Consently Blog
Expert insights on DPDPA 2023 compliance, data protection, and privacy best practices
DPDP Removal of Difficulties Order 2026: Two Words Changed, Nothing Else Did
What S.O. 5458(E) says, the two provisions behind it, what it does not change and a five-point checklist.
DPDP Breach Notification: Two Clocks, Two Regulators, 72 Hours
Rule 7 of the DPDP Rules, CERT-In's six hour rule, the penalties in the Schedule and an 8-step breach readiness checklist.
Data Principal Rights Under DPDP: Access, Correction, Erasure and Grievances
Access, correction, erasure and grievances under Sections 11 to 13 of the DPDP Act and Rule 14, with the limits and an 8-step checklist.
Verifiable Parental Consent Under DPDP: What Section 9 Demands
Under the DPDP Act, anyone below 18 is a child. Section 9 needs verified parental consent and bans tracking and targeted ads for children. What Rule 10 asks for, and an 8-step checklist.
DPDP Granular Consent: Why One Checkbox Is No Longer Enough
One checkbox covering terms, marketing, WhatsApp and partner sharing is unlikely to hold up under the DPDP Act. Here is what Section 6 and Rule 3 require, what purpose-level consent looks like on a real form, and a checklist to finish before 13 May 2027.
13 November 2026 Is Not Your DPDP Deadline. Here Is What It Actually Starts.
13 November 2026 opens Consent Manager registration under Rule 4 of the DPDP Rules, 2025. It places no new obligation on an ordinary Data Fiduciary. Your notice, consent, security, breach and rights obligations start on 13 May 2027. Here is who should act in November, and how to use the months in between.
Proving Consent Under the DPDP Act: What Your Consent Records Must Show
Under Section 6(10) of the DPDP Act, the Data Fiduciary has to prove that notice was given and consent was obtained. A "true" in your users table will not do that. This guide covers what a defensible consent record contains, why refusals and withdrawals must be recorded too, and a checklist for 13 May 2027.
DPDP Compliance for AI Chatbots and LLM Apps Built in India
Your chatbot is a data collection surface with a text box. Users paste Aadhaar numbers, medical histories, and card details into it, your prompts go to a model provider abroad, and every conversation is logged. Here is what the DPDP Act requires of an LLM application built in India — and the architecture that satisfies it.
DSAR Automation in 2026: Running Data Principal Rights Requests at Volume
The first Data Principal rights request is a curiosity. The five hundredth is an operational crisis. Under the DPDP Act you must verify identity, search every system, respond within your published timeline, and prove you did. Here is how to build a rights workflow that survives volume.
Data Retention and Erasure Under the DPDP Rules: The Three-Year Clock and How to Automate It
The DPDP Rules attach a hard erasure clock to specified classes of data fiduciary: three years of Data Principal inactivity and the data must go, with 48 hours' notice before deletion. Most Indian companies have never deleted anything. Here is what the rule requires and how to build the machinery.
DPDP Consent Manager Registration: Eligibility, the ₹2 Crore Net Worth Bar, and the Application Checklist
The Consent Manager framework goes live on 13 November 2026. Registration requires incorporation in India, a minimum net worth of ₹2 crore, and demonstrated technical capability to run consent across fiduciaries. Here is who qualifies, what the application needs, and — importantly — why most businesses should not apply.
Employee Data Under the DPDP Act: What Indian HR Teams Must Fix Before 2027
HR holds more sensitive personal data than marketing ever will — Aadhaar, bank details, medical records, background checks, CCTV, and now productivity monitoring. The DPDP Act covers all of it. The good news: much of it does not need consent. The bad news: most HR teams have no idea which parts do.