 11(1)(b) Coming soon
And Who Else Has Seen It
Anita then asks who else has been given it.
Section 11(2) Coming soon
One Recipient Off The List
s.11(2) is a carve-out from disclosure, not from the whole access right.
Section 12(2)(a) Coming soon
Her Name Is Spelt Wrong
s.12(2) is triggered by the request, not by the size of the error.
Section 12(2)(b) Coming soon
The Second Address Line Is Missing
Completion is its own limb. s.12(1) grants a right to "correction, completion, updating and erasure", and s.12(2)(b) makes the Data Fiduciary, on request, "complete the incomplete personal data" — a record that is…
Section 12(2)(c) Coming soon
She Changes Her Mobile Number
The third limb of s.12(2) is the plain one and it is easy to miss: on a request, the Data Fiduciary shall — clause (c) — "update the personal data".
Section 12(3) Coming soon
Erase Everything, She Writes
s.12(3) is mandatory with two named exits.
Section 13(2) Coming soon
Ninety Days, Says The Reel
The ninety days is real and it is attached to something else. s.13(2) leaves the grievance response period "within such period as may be prescribed"; r.14(3) supplies "a reasonable period not exceeding ninety days…
Section 11(1) Coming soon
Writing To A Stranger Company
She writes to a company she has never dealt with.
Section 14(1) Coming soon
If She Is In Hospital
She wants her sister able to act for her if she is hospitalised.
Section 13(1) Coming soon
Sent Back To The Company
She goes to the Board first and is sent back.
Section 15(d) Coming soon
A Grievance Filed For Leverage
A user files a grievance she knows is baseless, to force a refund.
Section 15(b) Coming soon
Using A Friend's Details
Section 15 points at the Data Principal, not at the company.
Chapter IV — Special provisions
Section 17(1)(a) Coming soon
Legal Hold On Her Messages
s.17(1)(a). Where the processing of personal data is necessary for enforcing any legal right or claim, the provisions of Chapter II — except sub-sections (1) and (5) of section 8 — Chapter III and section 16 shall not…
Section 17(1)(d) Coming soon
Pune Processes German Payroll
A Pune back office handles the staff records of a client's German employees.
Section 17(1)(e) Coming soon
Every HR File Moves Over
s.17(1)(e) is not a switch that turns the Act off for a merger.
Section 17(3) Coming soon
The Startup Exemption She Heard About
s.17(3) is a power to notify, not a standing exemption.
Section 16(1) Coming soon
The Database Moves Overnight
Moving personal data out of India is not addressed by a flat yes or no. r.15 says such data "may be transferred outside the territory of India subject to the restriction that the Data Fiduciary shall meet such…
Section 16(1) Coming soon
Which Countries Are On The List
s.16(1) — "The Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be so notified." The sub-section…
Section 16(2) Coming soon
The Regulator Wants More
Nothing contained in section 16 restricts the applicability of any law for the time being in force in India that provides for a higher degree of protection for or restriction on transfer of personal data by a Data…
Section 17(1)(a) Coming soon
Kept To Defend The Suit
s.17(1) is a named list, not a switch. Where the processing of personal data is necessary for enforcing any legal right or claim, the provisions of Chapter II — except sub-sections (1) and (5) of section 8 — of Chapter…
Section 17(1)(b) Coming soon
The Tribunal Reads The File
s.17(1)(b), read with the opening words of s.17(1).
Section 17(1)(c) Coming soon
The Case File Comes Together
s.17(1)(c) is a carved exemption, not a blanket one.
Section 17(1)(d) Coming soon
Bengaluru Works For A Foreign Client
s.17(1)(d) does not switch the Act off. The opening words of s.17(1) name what shall not apply — Chapter II except sub-sections (1) and (5) of section 8, Chapter III, and section 16 — and the clause itself is written…
Section 17(1)(e) Coming soon
The Customer Book Changes Hands
A demerger moves the customer book to a new company.
Section 17(1)(f) Coming soon
Profiling The Borrower Who Defaulted
A bank profiles a borrower who has stopped paying.
Section 17(2)(a) Coming soon
A Notified Agency, Outside The Act
A notified security agency processes personal data.
Section 17(2)(b) Coming soon
The Research Paper And The Records
A university team studies hospital records for a paper.
Section 17(3) Coming soon
Exactly Five Duties Would Lift
A startup asks what an s.17(3) notification would actually lift.
