Get DPDP Compliance for Your Business in Just 8 Weeks

A Data Fiduciary determines the purpose and means of processing personal data (similar to a controller under GDPR). A Data Processor processes data on behalf of and under the instructions of a Data Fiduciary. Data Fiduciaries bear the primary compliance obligations under the DPDP Act.

Significant Data Fiduciaries (SDFs) are designated by the Central Government based on factors including volume of personal data processed, sensitivity of data, national security risks, and impact on sovereignty. SDFs must appoint an India-based Data Protection Officer, conduct Data Protection Impact Assessments, and undergo periodic audits. They face penalties of up to ₹250 crore per breach instance.

Consent must be free, specific, informed, and unconditional. The consent notice must clearly specify the personal data to be collected, the processing purpose, and the manner in which the Data Principal can withdraw consent and exercise their rights. Pre-ticked boxes or bundled consent are not permitted. Data Principals must be able to withdraw consent as easily as they gave it.

Yes. "Deemed Consent" applies in certain situations where consent is not required — including processing for legitimate uses such as medical emergencies, provision of benefits/services by the State, employment purposes, and public interest purposes specified by the government. However, these must be approached carefully to avoid over-reliance.

Penalties range from ₹50 crore to ₹250 crore depending on the violation. The highest penalties (up to ₹250 crore) apply to breaches affecting Significant Data Fiduciaries and failures to implement adequate security safeguards. Penalties for failing to notify a breach or fulfill Data Principal rights also apply. The Data Protection Board of India adjudicates complaints and imposes penalties.

Yes. The DPDP Act provides heightened protection for children's data (individuals under 18). Data Fiduciaries must obtain verifiable parental consent before processing children's data and cannot track, monitor, or behaviorally target children or process data that may harm children. The age threshold may be modified by the Central Government via Rules.

The DPDP Act allows cross-border transfer of personal data to countries not restricted by the Central Government via a blocklist approach (unlike GDPR's adequacy decisions). Organizations must ensure transfers comply with applicable Rules and include appropriate contractual protections with Data Processors in other countries.

Yes, but with proportionality. All Data Fiduciaries regardless of size must comply with core DPDP requirements — consent, security safeguards, breach notification, and Data Principal rights. However, the DPDP Act allows the government to exempt certain categories of Data Fiduciaries (such as startups) from specific provisions via Rules. Proactive compliance is recommended as Rules are finalized.

DPDP and GDPR share similar principles (consent, purpose limitation, Data Principal/Subject rights, breach notification) but differ in scope and specifics. GDPR covers all personal data (physical and digital); DPDP covers only digital personal data. GDPR has more detailed requirements for DPIAs, legal bases beyond consent, and SCCs. Organizations with EU exposure should maintain both programs — ISpectra provides dual-compliance support.