Notice and consent
What must a person be told before their personal data is collected, and what makes consent valid? (ss. 5 and 6, DPDP Act; Rule 3, DPDP Rules)
PRACTICE AREA / 01
Data privacy & cybersecurity
Understand the data. Prepare for the incident.
How personal data moves through a business, the documents that govern it, and the legal side of preparing for a personal-data breach or cyber incident.
The laws covered: DPDP Act, 2023 · DPDP Rules, 2025 · CERT-In Directions, 2022
SUBJECTS WITHIN THIS AREA
Key questions under this law.
Vendors and processors
When may a vendor handle personal data for a business, and who remains responsible for it? (s. 8(1) and (2), DPDP Act; Rule 6(1)(f), DPDP Rules)
Security and breach
What safeguards are required, and whom must a business inform after a breach, and how fast? (s. 8(5) and (6), DPDP Act; Rules 6 and 7, DPDP Rules; CERT-In Directions, 2022)
A PRACTICAL STARTING POINT
A self-check
for readers.
Use these prompts to organise your thinking. Your answers stay on this page and are not submitted or saved. This is not an assessment or certification.
0 of 5 topics considered
Select the topics you have considered.
COMMON QUESTIONS
A little more context.
The DPDP framework commences in phases. Applicability and dates must be checked for the particular activity.
MeitY: DPDP Act and Rules ↗Does a privacy policy establish compliance?
No. The Act looks at how personal data is actually collected, used, secured and erased. A policy document is only one part of that.
Do all DPDP duties start on the same date?
No. The Act, the Rules and the commencement notifications must be read together; the Board and general provisions have applied since 13 November 2025, Consent Manager registration applies from 13 November 2026, and most duties of businesses apply from 13 May 2027.
Do the DPDP Rules require specific security measures?
Rule 6 lists minimum reasonable security safeguards, including encryption, masking or similar measures, access control, logs and monitoring, and backups. How they are put in place is a technical question for security specialists.
RELATED READING
Updates in this area.
DPDP Rules, 2025: what a small or mid-sized business must do, and by when
India's data protection law arrives in three phases ending on 13 May 2027; this note sets out, from the Act and the Gazette text of the Rules, what a business with customer and employee data has to put in place.
Published 28 October 2026Read ↗