Section 17(4) Coming soon
The Department Will Not Erase
A citizen asks a State department to erase her record.
Chapter V — Data Protection Board of India
Section 23(2)(a) Coming soon
The Empty Seat Argument
Section 23(2) is a saving clause. "No act or proceeding of the Board shall be invalid merely by reason of" a vacancy or a defect in the Board's constitution, a defect in the appointment of a person acting as…
Section 22(3) Coming soon
The Member Takes The Job
s.22(3) does not ban the job. It makes it conditional, and it makes the condition wide: for one year after she ceases to hold office a former Chairperson or Member may not accept any employment except with the previous…
Chapter VI — Powers, functions and procedure of the Board
Section 27(1)(a) Coming soon
The Board Wants It Stopped Today
The intimation a Data Fiduciary gives the Board under s.8(6) is the named trigger of s.27(1)(a).
Section 28(3) Coming soon
Sufficient Grounds, Or None
The Board decides whether to look into a company's affairs at all.
Section 28(7)(a) Coming soon
A Director On Oath
s.28(7) does not make the Board a court. It gives the Board, "for the purposes of discharging its functions under this Act", "the same powers as are vested in a civil court under the Code of Civil Procedure, 1908 (5 of…
Section 28(8) Coming soon
They Want The Servers
s.28(8) is a limit pointed at the regulator, not at the company.
Section 28(10) Coming soon
Stop Processing, For Now
An inquiry is not a waiting room. s.28(10) lets the Board act during the inquiry — "During the course of the inquiry, if the Board considers it necessary, it may for reasons to be recorded in writing, issue interim…
Section 28(12) Coming soon
Fifty Identical Complaints
The complaint side of the Act has a limit too. s.28(12) lets the Board warn a complainant or impose costs on her "if the Board is of the opinion that the complaint is false or frivolous", and s.15(d) makes not…
Section 27(1)(c) Coming soon
The Registration Is Suspended
Rule 4 gives the Board two powers over a Consent Manager that has drifted, and each states its own conditions.
Chapter VII — Appeal and alternate dispute resolution
Section 32(1) Coming soon
A Promise Instead Of A Fight
A s.28 proceeding has an off-ramp written into the Act. s.32(1) lets the Board accept a voluntary undertaking "at any stage of a proceeding under section 28", and s.32(4) makes acceptance "a bar on proceedings under…
Section 32(5) Coming soon
The Promise Was Missed
Missing a term of an accepted voluntary undertaking is not merely a broken promise. s.32(5): "such breach shall be deemed to be breach of the provisions of this Act", and the Board may then proceed under s.33 — where…
Section 31 Coming soon
Send Them To A Mediator
Not every complaint has to end in an order. s.31 gives the Board one sentence of alternate dispute resolution: if it "is of the opinion that any complaint may be resolved by mediation, it may direct the parties…
Section 29(1) Coming soon
Sixty Days, Then A Decree
An appeal against an order or direction made by the Board may be preferred before the Appellate Tribunal, and shall be filed within a period of sixty days from the date of receipt of the order or direction appealed…
Chapter VIII — Penalties and adjudication
Section 33(1) Coming soon
What The Safeguards Failure Costs
The Schedule's first row does not say what a safeguards failure costs.
Section 33(2)(a) Coming soon
Seven Things Set The Number
The Schedule gives a ceiling; s.33(2) gives the reasoning.
Section 34 Coming soon
Where The Penalty Money Goes
A penalty is not a payout. s.34 is one sentence: "All sums realised by way of penalties imposed by the Board under this Act, shall be credited to the Consolidated Fund of India." The money moves from the person…
Section 33(1) Coming soon
The Headline Says Two Fifty Crore
A headline says a company 'will be fined 250 crore'.
Chapter IX — Miscellaneous
Section 37(1)(a) Coming soon
Two Penalties, Then A Block
A platform penalised twice is ordered blocked.
Section 36 Coming soon
The Footnote Contradicts Itself
The printed commencement footnote to s.1(2) places ss.35 to 43 on one date and then lists 36 and 37 again on a later one.
Section 40(1) Coming soon
A Rule They Cannot Undo
An industry body says a rule it dislikes can never be undone.
Section 35 Coming soon
Suing The Board Itself
A company that lost an order wants to sue the Board and its officers.
