Guides
DPDP guides, by topic
25 plain-language guides to the Digital Personal Data Protection Act and Rules, written from inside real compliance programmes. Free to read, share and quote.
Start here 7
Start hereThe DPDP Act and Rules: what they ask, and what you must be able to showA working guide to India's DPDP Act, 2023 and DPDP Rules, 2025: what is in force, who it covers, the evidence to keep, and a plan for 13 May 2027.Read the guide Start hereDPDP compliance deadline: 13 May 2027, and what 13 November 2026 changesEvery DPDP commencement date by provision, what 13 November 2026 changes, and dated plans to 13 May 2027 for small, large, SaaS and late-starting organisations.Read the guide Start hereDoes the DPDP Act apply to you? Scope, exemptions and edge casesWho the DPDP Act covers from 13 May 2027: a decision tree, what each exemption switches off, and ten worked cases, from NGOs and foreign SaaS to research.Read the guide Start hereDPDP compliance checklist: 40 controls to finish before 13 May 202740 DPDP controls to finish before 13 May 2027, each with what done looks like, the section or rule behind it, the evidence to keep and the person who owns it.Read the guide Start hereDPDP penalties: what the ₹250 crore cap means, and how the Board decidesDPDP penalties explained: the Schedule's caps, when a breach is significant, the seven factors the Board weighs, undertakings, blocking, CERT-In and directors.Read the guide Start hereDPDP gap assessment: what it covers, how long it takes, what you getWhat a DPDP gap assessment covers, how long it takes by size, sample gap register rows and a heat map, and whether any official DPDP certification exists.Read the guide Start hereDPDP Act glossaryPlain-English definitions of 28 DPDP Act terms, from Data Fiduciary and Consent Manager to verifiable consent, DPIA, Third Schedule, nominee and TDSAT appeals.Read the guide
For your organisation 6
For your organisationDPDP for NGOs: beneficiary registers, WhatsApp groups and field teamsHow the DPDP Act applies to NGOs: roles with funders and government, basis for services, children, WhatsApp and registers, breaches, and a plan for May 2027.Read the guide For your organisationDPDP for CSR foundations: what you owe for data your implementing partners collectA CSR foundation that shapes a programme or receives named beneficiary data is a Data Fiduciary. Roles, partner questions, grant clauses and board reporting.Read the guide For your organisationDPDP for SaaS startups: what your enterprise customers will ask you to proveDPDP for SaaS startups: processor or fiduciary by feature, DPA and questionnaire asks mapped to the Rules, consent and erasure engineering, a 90-day plan.Read the guide For your organisationDPDP for a corporate group: one programme across many entitiesDPDP for corporate groups: each entity a fiduciary, intra-group sharing, a group operating model, SDF readiness, M&A under s. 17(1)(e), audit evidence.Read the guide For your organisationTen questions a board should ask management about DPDPTen DPDP questions for boards and trustees before 13 May 2027: why each matters, what a good answer looks like, red flags, evidence and a quarterly report.Read the guide For your organisationDPDP vs GDPR: the differences that change what you buildDPDP vs GDPR, article by section: no legitimate interests or contract ground, children at 18, breach notice to all, a transfer blacklist, and what to reuse.Read the guide
Consent and notices 7
Consent and noticesHow to write a DPDP consent notice: Rule 3, with examples you can copyWhat a DPDP consent notice must say under s. 5 and Rule 3, the language rules, layering, and sample notices for web, app, SMS, IVR, paper, parents and donors.Read the guide Consent and noticesInformed consent from beneficiaries: oral, assisted and low-literacy consent under DPDPHow NGOs take informed DPDP consent from low-literacy beneficiaries: spoken and thumbprint consent, dialect audio, parents without phones, scripts and records.Read the guide Consent and noticesThe data you already hold: re-notice, re-consent or delete before May 2027DPDP section 5(2) and the data you already hold: triage by legal basis, a notice campaign by SMS, WhatsApp, IVR and field visit, and what to erase by May 2027.Read the guide Consent and noticesVerifiable parental consent under DPDP: methods that work without a smartphoneHow to verify a parent's identity and age under Rule 10, with methods for parents without smartphones, every Fourth Schedule exemption, and schools and edtech.Read the guide Consent and noticesWhen you don't need consent: section 7 of the DPDP Act, ground by groundWhen you can process personal data without consent under section 7 of the DPDP Act: a test for each ground, who may use it, and which duties and rights remain.Read the guide Consent and noticesConsent Managers under DPDP: registration opens 13 November 2026. Do you need one?What a DPDP Consent Manager is, Rule 4 registration conditions from 13 November 2026, how it differs from consent software, and a decision tree for fiduciaries.Read the guide Consent and noticesHow to choose a DPDP consent management platform: 12 testsTwelve vendor-neutral tests for choosing a DPDP consent management platform in India, with a live demo script, a scoring sheet and contract terms to insist on.Read the guide
Data, security and vendors 5
Data, security and vendorsDPDP data mapping: find every record in four weeks, paper and WhatsApp includedA four-week DPDP data mapping method: team interview questions, an inventory template, finding WhatsApp, phone and shared-drive data, and what the map feeds.Read the guide Data, security and vendorsData breach under DPDP: the 72-hour Board report and CERT-In's six hoursDPDP breach notification from 13 May 2027 and CERT-In's six-hour rule today: what counts, what to tell people and the Board, an hourly playbook and a drill.Read the guide Data, security and vendorsThe DPDP data processing agreement: fiduciary or processor, and the contract you needWhat a DPDP data processing agreement must contain, how to tell a data fiduciary from a processor, joint fiduciaries, and an illustrative addendum with annexes.Read the guide Data, security and vendorsEmployee data under DPDP: hiring, payroll, CCTV and exitHow the DPDP Act treats employee data: the s. 7(i) employment ground and its limits, candidates, background checks, CCTV, biometrics, payroll vendors and exit.Read the guide Data, security and vendorsDPDP and AI: training data, chatbots and staff using AI toolsDPDP Act and AI: the basis for training on personal data, public data under s. 3(c)(ii), chatbots and children, a staff AI-tool policy, erasure from models.Read the guide
Not sure where to start?Answer a few questions and get your DPDP score, the gaps to fix first and a plan to 13 May 2027.
Get your DPDP score