Consently Blog
Expert insights on DPDPA 2023 compliance, data protection, and privacy best practices
DPDP Removal of Difficulties Order 2026: Two Words Changed, Nothing Else Did
What S.O. 5458(E) says, the two provisions behind it, what it does not change and a five-point checklist.
DPDP Breach Notification: Two Clocks, Two Regulators, 72 Hours
Rule 7 of the DPDP Rules, CERT-In's six hour rule, the penalties in the Schedule and an 8-step breach readiness checklist.
Data Principal Rights Under DPDP: Access, Correction, Erasure and Grievances
Access, correction, erasure and grievances under Sections 11 to 13 of the DPDP Act and Rule 14, with the limits and an 8-step checklist.
Verifiable Parental Consent Under DPDP: What Section 9 Demands
Under the DPDP Act, anyone below 18 is a child. Section 9 needs verified parental consent and bans tracking and targeted ads for children. What Rule 10 asks for, and an 8-step checklist.
DPDP Granular Consent: Why One Checkbox Is No Longer Enough
One checkbox covering terms, marketing, WhatsApp and partner sharing is unlikely to hold up under the DPDP Act. Here is what Section 6 and Rule 3 require, what purpose-level consent looks like on a real form, and a checklist to finish before 13 May 2027.
13 November 2026 Is Not Your DPDP Deadline. Here Is What It Actually Starts.
13 November 2026 opens Consent Manager registration under Rule 4 of the DPDP Rules, 2025. It places no new obligation on an ordinary Data Fiduciary. Your notice, consent, security, breach and rights obligations start on 13 May 2027. Here is who should act in November, and how to use the months in between.
Proving Consent Under the DPDP Act: What Your Consent Records Must Show
Under Section 6(10) of the DPDP Act, the Data Fiduciary has to prove that notice was given and consent was obtained. A "true" in your users table will not do that. This guide covers what a defensible consent record contains, why refusals and withdrawals must be recorded too, and a checklist for 13 May 2027.
DPDP Consent Manager Registration: Eligibility, the ₹2 Crore Net Worth Bar, and the Application Checklist
The Consent Manager framework goes live on 13 November 2026. Registration requires incorporation in India, a minimum net worth of ₹2 crore, and demonstrated technical capability to run consent across fiduciaries. Here is who qualifies, what the application needs, and — importantly — why most businesses should not apply.
Employee Data Under the DPDP Act: What Indian HR Teams Must Fix Before 2027
HR holds more sensitive personal data than marketing ever will — Aadhaar, bank details, medical records, background checks, CCTV, and now productivity monitoring. The DPDP Act covers all of it. The good news: much of it does not need consent. The bad news: most HR teams have no idea which parts do.
Significant Data Fiduciary Under DPDP: Obligations, DPO Requirements, Audits and Cross-Border Rules
Being designated a Significant Data Fiduciary adds four obligations no ordinary Data Fiduciary has: a resident DPO, an independent data auditor, annual Data Protection Impact Assessments, and algorithmic due diligence. MeitY has also signalled cross-border restrictions for SDFs. Here is what the designation means and how to prepare.
Can You Train AI on Indian Customer Data? What the DPDP Act Says About AI Training Data
India's DPDP Act has no research exemption for commercial AI, no legitimate-interests basis, and no concept of anonymised-enough. If you are fine-tuning a model on customer support transcripts or building a RAG index over user records, here is what the law actually requires — and what breaks.
The DPDP Act Deadline Calendar: Every Date Between Now and 13 May 2027
The DPDP Rules 2025 set two hard dates: 13 November 2026 for the Consent Manager framework and 13 May 2027 for every core obligation. MeitY has proposed compressing that further. Here is the month-by-month readiness calendar Indian businesses should be working to — with what to finish in each quarter.