Section 43(1) Coming soon
The Gap Nobody Foresaw
A ministry hits a gap the Act did not foresee.
Section 44(3) Coming soon
The RTI Clause That Changed
An RTI applicant is refused personal information about an official.
Section 44(2)(a) Coming soon
Section 43A Is Gone
A lawyer cites s.43A of the IT Act to claim compensation for a leak.
Section 39 Coming soon
The Local Civil Court Says No
A user wants to sue a company in her local civil court instead.
DPDP Rules, 2025
Rule 3(b)(i) Coming soon
The Sign-Up That Said Nothing
A sign-up page says only that it collects certain information to improve its services.
Rule 3(a) Coming soon
A Link To Page Forty
The notice must be presented and be understandable independently of any other information that has been, is or may be made available by such Data Fiduciary (DPDP Rules 2025, r.3(a)).
Rule 3(c)(iii) Coming soon
The Notice With No Complaint Link
The notice given by the Data Fiduciary to the Data Principal shall give the particular communication link for accessing the website or app, or both, of such Data Fiduciary, and a description of other means, if any,…
Rule 3(c) Coming soon
The Link Under Manage Preferences
The duty in r.3 is a duty on the notice. "The notice given by the Data Fiduciary to the Data Principal shall … (c) give, the particular communication link for accessing the website or app, or both, of such Data…
Rule 6(1)(c) Coming soon
No Log, No Answer
After an incident nobody can say who opened the HR drive, or when.
Rule 10 Coming soon
The Bank Already Knows The Mother
r.10 Illustration, Case 3: where the parent is opening the account herself, is a registered user of the platform and has previously made her identity and age details available, the Data Fiduciary "shall check to…
Rule 10(1)(b)(ii) Coming soon
A Token Instead Of A Document
r.10(1) sets the due diligence on the person claiming to be the parent, and then lists what the Data Fiduciary may check her against.
Rule 10 Coming soon
She Names Her Mother
A child signs up and declares her mother as her parent.
Rule 11(1) Coming soon
Consenting For Her Adult Son
A person saying she is the lawful guardian is a declaration; r.11(1) puts the check on the appointment behind it.
Rule 11(2)(b)(i) Coming soon
She Can Decide With Support
The guardian route is not switched on by a disability.
Rule 10(1)(a) Coming soon
The App Demands An ID Photo
r.10(1) makes the Data Fiduciary "observe due diligence, for checking that the individual identifying herself as the parent is an adult who is identifiable" — and then says what that check is made "by reference to":…
Rule 10(1) Coming soon
We Assumed They Were Adults
A platform says it assumed its users were adults.
Rule 7(2)(a) Coming soon
Eleven PM, Before The Forensics
The security team confirms the breach at eleven at night and wants to wait for forensics.
Rule 7(2)(b) Coming soon
Six Things Within Seventy-Two Hours
Seventy-two hours later the company files its follow-up.
Rule 7(2)(b) Coming soon
Three Days Is Not Enough
The seventy-two hours in r.7(2)(b) is not the only period the rule allows.
Rule 7(1) Coming soon
We Take Security Seriously
A breach email that says only "we take security seriously and are investigating" is not the intimation rule 7(1) describes.
Rule 7(1) Coming soon
After The Fix Ships Next Month
r.7(1) fixes the moment the clock starts and how long it may run: "On becoming aware of any personal data breach" the Data Fiduciary shall intimate each affected Data Principal "in a concise, clear and plain manner and…
Rule 7(1) Coming soon
A Notice On The Website Only
r.7(1) names where the breach intimation travels: the Data Fiduciary "shall … intimate to each affected Data Principal … through her user account or any mode of communication registered by her with the Data Fiduciary".
Rule 7(1)(d) Coming soon
What Should She Do Now
The notice explains what happened but not what she can do about it.
Rule 7(1)(e) Coming soon
Sent From A No-Reply Address
The breach email arrives from a no-reply address.
Rule 6(1)(c) Coming soon
Logging Was Switched Off
The DPDP Rules do not leave audit logging to a security team's judgement: r.6(1) says the reasonable security safeguards "shall include, at the minimum," — and clause (c) of that minimum is "visibility on the accessing…
Rule 6(1)(a) Coming soon
The Passwords Were Plain Text
The dump shows the passwords stored in plain text.
