DPDPA 2023 FAQs - Frequently Asked Questions on India's Data Protection Law

115+ questions drawn from real webinar Q&A sessions - organised by audience and thematic sub-sections covering scope, consent, cross-border transfer, children's data, rights, retention, enforcement, and more.

30 min read

Scope and Applicability

Privacy Notice

Employee and HR Data

Vendor and B2B Data

Cross-Border Data Transfer

Data Retention and Deletion

Significant Data Fiduciary and DPO

Breach, Penalties, and Enforcement

On This Page

Explore More

About DPDPA

Overview of the Act

Learn more

Rights

Data Principal rights

Learn more

Glossary

Key terms

Learn more

Contact

Reach out to us

Learn more

Disclaimer: The information on this page is for educational purposes only and does not constitute legal advice or solicitation.

DPDPA 2023 FAQs - Frequently Asked Questions on India's Data Protection Law

Scope and Applicability

What qualifies as 'personal data' under the DPDPA? Does it include phone numbers, PAN, Aadhaar, email IDs, and IP addresses?

Is data of a company (AoA, balance sheets, GSTIN) covered, or only data of identifiable individuals?

Does the DPDPA apply to data collected in physical form (visiting cards, paper forms) that is later digitised?

Is the Act applicable to MSMEs, startups, and small businesses? Are there exemptions based on size?

Does the DPDPA apply to B2B entities, manufacturing companies, and professional firms (CA, CS, law firms)?

Are educational institutions, hospitals, and government bodies covered under the Act?

Does the Act have retrospective effect for data already collected before it comes into force?

Privacy Notice

What is a Privacy Notice under the DPDP Rules 2025 and how is it different from a Privacy Policy?

Must the Privacy Notice be independent of Terms of Service, or can they be combined?

Does the Privacy Notice need to be granular - tying each data point to its specific purpose - or can purposes be listed broadly?

Can the Privacy Notice be in English only, or must it be in Hindi or regional languages?

Who should sign or authenticate the Privacy Notice?

Is a Privacy Notice required for employee data, or does the employment exemption eliminate this need?

Consent Framework

Is consent required from existing employees, or does 'purposes of employment' under Section 7(i) suffice?

Do we need to re-obtain consent from existing customers and vendors after the Rules come into effect?

Is a checkbox-based 'clickwrap' consent legally valid under the DPDPA? What constitutes valid consent?

If personal data is not collected directly from the Data Principal but from a third party (distributor, job portal), who must obtain consent?

Can a broad, blanket consent covering multiple purposes be obtained from employees?

When sharing employee data with insurers (group health), banks (salary accounts), or EPF, is separate consent required?

How does consent withdrawal work? Must the Data Fiduciary provide proof of data deletion upon withdrawal?

Consent Managers

What is a Consent Manager, and how does it differ from a Data Protection Officer (DPO)?

Is it mandatory to use a registered Consent Manager, or can a Data Fiduciary build its own consent management system?

Can a Data Fiduciary itself act as or appoint its own Consent Manager?

Does a Consent Manager act on behalf of the Data Fiduciary or the Data Principal?

What is the commercial model - who pays for the Consent Manager?

How does the Consent Manager workflow integrate with existing IT systems of a Data Fiduciary?

Employee and HR Data

Is employer-employee data processing exempt from consent under the DPDPA? What does 'purposes of employment' cover?

Does the employment exemption cover sharing employee data with parent companies abroad, auditors, and statutory bodies?

How long can a company retain data of former employees after they leave the organisation?

Does employee data on Microsoft Teams, internal apps, or HRMS platforms require separate consent?

How should companies handle recruitment data - resumes from job portals, background verification, rejected candidates?

Is data of contractual employees and gig workers covered, and who bears responsibility - the company or the contractor?

Does the Act require companies to take fresh consent from all existing employees?

Vendor and B2B Data

Is personal data of vendor contact persons (name, PAN, bank details) collected during ordinary business transactions covered under the DPDPA?

When vendors voluntarily provide bank account and PAN details, does that constitute implied consent?

With thousands of vendors on-boarded, do we need to obtain individual consent from each vendor contact person?

Does sharing vendor or supplier data with a parent company abroad require consent or a cross-border transfer assessment?

How should companies handle data of sole proprietors - is it personal data or business data?

Cross-Border Data Transfer

Can personal data be stored and transferred outside India under the DPDPA? What are the conditions?

Is there a list of restricted or blacklisted countries to which data cannot be transferred?

What about personal data of employees already stored on servers or cloud platforms outside India - does it need to be brought back?

For MNC subsidiaries, if employee data is automatically synced to a global ERP system abroad, does that require separate consent?

How do the DPDPA cross-border rules interact with sector-specific data localisation requirements (e.g., RBI)?

If an organisation is already GDPR-compliant, what additional steps are needed for DPDPA compliance?

Data Retention and Deletion

What are the data retention periods under the DPDP Rules 2025 - is it one year or three years?

What is the rationale for different retention periods (general vs. 3 years for certain classes)?

If a Data Principal requests erasure before the mandatory retention period expires, must the data still be deleted?

How does the DPDPA retention period interact with longer retention requirements under other laws (Income Tax, Companies Act)?

Does 'retention' refer only to active data, or does it include log files, backups, and archived data?

After the purpose is fulfilled and the retention period expires, must the Data Fiduciary actively inform the Data Principal of deletion?

Significant Data Fiduciary and DPO

What are the criteria for being designated as a Significant Data Fiduciary? Is there a user-count threshold?

Is a DPO required only for SDFs, or should all Data Fiduciaries appoint one?

Can the DPO also serve as the Grievance Redressal Officer, CISO, or Chief Compliance Officer?

Must the DPO be an internal employee, or can an external consultant or shared DPO serve multiple companies?

What audit obligations apply to SDFs - internal audit, external audit, or both?

Can a Significant Data Fiduciary also act as a Consent Manager?

Breach, Penalties, and Enforcement

What constitutes a 'personal data breach' under the DPDPA? Does processing beyond the stated purpose qualify as 'unauthorised processing'?

What are the breach notification obligations and timelines under the DPDP Rules 2025?

If an organisation has taken all reasonable security safeguards but a breach still occurs, is it still liable for penalties?

What is the penalty range, and is there a minimum penalty? Is the penalty proportional to the breach?

Who imposes penalties - the Data Protection Board? Can it take suo motu cognizance?

Can decisions of the Data Protection Board be appealed? What is TDSAT, and what is the appeal hierarchy?

Can only a Data Principal file a complaint, or can third parties (NGOs, whistle-blowers) also approach the Board?

Explore More

About DPDPA

Rights

Glossary

Contact