DPDP Roles, explained simply

India's Digital Personal Data Protection Act. Who is who.

Plain language analysis of the DPDP Act 2023 and the DPDP Rules 2025. Three running series, written so an owner can follow them and a practitioner still finds them precise. Slide each row to see more.

Loopholes in the law

The shortcuts businesses try, and whether they actually work
Plain The hex code that does not hide your customer A shopkeeper hashes customer details and deletes the original, then reuses the value for loyalty points. Here is why that does not escape the Act. 29 Jun 2026 · 5 min

Sector wise readiness

What the Act means for your line of business
Healthcare Healthcare: what applies on day one, and what does not A clinic on its first 500 patients is not Apollo Hospitals. The baseline that always applies, and the child health and erasure traps. 29 Jun 2026 · 4 min Fintech & BFSI Fintech and BFSI: triggered versus day one duties A lending app on 10,000 users is not HDFC Bank. The baseline, the SDF line, and the retention clocks you reconcile on paper. 29 Jun 2026 · 4 min EdTech EdTech: the children's data twist from day one Children's data changes the baseline itself: verifiable parental consent, and an absolute ban on behavioural targeting of minors. 29 Jun 2026 · 4 min E-commerce E-commerce: the 2 crore user line that changes everything Three triggers people blur: the Third Schedule retention regime, SDF notification, and the day one transaction log duty. 29 Jun 2026 · 5 min SaaS & Cloud SaaS and cloud: when a processor becomes a Fiduciary Process on a client's behalf and you are usually a processor. Use that data for your own purposes and the law re-classifies you. 29 Jun 2026 · 4 min HR HR and employee data: the sector everybody is in Holding employee data alone puts the full baseline on you, with no size gate. Why consent is the wrong basis for staff data. 29 Jun 2026 · 4 min AI & ML AI and ML: can you prove a basis for every record? "The training data is public, so we are fine" is the most expensive assumption in AI. Why publicly available is narrower than reachable. 29 Jun 2026 · 5 min

General awareness

The misconceptions that affect almost every organisation
Awareness Who is actually a Data Fiduciary? The Act does not ask how big your company is. It asks who decided the purpose and means of processing. Why size is the wrong question. 29 Jun 2026 · 5 min Awareness Consent is not the default: understanding Section 7 Consent is the main road. Section 7 gives a few marked exits. There is no lane marked "because it makes commercial sense." 29 Jun 2026 · 5 min

Be DPDP ready before the deadline

When you start, you will need the right documents to comply. We are preparing more than a dozen ready to use templates, including the Privacy Notice, Consent Notice, Data Retention and Erasure Policy, Security Safeguards Policy, Breach Response Procedure, Children's Data Policy, and the Data Processing Agreement.

They help you comply in hours, not weeks. With penalties up to Rs 250 crore and the main obligations expected to bind around 2027, the time to prepare is now.

Stay tuned: drop your email and we will notify you when the assessment and templates go live on the site. You can then assess your organisation and get the documents you need.