Rule 20 Coming soon
No Train To The Hearing
Rule 20 — in force since the Rules were published — says the Board "shall function as a digital office" and "may adopt techno-legal measures to conduct proceedings in a manner that does not require physical presence of…
Rule 19(9) Coming soon
A Year And Still No Order
The Board's inquiry runs on a clock written into the Rules. r.19(9): "The inquiry by the Board shall be completed within a period of six months from the date of receipt of the intimation, complaint, reference or…
Rule 9 Coming soon
Nobody's Name On The Form
r.9 is one sentence carrying two duties. The business contact information has to be prominently published on the website or app, and mentioned "in every response to a communication for the exercise of the rights of a…
Rule 14(1)(a) Coming soon
How Do I Even Ask
r.14(1) puts the discoverability of a data request on the company, not on the customer.
Rule 4(2)(b) Coming soon
The Application Comes Back Refused
Limb (b) of rule 4(2) is one sentence with one conjunction in it: the Board "is not satisfied, reject the application and communicate the reasons for the rejection to the applicant." The refusal and the reasons are…
Rule 13(1) Coming soon
The Assessment Is Three Years Old
r.13(1) fixes both the interval and the starting point.
Rule 13(3) Coming soon
The Algorithm Shapes What She Sees
r.13(3) reaches the software itself. A Significant Data Fiduciary must "observe due diligence to verify that technical measures including algorithmic software adopted by it" for a listed set of operations on personal…
Rule 13(4) Coming soon
Some Data Cannot Leave India
r.13(4) does not restrict data by category name.
Rule 14(1)(b) Coming soon
The Wrong Reference Number
Her request is rejected because she did not quote the right reference number.
Rule 9 Coming soon
Signed, The Team
The reply to her request is signed 'The Team'.
Rule 5(2)(a) Coming soon
A Scheme On An Executive Order
A scheme runs on an executive instruction, not a statute. 'Under law', 'under policy' and 'using public funds' are each defined — policy reaches instructions issued in exercise of executive power, and public funds…
Rule 23(1) Coming soon
Hand It Over, Say Nothing
A company is told to furnish information and to tell nobody.
Rule 8(2) Coming soon
Forty-Eight Hours Before The Purge
The warning before an r.8 erasure is not a courtesy — r.8(2) makes it a duty with a floor on the notice period and a fixed content.
Rule 8(3) Coming soon
The Cloud Host Kept Nothing
The company points at its cloud host and shrugs.
Rule 1(3) Coming soon
Consent Manager Onboarding, Live Now
Rule 4 — the registration of Consent Managers and the obligations that come with it — is on its own clock. r.1(3): "Rule 4 shall come into force one year after the date of publication of this Gazette." r.1(3) names one…
Rule 1(2) Coming soon
What Binds This Morning
Two instruments, two different commencement mechanisms.
DPDP Rules, 2025 — Schedules
Fourth Schedule Coming soon
The Age Gate Before The Game
A gaming app asks a new player to confirm she is not a child.
Fourth Schedule Coming soon
Fifteen, Alone, At The Clinic
Section 9(1) would make a Data Fiduciary obtain verifiable consent of the parent before processing any personal data of a child. r.12(1) and item 1 of Part A of the Fourth Schedule take sub-sections (1) and (3) off a…
Fourth Schedule Coming soon
The Physiotherapist Follows The Plan
Rule 12(1) switches off sub-sections (1) and (3) of section 9 for the classes listed in Part A of the Fourth Schedule — and item 2 lists "A Data Fiduciary who is an allied healthcare professional", on a condition the…
Fourth Schedule Coming soon
Counselling A Sixteen-Year-Old
The Fourth Schedule's carve-out is written for a defined class, not for a description of what a place does.
Fourth Schedule Coming soon
Attendance From The Classroom Camera
r.12(1) with Fourth Schedule Part A item 3 takes a class of Data Fiduciary out of s.9(1) and s.9(3) — but only on the terms the Schedule's third column sets: "Processing is restricted to tracking and behavioural…
Fourth Schedule Coming soon
The Bus Knows Where He Is
Fourth Schedule Part A item 5 is a class entry, and the class is the operator, not the school: "A Data Fiduciary who is engaged by an educational institution, crèche or child care centre for transport of children…
Fourth Schedule Coming soon
The Crèche Camera On Her Phone
A creche streams its playroom camera to a supervisor's phone.
