DPDP questions answered

Direct answers to 32 common questions about India's DPDP Act 2023 and the DPDP Rules 2025, from whether the Act applies to you through consent, rights, breach reporting and retention. Each page answers one question, states where the answer comes from in the Act or the Rules, and names the mistake that most often follows.

Does it apply to me

• Does DPDP apply to my small business?
• Does DPDP apply if we only have employee data?
• Does DPDP apply to B2B companies?
• Does DPDP apply to freelancers and sole proprietors?
• Are NGOs and charities exempt from DPDP?
• Does DPDP apply to companies outside India?

What counts as personal data

• Is an email address personal data under DPDP?
• Is Aadhaar personal data under DPDP?
• Is a phone number personal data?
• Is CCTV footage personal data?
• Is anonymised data covered by DPDP?

Consent and lawful basis

• Does DPDP require consent for everything?
• What is legitimate use under Section 7?
• Can I use pre ticked consent boxes?
• Do I need consent for employee data?
• Can I send marketing emails under DPDP?
• Does CCTV need consent under DPDP?
• Can I buy a marketing list?
• Do I need parental consent for users under 18?

Rights and duties

• What rights do people have under DPDP?
• What is the right to nomination under DPDP?
• How long do I have to answer a grievance?
• Do I need to appoint a Data Protection Officer?
• What is a Significant Data Fiduciary?
• Am I a Data Fiduciary or a Data Processor?

Breach and enforcement

• Do I have to report every data breach?
• Is a system outage a personal data breach?
• What are the penalties under DPDP?
• When does DPDP come into force?
• Is a privacy policy enough for DPDP compliance?

Retention and transfers

• How long can I keep personal data?
• Can I store personal data outside India?

Want this applied to your own organisation rather than in the abstract? The readiness assessment works through your actual answers.