# Ten questions a board should ask management about DPDP

> Most DPDP duties start on 13 May 2027, with penalties of up to ₹250 crore falling on the organisation. The Act creates no offences and no officer-liability clause, but directors sign a statement that the company has proper systems to comply with all applicable laws, and the IT Act can reach persons in charge. This guide gives ten questions to put to management, what a good answer and a red flag look like, the evidence to ask for, a quarterly reporting template, a sample resolution and guidance for listed companies.

Source: https://dpdp.commons.inc/dpdp-for-boards · Updated 25 October 2026 · By the Commons Trust team (commons.inc)

Every year, a company's directors state in the board's report that they have devised proper systems to ensure compliance with all applicable laws, and that those systems are adequate and operating effectively (Companies Act, 2013, s. 134(5)(f)). From 13 May 2027 the Digital Personal Data Protection Act is one of those laws, with penalties of up to ₹250 crore on the organisation. A board can test that statement by putting ten questions to management each quarter and asking to see the evidence behind each answer. The DPDP Act itself creates no offences and makes no director personally liable; the IT Act and ordinary duties of care are where personal exposure lies.

This guide is for directors, trustees and governing council members of companies, foundations and nonprofits, and for the DPOs, CFOs and company secretaries who brief them. Like the Act (s. 2(y)), we say "she" and "her" for every person.

Jump to:

- [What directors and trustees are exposed to](#what-directors-and-trustees-are-exposed-to)
- [The ten questions](#the-ten-questions)
- [A quarterly report you can ask for](#a-quarterly-report-you-can-ask-for)
- [Listed companies and CFOs](#for-listed-companies-and-cfos)
- [Sample resolution and minutes](#a-sample-resolution-and-minute-wording)
- [When answers stay weak](#what-the-board-should-not-do-and-when-to-escalate)

## What directors and trustees are exposed to

**Under company law.** The s. 134(5)(f) statement covers "all applicable laws", with no carve-out for data protection. Until 13 May 2027, the SPDI Rules under IT Act s. 43A are already an applicable law for companies. Our view: from the financial year in which 13 May 2027 falls, directors cannot honestly give the statement without some evidence of DPDP readiness. Directors must also act with due and reasonable care, skill and diligence (s. 166(3)). An independent director, and a non-executive director who is neither a promoter nor key managerial personnel, is liable only for acts that occurred with her knowledge, attributable through board processes, and with her consent or connivance, or where she had not acted diligently (s. 149(12)). That protection limits liability under the Companies Act only; it does not answer IT Act s. 85. Section 8 companies are companies for all of these purposes.

**Under the DPDP Act.** The Act creates no criminal offences and has no clause making directors, trustees or officers personally liable. A penalty is imposed on "a person" found in significant breach, after an inquiry and a hearing (s. 33(1)), and "person" includes a company, a firm, an association of persons or body of individuals, and every artificial juristic person (s. 2(s)). For most readers that person is the company, trust or society. Penalties go to the Consolidated Fund of India (s. 34). The full schedule, and how the Board sets an amount, are in [Penalties under the DPDP Act](/dpdp-penalties).

**Under the IT Act and CERT-In.** Failing to comply with CERT-In's directions, including the six-hour incident reporting rule in the [Directions of 28 April 2022](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf), remains an offence under s. 70B(7) of the IT Act, punishable with imprisonment of up to one year, a fine of up to ₹1 crore (raised from ₹1 lakh from 30 November 2023), or both. Courts act only on a complaint by an officer authorised by CERT-In (s. 70B(8)). Where a company commits a contravention, s. 85(1) makes every person who "was in charge of, and was responsible to, the company for the conduct of business of the company" liable unless she proves it happened without her knowledge or that she exercised all due diligence to prevent it, and also makes liable any director or officer whose consent, connivance or neglect is proved. The explanation to s. 85 defines "company" to include a firm or other association of individuals; whether a particular trust or society falls within it is a question for your lawyer.

**For trusts and societies.** Trustees and governing council members owe the duties set by the trust deed or bylaws and the state law that governs the organisation. The DPDP Act adds no personal duty, but a penalty or a public breach is a loss to the organisation's funds and reputation, and funders will ask what the trustees did. Our view: minute the oversight, so the record shows the questions were asked and followed up.

**Reputation and funders.** We expect the Board's orders to become public, and we expect enterprise customers, CSR funders and donors to add DPDP questions to their due diligence.

