Data Protection Under the DPDP Act : Ten Essential Questions Every Indian Business Must Answer

Introduction

The Digital Personal Data Protection Act, 2023 (the DPDP Act) and the DPDP Rules, 2025 now govern how every business in India collects and uses personal data. The Rules were notified on 13 November 2025, and most operational duties (notice, consent, security, breach reporting) become enforceable on 13 May 2027.

That window is short, companies that treat compliance as a perfunctory (done carelessly, only as a formality) exercise risk penalties of up to ₹250 crore per breach of duty. As the maxim says, ignorantia juris non excusat (ignorance of the law is no excuse).

AgreyaLegal answers the ten questions our clients ask most often, in plain language, with the governing section of the Act or Rules for each.

1. Who is a Data Fiduciary (Data Controller)?

A Data Fiduciary is the person or organisation that decides why and how personal data is processed. The European Union’s GDPR calls this role a “Data Controller”; India’s DPDP Act calls it a “Data Fiduciary”. The two terms are broadly synonymous.

Section 2(i) of the DPDP Act defines a Data Fiduciary as any person who, alone or together with others, determines the purpose and means of processing personal data.

The word “fiduciary” is deliberate. It signals a relationship of trust, the company holds the data as a custodian for the individual (the “Data Principal”), not as an owner. Under Section 8(1), the Fiduciary stays responsible for compliance even when it hands the actual processing to someone else.

2. Who is a Data Processor?

A Data Processor is anyone who processes personal data on behalf of a Data Fiduciary (Section 2(k)). The Processor follows instructions; it does not decide the purpose. Common examples are cloud hosting providers, payroll vendors, call centres and marketing agencies.

“Processing” is defined expansively (in a wide, all-covering way) in Section 2(x). It means any wholly or partly automated operation on digital personal data, including:

• collection, recording, organisation, structuring and storage;
• adaptation, retrieval, use, alignment, combination and indexing;
• sharing, disclosure by transmission, dissemination or otherwise making data available;
• restriction, erasure or destruction.

In practice, almost anything a vendor does with a client’s personal data will count as processing.

3. What is a contract between a Data Fiduciary and a Data Processor?

It is a legally binding agreement that controls how the Processor handles personal data for the Fiduciary. It is not optional. Section 8(2) permits a Fiduciary to engage a Processor for offering goods or services to Data Principals only under a valid contract.

The contract matters because the Fiduciary cannot shift its liability. The maxim qui facit per alium facit per se (he who acts through another acts himself) captures the position: a Processor’s lapse is treated as the Fiduciary’s lapse.

A robust (strong and well-built) processing agreement should cover:

• Instructions only: the Processor acts strictly on the Fiduciary’s documented instructions.
• Security safeguards: the measures required by Section 8(5) and Rule 6, such as encryption, masking, access controls and logging.
• Breach notice: the Processor must alert the Fiduciary immediately so the Fiduciary can meet its own reporting deadlines.
• Sub-processing: whether the Processor may hire others, and on what terms (see Question 4).
• Erasure and return: deletion of data when the purpose ends or consent is withdrawn (Sections 6(6) and 8(7)).
• Audit rights and indemnity: the Fiduciary’s right to inspect, and compensation if the Processor’s default causes loss.

4. Who are Sub-Processors?

A sub-processor is a third-party vendor that a Processor engages to carry out part of the processing it does for the Data Fiduciary. For example, a payroll vendor (Processor) may store its client’s employee data on a cloud platform (sub-processor).

The DPDP Act does not mention sub-processors expressly. However, the position can be inferred (worked out by reasoning) from the scheme of the Act. Since a Processor may act only under a valid contract with the Fiduciary (Section 8(2)), and the Fiduciary remains answerable for all processing (Section 8(1)), a Processor should not sub-contract without the Fiduciary’s written authorisation.

This mirrors the maxim delegatus non potest delegare (a delegate cannot delegate further). Best practice is for the processing agreement to:

• require prior written approval for each sub-processor, or a pre-approved list;
• pass the same data protection obligations down to every sub-processor;
• keep the Processor fully liable to the Fiduciary for any sub-processor’s default.

5. What is “Data Blind” processing?

“Data blind” describes an arrangement in which a party handles or analyses personal data without being able to see or identify the individuals behind it. It is not a term defined in the DPDP Act. It is a privacy-engineering concept that the Act strongly encourages.

Common data-blind techniques include:

• Encryption: the Processor stores data it cannot read, because only the Fiduciary holds the decryption key.
• Masking and tokenisation: names, phone numbers or Aadhaar numbers are replaced with random tokens or partial values.
• Pseudonymisation: identifiers are separated from the data and kept elsewhere under strict control.
• Aggregation and anonymisation: only group-level or irreversibly de-identified figures are shared.

The legal link is direct. Rule 6 of the DPDP Rules lists encryption, obfuscation, masking and virtual tokens as reasonable security safeguards under Section 8(5). Data-blind design also supports data minimisation, because each party sees only what it strictly needs.

One caution is paramount (of the highest importance). Pseudonymised data is still personal data for anyone who can re-identify it. Only data that is truly anonymised, so that no individual is identifiable, falls outside the definition of “personal data” in Section 2(t). Data-blind measures reduce risk; they do not, by themselves, end the Fiduciary’s obligations.

6. Who can be Data Auditors and Consultants?

Data Auditors. An independent data auditor is a statutory requirement for a Significant Data Fiduciary (SDF). Section 10(2)(b) obliges every SDF to appoint an independent data auditor to evaluate its compliance with the Act. The Act does not prescribe formal qualifications. The sine qua non (essential condition) is independence: the auditor must be a third party with no conflict of interest. Suitable choices include chartered accountancy firms with IT-audit practices and specialist cyber-security audit firms.

