Ch IPreliminary
S.1 Short title and commencementS.2 DefinitionsS.3 Application and scopeCh IIObligations of Data Fiduciary
S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data FiduciaryCh IIIRights and duties of Data Principal
S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data PrincipalCh IVSpecial provisions
S.16 Transfer outside IndiaS.17 ExemptionsCh VData Protection Board of India
S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the ChairpersonCh VIBoard powers and procedure
S.27 Powers and functions of the BoardS.28 Procedure followed by the BoardCh VIIAppeal and dispute resolution
S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertakingCh VIIIPenalties
S.33 Penalties and the ScheduleS.34 Penalties to Consolidated FundCh IXMiscellaneous
S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other ActsDPDP Compliance Services
DPDPActIndia helps Indian organisations work out exactly what the Digital Personal Data Protection Act requires of them — then get it implemented, with the right specialist for each part of the job.
Not a one-size-fits-all consultancy. We scope the problem first, then match the right expertise — so you don't buy consulting you don't need.
DPDP commencement
How DPDPActIndia works
DPDP compliance rarely belongs to one discipline. Our job is to turn a vague obligation into a defined piece of work — and bring in the right specialist only where implementation genuinely needs one.
We identify what you're actually trying to solve, in plain terms.
We establish which DPDP obligations apply and where the gaps are.
We turn those gaps into a defined workstream, not a vague enquiry.
Where specialist delivery is needed, we identify suitable partners.
The selected specialist implements the required controls with you.
Where appropriate, the result is reviewed against the agreed requirements.
Services
Grouped by what you're trying to do — assess, implement, secure & respond, or operate. Not sure which you need? Start with the assessment and we'll route you.
“Where are our gaps and what do we actually have to do?”
“We don't know where personal data lives or where it flows.”
“We've built controls — are they actually working?”
“Could we be designated an SDF, and are we ready for it?”
“Make us DPDP compliant — manage the whole thing.”
“Our consent collection and withdrawal aren't ready.”
“Our existing notices, forms and flows need fixing.”
“How do we handle access, correction, erasure and grievances?”
“We keep personal data indefinitely and can't delete on demand.”
“Our vendors process customer and employee data — are we covered?”
“We process children's data and the rules are strict.”
“Are our technical safeguards sufficient under DPDP?”
“Could we respond to and report a breach correctly?”
“Our teams don't know their DPDP responsibilities.”
“We can't sustain privacy operations in-house.”
The specialist-partner model
A privacy lawyer, a cybersecurity engineer, a consent-platform provider and a data engineer solve different problems. We identify which one your requirement needs — rather than treating every job as the same consulting project.
Privacy law, governance, security, product, data engineering and privacy technology rarely sit in one team. We bring in the discipline the requirement actually calls for.
We scope the requirement before anyone is introduced, so the work is defined and you don't pay for tooling or consulting you don't need.
Clearly-scoped engagements, transparent structure, and your choice of whether to proceed with any partner we suggest.
Looking for a Data Protection Officer?
Appointing, outsourcing or operating a DPO and the wider privacy function is handled by our sister platform, DPOIndia. DPDPActIndia gets you compliant; DPOIndia runs the DPO role once you need one. Visit DPOIndia →
Start with the DPDP Compliance Assessment — a short diagnostic that maps your obligations, flags your gaps, and points you to the right workstream and specialist.
Consultant-led and partner-backed.