## Why the timing matters now

Duties start on 13 May 2027 with no further run-in. In January 2026 MeitY reportedly discussed with industry shortening the window, at least for Significant Data Fiduciaries; as of 25 October 2026 we have found no amending notification (see the [DPDP timeline](/dpdp-timeline)). The work that takes longest, finding all the data and re-noticing people whose data you already hold, has to finish before then. The organisation carries the burden of proving consent (s. 6(10)) and stays responsible for its vendors "irrespective of any agreement to the contrary" (s. 8(1)). And the work cuts across programmes or product, fundraising or sales, HR, IT, finance and legal, which only the board, or someone it empowers, can make move together.

## The ten questions

Ask for the evidence as well as the answer.

### 1. Who owns DPDP here, and does she have the authority to make every team change?

**Why it matters.** Without an owner who can direct every function, the "technical and organisational measures" the Act requires do not get built (s. 8(4)). A Significant Data Fiduciary must have an India-based DPO responsible to its board (s. 10(2)(a)).

**A good answer.** One named person, senior enough to direct programme, product, HR and IT leads, with a budget, a champion in each team, published contact details (s. 8(9), Rule 9) and a regular line to the board or a committee.

**Red flags.** DPDP sits with IT alone, or legal alone. The owner is a junior hire who cannot overrule a business head. "The vendor is handling it."

**Evidence to ask for.** The resolution appointing the owner; the published contact details; the list of champions; the programme budget.

### 2. Do we know what personal data we hold, where it sits and why we keep it?

**Why it matters.** You cannot give a notice for data you do not know you collect, erase what you cannot find, or tell a person who received her data (s. 5, s. 8(7), s. 11(1)(b)). Data digitised from paper is covered too (s. 3(a)).

**A good answer.** A data map covering every system, form, spreadsheet, messaging group, vendor and partner, with an owner, purpose and basis for each, and coverage rising each month.

**Red flags.** The map lists only core applications. No one has looked at field phones, shared drives, HR or fundraising. "We don't hold sensitive data": the Act has no such category, yet sensitivity counts both for Significant Data Fiduciary notification and for the penalty amount (ss. 10(1)(a), 33(2)(b)).

**Evidence to ask for.** The map, with coverage by function; the systems found since the last report. [Data mapping](/dpdp-data-mapping) explains the method.

### 3. On what basis do we use each kind of data, and could we prove a consent tomorrow?

**Why it matters.** Processing without consent or a listed legitimate use breaches the Act, and where consent is questioned the organisation must prove it (s. 4, s. 6(10)). Breaches of these duties carry up to ₹50 crore (Schedule item 7).

**A good answer.** Each purpose has a recorded basis, consent or a named clause of s. 7, with a note of why. Consent records show notice version, language, channel, time and decision. There is a plan, with numbers, for re-noticing people whose data the organisation already holds (s. 5(2)).

**Red flags.** "Everyone signs our terms." One checkbox for several purposes (s. 6(1)). A private organisation relying on s. 7(b), which is for the State. No plan for legacy data.

**Evidence to ask for.** The purpose register; one consent record pulled at random during the meeting; the notice drive plan. See [The data you already hold](/dpdp-existing-data).

### 4. If we had a breach tonight, what would happen in the first 72 hours?

**Why it matters.** Affected people and the Board must be told without delay, with a detailed report to the Board within 72 hours, and failing to notify carries up to ₹200 crore (s. 8(6), Rule 7, Schedule item 2). Where the CERT-In Directions apply, specified incidents must be reported within six hours.

**A good answer.** One incident playbook covering the Board, affected people, CERT-In and any sector regulator, with named roles and deputies, notice templates in the languages people use, and a drill in the last twelve months with lessons fixed.

**Red flags.** Separate IT and legal playbooks that have never met. No one has checked whether the CERT-In Directions apply. Vendors are not bound to tell you within hours.

**Evidence to ask for.** The playbook; the last drill report and what changed; vendor notice clauses. [Data breach under DPDP](/dpdp-breach-response) has a drill script.

### 5. Could we show that our security safeguards were reasonable, before anything went wrong?

**Why it matters.** Failing to keep reasonable security safeguards carries the Act's largest penalty, up to ₹250 crore (s. 8(5), Schedule item 1). Rule 6(1) sets the minimum: encryption or masking, access control, logs and monitoring, backups, a year of logs, contract terms and organisational measures.

**A good answer.** Each Rule 6 item mapped to a control with an owner and evidence, a list of known gaps with dates, and attention to the organisational weak points: links shared publicly, shared logins, leavers who still have access, data on personal phones.

