Compliance

DPDP Act vs GDPR: Key Differences Indian Businesses Must Know

Feb 28 2026

Introduction If your organisation already complies with the EU General Data Protection Regulation (GDPR), you might assume that India’s Digital Personal Data Protection Act, 2023 (DPDP Act) requires only minor adjustments. That assumption is risky. While DPDP draws philosophical inspiration from GDPR — focusing on individual rights, consent standards, and accountability — it differs in […]

What Is a Significant Data Fiduciary? How to Know If You Are One — and What to Do About It

Feb 28 2026

Introduction Most organisations reading about the DPDP Act focus on the baseline obligations — privacy notices, consent, data deletion, breach reporting. These apply to every Data Fiduciary. But for a specific subset of organisations, the DPDP Act has a second tier of obligations that goes considerably further. This tier applies to Significant Data Fiduciaries (SDFs) […]

DPDP Compliance Deadline: What You Need to Do Before May 13, 2027

Feb 28 2026

Introduction May 13, 2027 is the full compliance deadline under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, 2025. From that date onward, every organisation in India that processes digital personal data must be fully compliant. There is no grace period. The penalty framework — including fines of up to […]

What Is the DPDP Act? A Plain-English Guide for Business Leaders

Feb 26 2026

Introduction If you run a business in India and collect even a single piece of personal information — a customer’s name, a visitor’s phone number, an employee’s attendance log, or a face photo at reception — you are subject to India’s most significant data privacy law to date. The Digital Personal Data Protection Act, 2023 […]

Data Fiduciary vs Data Processor: What Is Your Role Under the DPDP Act?

Feb 26 2026

Introduction Under the Digital Personal Data Protection Act, 2023 (DPDP Act), one question determines the scale of your compliance obligations: Are you a Data Fiduciary, a Data Processor, or both? Many organisations answer this confidently — and incorrectly. A company using a third-party visitor management system may assume it is “just a user.” A SaaS […]

DPDP Rules 2025 vs DPDP Act 2023: What Changed — and What It Means for Your Business

Feb 25 2026

Introduction When the Digital Personal Data Protection Act, 2023 was enacted, it established India’s modern privacy framework in principle. But it was never designed to operate alone. The Act sets out rights, obligations, penalties, and regulatory authority. The Digital Personal Data Protection Rules, 2025 provide the operational detail — the technical standards, timelines, procedural requirements, […]