Consultants. Consultants are not mandatory, but they are a valuable asset for any company working towards compliance. Any experienced professional or firm well-versed in the law and its technical demands can act as one. Typical consultants include law firms and privacy advocates, cyber-security firms, and management consultancies.

A good consultant performs gap analysis, drafts notices and processing agreements, designs consent workflows, trains staff and prepares breach-response plans.

7. What is a personal data breach, and what action must be taken?

Section 2(u) defines a personal data breach as any unauthorised processing, or any accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability. A ransomware attack, a lost laptop and an email sent to the wrong list can all qualify.

On discovering a breach, a Data Fiduciary should act expeditiously (quickly and efficiently):

1. Contain: isolate compromised systems, revoke exposed credentials and stop further leakage.
2. Assess: establish what data, how many people and which systems are affected, and preserve logs as evidence.
3. Notify the affected Data Principals: without delay, in plain language, explaining the nature of the breach, its likely consequences and the steps they can take (Section 8(6) read with Rule 7).
4. Notify the Data Protection Board: an initial intimation without delay, followed within 72 hours by a detailed report covering the facts, cause, mitigation measures and the persons responsible (Rule 7).
5. Remediate and record: restore clean backups, fix the root cause and document every step taken.

Timing is everything. Vigilantibus non dormientibus jura subveniunt (the law helps the vigilant, not those who sleep on their rights). Failure to notify a breach can attract a penalty of up to ₹200 crore, and failure to keep reasonable security safeguards up to ₹250 crore (Schedule to the Act).

8. Can a person refuse to share data or decline to give consent?

Yes. Under the DPDP Act, consent is voluntary, and a Data Principal may refuse it, limit it or withdraw it later. The law rests on the idea that the individual, not the company, controls their personal data.

Refusing consent. Section 6(1) requires consent to be free, specific, informed, unconditional and unambiguous. It must also be limited to the data necessary for the stated purpose. A company cannot make a service conditional on consent to collect unrelated data; any such bundled consent is invalid to that extent (Section 6(2)).

Withdrawing consent. Section 6(4) gives the right to withdraw consent at any time. Withdrawal must be as easy as giving consent. Once consent is withdrawn, the Fiduciary and its Processors must stop processing within a reasonable time, unless the law requires retention (Section 6(6)). The Data Principal may also seek erasure under Section 12.

Consequences and limits. The refusal is not cost-free. Under Section 6(5), the Data Principal bears the consequences of withdrawal; for instance, a service that genuinely needs the data may no longer be available. Withdrawal also does not make earlier lawful processing unlawful.

Further, consent is not the only lawful ground. Section 7 lists “certain legitimate uses” where data may be processed without consent, including:

• data the person voluntarily provides for a specified purpose, without objecting to its use;
• compliance with a law, a court order or judgment;
• medical emergencies, epidemics and disasters;
• specified State functions, such as subsidies and benefits;
• employment-related purposes.

The maxim volenti non fit injuria (no wrong is done to one who consents) explains why consent matters so much. Where there is no valid consent and no Section 7 ground, the processing is unlawful.

9. How should a company record privacy consent?

Recording consent means creating an immutable (unchangeable) and verifiable record each time a Data Principal gives, changes or withdraws consent. This record is the company’s best evidence, because Section 6(10) places the burden of proof on the Data Fiduciary to show that notice was given and consent was obtained.

Valid consent under Sections 5 and 6 must be preceded by a clear notice and given through a clear affirmative action. Pre-ticked boxes, silence, inactivity and “implied” consent no longer suffice.

A defensible consent record should capture:

• the identity of the Data Principal (or a secure identifier);
• the exact version of the notice shown, and the language used;
• the specific purposes and data items consented to;
• the date, time and channel of the affirmative action;
• every later change or withdrawal, with its date and time.

Companies may manage this in-house through a consent-management system, or through a Consent Manager registered with the Data Protection Board (Sections 6(7) to 6(9) and Rule 4).

10. What is a Data Protection Impact Assessment (DPIA)?

A DPIA is a structured review of how an organisation’s processing affects the rights of the people whose data it holds. Under Section 10(2)(c), read with its Explanation, it is a process that describes the rights of Data Principals and the purpose of processing, assesses and manages the risks to those rights, and covers any other matters prescribed by the Rules.

The Act makes periodic DPIAs mandatory only for Significant Data Fiduciaries. Even so, every organisation gains from conducting one. A DPIA works pre-emptively (acting in advance to prevent a problem): it exposes gaps and vulnerabilities so they can be fixed before malicious actors exploit them.

A documented DPIA also serves as evidence of due diligence. If a breach occurs, it shows the Board and stakeholders that the company took its duties seriously. When fixing a penalty, Section 33(2) directs the Board to consider factors such as the gravity of the breach and the steps the Fiduciary took to mitigate its effects. A well-kept DPIA strengthens that case.

Conclusion

The DPDP regime asks one thing of every business: treat personal data as something held in trust. With full enforcement due on 13 May 2027, the time to map data flows, rewrite contracts, fix consent journeys and rehearse breach response is now. Ubi jus ibi remedium (where there is a right, there is a remedy); Data Principals will have both, and companies must be ready.

AgreyaLegal’s data protection team advises companies on DPDP compliance, processing agreements, DPIAs and breach response, and defends them before the Data Protection Board and the courts. Contact us for a compliance review.

Disclaimer

This article is for general information only and is not legal advice. Commencement dates and penalties are stated as of October 2026; readers should verify any later amendment or notification before acting.

This note is general information and is not legal advice. The law may have changed since it was written, and how it applies depends on the facts of each case.

All posts