**Red flags.** "We are ISO 27001 certified, so we are covered." Its scope may exclude the systems holding beneficiary or customer data. No access review in the last six months.

**Evidence to ask for.** The Rule 6 control map; the latest access review; log retention settings; open security findings by age.

### 6. Do we process children's data, or data of people with a lawful guardian, and how do we verify the parent or guardian?

**Why it matters.** Processing a child's data without a parent's verifiable consent, or tracking and targeting children, breaches s. 9, with penalties up to ₹200 crore (Schedule item 3). A child is anyone under eighteen (s. 2(f)), and Rule 10 requires due diligence that the parent is "an adult who is identifiable if required in connection with compliance with any law".

**A good answer.** A list of every programme, product or system that touches under-18s, how parents are verified in each, how guardians of persons with disability are checked (Rule 11), and which Fourth Schedule exemption is relied on and why it fits the exact words.

**Red flags.** "Our users are mostly adults." Self-consent at sixteen or seventeen; there is none. "We work with schools, so we are exempt"; the educational-institution exemption covers only tracking and behavioural monitoring for educational activities or children's safety (Fourth Schedule, Part A, item 3).

**Evidence to ask for.** The list; one sample verification record; the legal note on any exemption. See [children's data under DPDP](/dpdp-childrens-data).

### 7. Which vendors, partners and grantees handle our data, and under what contracts?

**Why it matters.** The organisation stays responsible for what its processors do and may use them only under a valid contract (s. 8(1), (2)). Missing security terms in those contracts is a gap in the safeguards duty itself (Rule 6(1)(f)).

**A good answer.** A register of every vendor and partner holding personal data, its role (processor, or a fiduciary in its own right where it decides purpose and means with you, s. 2(i); our view is that a co-designing funder and partner may both be fiduciaries), contract status, breach-notice period and renewal date, with gaps closing on a schedule.

**Red flags.** Contracts signed years ago with no data terms. Free tools used by teams with no contract. Roles with implementing partners never discussed.

**Evidence to ask for.** The register, with contracts updated and outstanding. See [processor contracts](/dpdp-processor-contracts) and, for funders, [DPDP for CSR foundations](/dpdp-for-csr-foundations).

### 8. Can people see, correct and erase their data, and complain, and do we answer on time?

**Why it matters.** People have rights to access, correction, erasure, grievance redress and nomination, with grievances answered within a published period of no more than 90 days (ss. 11 to 14, Rule 14(3)). A person must use your grievance route before going to the Board (s. 13(3)); our view is that a desk that resolves complaints will keep most of them away from the regulator.

**A good answer.** One published route, one queue for every channel, a clock on each request, and a monthly count of requests, response times and late ones.

**Red flags.** Requests arrive by WhatsApp to field staff and are never logged. No one can say which vendors hold a given person's data. The grievance period is not published.

**Evidence to ask for.** The quarter's request log; the oldest open request; the published request page.

### 9. What do we keep, for how long, and does erasure actually happen?

**Why it matters.** Data must be erased when consent is withdrawn or the purpose ends, unless another law requires it to be kept (s. 8(7)). Every fiduciary must also keep data, traffic data and logs for at least one year for the Seventh Schedule purposes (Rule 8(3)).

**A good answer.** A retention schedule naming each data set, purpose, period, reason and owner, and erasure jobs that have run and left a record.

**Red flags.** "We keep everything, just in case." A schedule that exists only as a policy. Erasure that ignores backups, processors or field devices.

**Evidence to ask for.** The schedule; the log of the last erasure run, including what was kept and why.

### 10. Are we on track for 13 May 2027, and could we be notified as a Significant Data Fiduciary?

**Why it matters.** Duties start on that date with no run-in. A Significant Data Fiduciary must add a DPO, an independent data auditor, and an annual impact assessment and audit reported to the Board, with penalties up to ₹150 crore for failing them (s. 10, Rule 13, Schedule item 4); none had been notified as of 25 October 2026.

**A good answer.** A dated plan with owners, progress measured by evidence produced, a reasoned view on SDF risk (s. 10(1) factors), and slack in case dates move.

**Red flags.** A plan that ends in May 2027 with nothing after it. Progress reported as "policies approved" alone. No contingency for an earlier date.

