Blog
Practical writing on Digital Personal Data Protection (DPDP) Act compliance for Indian businesses.
Checklists, comparisons, and roadmaps — written for founders, COOs, and heads of compliance who need to act, not just read.
The DPDP Privacy Notice: What Rule 3 Actually Requires from Indian SMEs
Your old privacy policy probably will not pass. Rule 3 of the DPDP Rules 2025 demands an itemised, single-purpose notice with easy consent withdrawal. This is how Indian SMEs can build one.
Data Retention Under the DPDP Act: Why 'Keep Everything' Is Now a Liability for Indian SMEs
The DPDP Rules 2025 turn old data from an asset into a risk. Here is how Indian SMEs should think about retention, erasure, and the 48-hour deletion notice.
Reasonable Security Safeguards Under the DPDP Act: The Obligation Indian SMEs Keep Underestimating
Security safeguards carry the DPDP Act's steepest penalty at Rs 250 crore, yet it's the obligation most SMEs overlook. Here's what Section 8(5) and Rule 6 require, and how to prepare before 2027.
Cross-Border Data Transfer Under the DPDP Act: What Indian SMEs on Foreign SaaS Should Check Now
Most Indian SMEs move personal data abroad every day through tools like AWS, Google Workspace and HubSpot. Here is what the DPDP Act's cross-border transfer rules actually require, and the short list of things to sort before May 2027.
Data Principal Rights Under the DPDP Act: Building a Request-Handling Process Before It's Required
Access, correction, erasure, and grievance redressal: the DPDP Act gives every customer real rights over their data. A practical guide for Indian SMEs on building a process to handle these requests before the obligations take effect.
Children's Data Under the DPDP Act: The Compliance Project Indian EdTech and Gaming Startups Should Start Now
The DPDP Rules, 2025 require verifiable parental consent before you process any under-18 user's data. Here's what Section 9 and Rule 10 mean for Indian edtech, gaming and consumer apps, and what to build now.
Consent Manager or Consent Platform? What Indian SMEs Actually Need Before November 2026
"Do we have to register as a DPDP consent manager?" Almost always, no. Here is the difference between a registered Consent Manager and the consent platform your SME actually needs before the 13 November 2026 deadline.
The DPDP Compliance Clock Has Started: What India's 2026 Deadlines Mean for SMEs
India's DPDP Rules are now in force and the real deadlines land in 2026 and 2027. Here is a plain-English read on the three dates that matter and what a small business should actually do first.
The Complete DPDP Act Compliance Checklist for Indian SMEs (2026 Edition)
A 32-point, six-pillar checklist mapped to every principal obligation under the Digital Personal Data Protection Act, 2023 — what to do, in what order, with realistic timelines and budgets for a 50–500 person Indian business.
DPDP Act vs GDPR: 7 Differences That Will Trip Up Indian Startups
If you've ported a GDPR program to India, here's where the Digital Personal Data Protection Act, 2023 diverges — consent architecture, cross-border transfers, Significant Data Fiduciary thresholds, and breach notification timelines.
Common DPDP Act Mistakes Startups Make in the First 90 Days
Five recurring mistakes we've seen across SaaS, fintech, and HR tech — and the inexpensive fixes that close roughly 60% of your real regulatory exposure.
Vendor Compliance Under DPDP Act: A Practical Playbook
How to inventory your vendors, classify processor risk, and update DPAs without burning legal hours you don't have. Templates and negotiation tactics included.
HR Data Privacy Obligations Under India's DPDP Act
Employee data is in scope. Here's what HR and ops leaders need to operationalize — from offer letter to exit interview — without paralyzing the business.
DPDP Act Readiness Roadmap 2026–2027
An 18-month implementation roadmap for mid-size Indian businesses — quarter-by-quarter, with realistic budgets, headcount asks, and milestone-level deliverables.
Consent Under DPDP Act: Why 'Accept All' Banners Will Hurt You
Granular, informed, revocable. We break down what a defensible consent system looks like in 2026 — and why the cookie banner pattern from 2019 GDPR is the wrong reference.
Breach Notification: Your First 72 Hours Under DPDP Act
A practical incident response timeline mapped to Digital Personal Data Protection Act's notification obligations. Who to call, what to document, and how to avoid the mistakes that turn incidents into investigations.
Significant Data Fiduciary: Are You One Without Knowing It?
The thresholds, the obligations, and the practical signals that you're operating like an SDF — even before formal designation. Includes a self-assessment.
One Digital Personal Data Protection (DPDP) Act brief a month. No fluff.
A short, opinionated monthly note on what changed in Digital Personal Data Protection (DPDP) Act enforcement, what we're seeing across client engagements, and what to do about it.
Digital Personal Data Protection (DPDP) Act-grade handling. Unsubscribe anytime.