DPDP Act and CERT-In guides
Plain-language guides to India's Digital Personal Data Protection Act 2023, the DPDP Rules 2025 and the CERT-In Directions, written for the people who have to put them into practice: DPOs, CISOs, engineers and founders.
DPDP basics
DPDP Rules 2025 timeline: key dates to May 2027
The DPDP Rules 2025 were notified on 14 November 2025 with an 18-month phase-in. What applied first, what starts in November 2026 and in May 2027.
2 min readDPDP basicsDPDP Act vs GDPR: key differences for Indian companies
How India's DPDP Act differs from GDPR: scope, lawful bases, breach reporting, children, transfers, rights and penalties, and what carries over.
2 min readDPDP basicsDPDP Act penalties: what the ₹250 crore figure covers
The DPDP Act Schedule sets penalties from ₹10,000 to ₹250 crore. Which failures attract which maximum, and how the Data Protection Board decides.
2 min readDPDP basicsDPDP Act compliance checklist for Indian businesses
A 12-step DPDP Act 2023 and DPDP Rules 2025 checklist: inventory, lawful basis, notice, consent, security, breaches, erasure, rights and vendors.
4 min readGovernance
Significant Data Fiduciary obligations: DPO, DPIA, audit
Significant Data Fiduciary duties under the DPDP Act: a DPO in India, an independent auditor, annual DPIA and audit, and algorithmic due diligence.
2 min readGovernanceShadow AI and personal data: governing AI tools under DPDP
Pasting customer data into AI tools is processing under the DPDP Act. How to find shadow AI, what AI vendors need, and an AI governance checklist.
2 min readGovernanceMapping DPDP to ISO 27001 and SOC 2: collect evidence once
How DPDP and CERT-In obligations map to ISO 27001:2022, NIST CSF 2.0 and SOC 2, and how to use one control library and one set of evidence.
2 min readObligations
Data retention and erasure under the DPDP Act
When the DPDP Act requires erasure, how long data may be kept, the 48-hour notice for large platforms, logs, backups and processors.
2 min readObligationsData Principal rights under DPDP and the 90-day rule
Data Principal rights under the DPDP Act: access, correction, erasure, grievance and nomination, the 90-day response limit and a workable process.
2 min readObligationsConsent and notice under the DPDP Act: a practical guide
What valid consent and notice look like under the DPDP Act 2023: the five conditions, notice contents, languages, withdrawal and legitimate uses.
3 min readObligationsChildren's personal data under the DPDP Act
A child is anyone under 18 under the DPDP Act. Verifiable parental consent, the ban on tracking and targeted ads, exemptions and the ₹200 crore penalty.
2 min readSecurity and incidents
Log retention in India: CERT-In 180 days, DPDP one year
How long to keep logs in India: CERT-In's 180 days within India and one year under the DPDP Rules, which logs count, time sync and a checklist.
2 min readSecurity and incidentsDPDP breach notification: the Board, users and 72 hours
Every personal data breach must be reported to the Data Protection Board and each affected person. What to send, when, and how CERT-In fits in.
3 min readSecurity and incidentsCERT-In 6-hour incident reporting: a practical guide
CERT-In's April 2022 Directions: report cyber incidents within 6 hours, keep 180 days of logs in India, sync to NIC/NPL time. A step-by-step guide.
3 min read