**Evidence to ask for.** The plan; the readiness score and how it is calculated; the SDF assessment.

## A quarterly report you can ask for

Ask management to bring this to every meeting of the responsible committee until 13 May 2027, and to the full board twice a year, in two pages. The figures are placeholders; the format is ours, not a legal requirement.

| Item | This quarter | Last quarter | Target by May 2027 | Comment |
|---|---|---|---|---|
| Readiness: controls with evidence on file | 52 of 120 | 31 of 120 | 120 | Count only controls with evidence |
| Data map coverage, by function | 70% | 45% | 100% | Fundraising and HR outstanding |
| Purposes with a recorded basis | 18 of 22 | 9 of 22 | All | |
| Existing-data notice drive (s. 5(2)) | 0% reached | n/a | Plan agreed | Starts after notices approved |
| Vendors and partners with compliant contracts | 14 of 31 | 6 of 31 | All | Payroll vendor overdue |
| Children's data: programmes with parent verification | 2 of 4 | 0 of 4 | All | |
| Rights requests received, and any late | 6, none late | 2, none late | None late | |
| Breach drill in the last 12 months | Yes, Sept | No | Yes | Two actions open |
| Incidents and near misses | 1 near miss | 0 | | Shared link found and closed |
| Budget: spent and committed against plan | | | | |
| Top three risks, with owners and dates | | | | |
| Decisions needed from the board | | | | |

Count a control as done only when its evidence is on file, and give every red item a date and a named owner.

## For listed companies and CFOs

**Risk management committee.** For listed entities required to have one (the top 1,000 by market capitalisation and high-value debt listed entities), SEBI's Listing Regulations (Regulation 21) require the risk management committee's role to cover cyber security risk. Our view: put DPDP on that committee's agenda alongside cyber security, since breach readiness and safeguards are the same conversation. Check the current text of Regulation 21 and Schedule II with your company secretary.

**Sustainability reporting.** The Business Responsibility and Sustainability Report that the largest listed companies file includes questions on consumer complaints about data privacy and cyber security, and on data breaches. Expect DPDP readiness to show up in those answers; check the current BRSR format with your company secretary before relying on the exact wording.

**Sizing the budget.** We give no rupee figures here, because they depend on what you hold. These are the lines a credible estimate should contain, as guidance:

- internal owner and champions' time, including the months after May 2027;
- external help for assessment, policies, legal review and training;
- platform licence and, usually larger in year one, integration work;
- the s. 5(2) notice drive: number of people to reach multiplied by the cost per channel (SMS, WhatsApp, calls, field visits);
- security fixes from the Rule 6 gap list;
- data clean-up and erasure across old systems;
- contingency for an earlier date or SDF notification.

**Challenging management's cost estimate.** Ask what it assumes about the number of systems and people to re-notice, and how those numbers were found. Ask whether integrations, the notice drive and run-rate costs after May 2027 are included. Ask for the cost of the minimum defensible version and what it would leave uncovered. Ask which estimates come from vendors who are also selling the work. An estimate with no data map behind it is a guess.

## A sample resolution and minute wording

Illustrative only; adapt it with your company secretary or legal adviser.

> **Resolution of the [Audit / Risk] Committee, [date].** RESOLVED THAT [name], [designation], is appointed as the officer accountable for the organisation's compliance with the Digital Personal Data Protection Act, 2023 and the Rules made under it, with authority to direct all functions on matters within that responsibility and to engage external advisers within the approved budget of [amount]; THAT she shall report to this Committee at each meeting until 13 May 2027 using the agreed quarterly format, and to the Board twice a year; AND THAT management shall answer the Committee's ten DPDP questions in writing, with supporting evidence, by [date].

Sample minute lines:

> The Committee reviewed the DPDP quarterly report. It noted that 14 of 31 vendor contracts meet the Act and asked the accountable officer to present a plan for the remaining 17, with dates, at the next meeting.
>
> The Committee observed the breach drill held on [date] and noted two actions: vendor notice terms and out-of-hours escalation. Owners: [names]. Due: [date].
>
> The Committee asked whether the CERT-In Directions apply to the organisation. Management will obtain legal advice and report by [date].

## What the board should not do, and when to escalate

Our view of what boards should avoid:

- running the programme, or approving every notice and procedure;
- accepting a certificate or vendor badge as proof of compliance (as of 25 October 2026 there is no official DPDP certification; see [gap assessment](/dpdp-gap-assessment#is-there-a-dpdp-certification));
- treating DPDP as an IT project, or leaving it to a vendor;
- asking for zero risk, which pushes management to report green.

If answers stay weak after two quarters, escalate in steps: name a board sponsor to work with the owner; commission an independent [gap assessment](/dpdp-gap-assessment); set dated milestones in a resolution; and if they are missed, change the owner or her authority and take the matter to the full board.