Fourth Schedule Coming soon
An Email Account And Nothing Else
A school issues every student an account that only sends and receives email.
Fourth Schedule Coming soon
The Tablet Blocks The Ad
The DPDP Rules 2025 name this exact purpose. r.12(2) disapplies sub-sections (1) and (3) of section 9 to processing of a child's personal data for the purposes specified in Part B of the Fourth Schedule, subject to the…
Fourth Schedule Coming soon
The Class List And The Vendor
Fourth Schedule Part A does name an educational institution as a class for whom s.9(1) and s.9(3) do not apply — but the same row carries a condition, and the condition restricts the processing to tracking and…
Fourth Schedule Coming soon
Her Father Watches The Dot
Item 4 of Part B of the Fourth Schedule makes "the determination of real-time location of a child" a listed purpose, so that under r.12(2) sub-sections (1) and (3) of section 9 will not apply to processing for it.
Fourth Schedule Coming soon
The Committee Opens A File
A child welfare committee opens a file under a statute.
Seventh Schedule Coming soon
Deleted The Day It Shipped
Rule 8(3) of the DPDP Rules, 2025 tells "a Data Fiduciary" — not a class, not a threshold — to retain "such personal data, associated traffic data and other logs of the processing for a minimum period of one year from…
First Schedule Coming soon
Two Crore To Get Started
Registration is applied for, and it is applied for against a list. r.4(1): a person who fulfils the conditions set out in Part A of the First Schedule may apply to the Board.
First Schedule Coming soon
A Director With A Past
Registration as a Consent Manager is not only a balance-sheet test.
First Schedule Coming soon
Built In-House, Never Reviewed
Condition 9 of Part A is not "you have a security review".
First Schedule Coming soon
The Engineer Can Read It
Part B item 2 does not hand out permission to look.
First Schedule Coming soon
Everything She Ever Refused
The record a Consent Manager keeps is not a list of live permissions.
First Schedule Coming soon
A File, Not A Screenshot
Item 4 has two different clauses and they are not the same right. (a) is plain access to the record. (b) is the copy — "on the request of the Data Principal and in accordance with its terms of service, make available…
First Schedule Coming soon
Purging The Records At Two Years
Item 4(c) is a floor with two ways up and no way down: the Consent Manager "shall maintain such record for at least seven years, or for such longer period as the Data Principal and Consent Manager may agree upon or as…
First Schedule Coming soon
Routing Consent Through A Subsidiary
A Consent Manager cannot move the doing of its duties onto somebody else and stay clean.
First Schedule Coming soon
A Lender Quietly Buys In
The control of the company registered as the Consent Manager "shall not be transferred by way of sale, merger or otherwise, except with the previous approval of the Board and subject to fulfilment of such conditions as…
Seventh Schedule Coming soon
The Ministry Asks For Numbers
r.23(1): the Central Government may, for such purposes of the Act as are specified in Seventh Schedule, acting through the corresponding authorised person specified in the said Schedule, require any Data Fiduciary or…
Second Schedule Coming soon
Eight Standards For The Department
A department asks what rules it must follow inside that lane.
Second Schedule Coming soon
Nobody Told Her At All
A citizen is never told the State is processing her data in this lane. s.7(b) processing comes with an intimation carrying the business contact of a person who can answer, and the communication link for exercising her…
Third Schedule Coming soon
Three Years Since She Opened It
Rule 8(1) does not set a retention clock for everyone.
Third Schedule Coming soon
The Account He Stopped Playing
The Third Schedule's second row runs the same three-year erasure machinery as the first, on a different and lower headcount.
Third Schedule Coming soon
The Profile Nobody Opens
Third Schedule item 3 puts the same three-year erasure machinery on a "Data Fiduciary who is a social media intermediary having not less than two crore registered users in India" — and then declines to say in these…
Third Schedule Coming soon
Her Wallet Survives The Purge
Her wallet balance and her login are still there after the purge.
Third Schedule Coming soon
When Does The Clock Start
Does the three years run from her last login, or from the Rules.
Third Schedule Coming soon
The Saree Seller Asks
A saree seller on a big marketplace asks whether the three-year rule is hers. 'E-commerce entity' does not include a seller merely offering her goods or services for sale on a marketplace e-commerce entity
Seventh Schedule Coming soon
Deleted Her Account The Next Day
A user deletes her account the day after her order arrives.