## Where the law is unclear

**Will the Board look at governance when it sets a penalty?** Probably, through the mitigation and gravity factors. *Why:* s. 33(2) asks about the nature, gravity and duration of the breach and whether, how quickly and how effectively the organisation mitigated (s. 33(2)(a), (e)). Board oversight is evidence of both. *Would change if:* early orders ignore organisational factors. *Confidence:* medium.

**Does DPDP non-compliance affect the s. 134(5)(f) statement?** We think it does from the year the duties start. *Why:* the statement covers "all applicable laws". *Would change if:* the Ministry of Corporate Affairs or the courts narrow how it is read. *Confidence:* medium.

**Is a board member a "person in charge" under IT Act s. 85?** Usually not a non-executive director, but it depends on her role. *Why:* under the similar clause in s. 141 of the Negotiable Instruments Act, the Supreme Court has held that being a director is not enough; the complaint must show she was in charge of and responsible for the conduct of the business (SMS Pharmaceuticals v. Neeta Bhalla, (2005) 8 SCC 89), and officers can be prosecuted only if the company itself is (Aneeta Hada v. Godfather Travels, (2012) 5 SCC 661). *Would change if:* a court applies s. 85 to non-executive directors on CERT-In failures. *Confidence:* low.

## What to do at your next meeting

1. Put DPDP on the agenda of the committee that oversees risk or cyber security, as a standing item until 13 May 2027.
2. Pass a resolution appointing the accountable owner, with authority and budget.
3. Ask management to answer the ten questions in writing, with evidence, within four weeks.
4. Agree the quarterly report format.
5. Ask when the last breach drill happened. If never, ask for one before the next meeting, with a board member observing.
6. Minute the questions and the answers.

For the duties behind these questions, see [the DPDP Act guide](/dpdp-act-guide); for a control-by-control list, the [DPDP compliance checklist](/dpdp-compliance-checklist).

**How we wrote this guide.** We worked from the text of the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), as corrected by G.S.R. 892(E)), the Information Technology Act, 2000 as amended by the Jan Vishwas (Amendment of Provisions) Act, 2023, the CERT-In Directions of 28 April 2022 and the Companies Act, 2013. References to SEBI's Listing Regulations and the BRSR format are summaries; check the current text. Events after November 2025 come from linked reports, last checked 25 October 2026. Statements marked "our view" are our judgement, not the law. This guide explains the law; it is not legal advice.
{: .note }

## Questions people ask

### Should the board approve the privacy policy itself?

The DPDP Act does not require board approval of any policy. Our view: the board or a committee should approve the data protection policy and the risk appetite behind it, because those choices set what management may do with people's data. It should not approve every notice or procedure. Approval matters less than evidence that the policy is followed, so pair approval with the quarterly report.

### Which committee should own DPDP oversight?

The Act does not say. Many boards will give it to the audit committee or a risk committee, since the questions are about controls and evidence. Our view: choose the committee that already oversees cyber security, so that breach readiness and data protection are seen together, and give it a standing agenda item at least quarterly until 13 May 2027. Smaller trusts and societies can keep it with the full board.

### Should we buy insurance for DPDP penalties?

Talk to your broker and lawyer; this is not settled. Cyber policies often cover breach response costs, and some cover regulatory fines where the law allows them to be insured. Whether a penalty under s. 33 of the DPDP Act can be insured in India has not, as far as we know, been tested. Read the exclusions closely, and do not treat insurance as a substitute for the safeguards s. 8(5) requires.

### What should the board minute, and in how much detail?

Our view: enough to show the board asked, challenged and followed up: the question, the substance of management's answer, the evidence seen, any decision, the owner and date for each action, and dissent where there was some. Avoid pasting legal advice into the minutes in full; record that advice was received and the decision taken. Minutes are a record a regulator, auditor or court may later read, so write them for that reader.

### What should a board do if management says it is too early, because the Board has no members yet?

Reject the premise. As far as we found on 25 October 2026, no Chairperson or Members of the Data Protection Board had been appointed, but the duties start on 13 May 2027 whether or not it is staffed, and breaches, complaints and court references can reach it from then on. Section 6(10) puts the burden of proving consent on the organisation in any proceeding, including in court. A late start compresses the hardest work, the data map and the notice drive for existing data, into too few months.

## About Commons Trust

Commons Trust is a DPDP compliance programme and consent management platform from commons.inc that takes nonprofits, foundations, startups and corporates from wherever they are to fully compliant with India's Digital Personal Data Protection Act. Contact: hello@commons.inc · https://dpdp.commons.inc/#start