The Data Fiduciary playbook: what every business must do under DPDP

Most businesses we speak to ask the same question: what exactly are we supposed to do? The DPDP Act is short and written as principles. The Rules fill in some detail. Neither tells a grocery chain, a lender or a school how the duties play out in their own processes.

This playbook sets out the baseline every Data Fiduciary must meet, whatever its size or sector. The industry guides then apply it to specific businesses: the data they typically hold, where the risk sits, and a checklist with owners.

In one line: collect only what you need, tell people plainly why, get a clear yes for each purpose, honour a no or a withdrawal everywhere (including at your vendors), keep data safe, delete it when you are done, answer people’s requests, and be able to prove all of it.

First, the vocabulary

Term	Who it is	Example
Data Principal	The individual the data is about. For a child (under 18), the parent or lawful guardian acts for them.	Your customer, employee, patient or student.
Data Fiduciary	Anyone who decides why and how personal data is processed. This is you.	A bank, an online store, a hospital, a housing society.
Data Processor	Anyone who processes data on your behalf, under your instructions.	Your cloud host, CRM, payroll provider, SMS gateway, call centre.
Significant Data Fiduciary (SDF)	A Data Fiduciary the Central Government notifies because of the volume or sensitivity of the data, or the risk involved. SDFs have extra duties.	Large banks, big platforms and health networks are likely candidates.
Consent Manager	A company registered with the Data Protection Board that lets people give, manage, review and withdraw consent across many businesses from one place.	myconsentapp is a proposed Consent Manager.
Data Protection Board of India	The regulator that inquires into breaches and complaints, and imposes penalties.

You are responsible for your processors. Section 8(1) says you remain accountable for processing done on your behalf, “irrespective of any agreement to the contrary”. A vendor’s breach is your breach as far as the Board is concerned.

Does the DPDP Act apply to you?

The Act applies to digital personal data: data collected digitally, or collected on paper and later digitised (section 3(a)). It also applies outside India if you offer goods or services to people in India (section 3(b)).

It does not apply to:

• data an individual processes for personal or domestic purposes, and
• data the person themselves made public, or that someone was required by law to publish (section 3(c)).

If you run a business and keep any customer, employee or supplier-contact data in a computer, a phone, a cloud drive or a billing app, the Act applies to you. There is no general small-business exemption. Section 17(3) lets the government exempt notified classes, including startups, from some duties, but no such notification exists yet. Plan as if it applies in full.

The timeline

Date	What happens
13 November 2025	DPDP Rules 2025 notified. Rules on the Board (rules 1, 2, 17–21) take effect.
13 November 2026	Rule 4 takes effect: Consent Managers can register with the Board.
13 May 2027	Rules 3, 5–16, 22 and 23 take effect: notices, security, breach reporting, retention, children, SDF duties and rights. This is the date most businesses are working towards.

Eighteen months sounds generous until you add up the work. Inventories, vendor contracts, re-designed consent flows, staff training and integration with every system that uses personal data each take weeks. Start now.

The core duties of every Data Fiduciary

Each duty is followed by the legal source and what it means in practice.

1. Process only on a valid ground (section 4)

Every processing purpose needs either consent or one of the legitimate uses in section 7. “We have always done it” is not a ground. Anything without a ground must stop.

2. Give a proper notice (section 5, rule 3)

Before or alongside every consent request, give a notice that:

• stands on its own and does not rely on your other documents
• uses clear, plain language
• itemises the personal data and the specific purpose for each item, along with the goods, services or uses it enables
• gives a link (and any other means) to withdraw consent, exercise rights, and complain to the Board
• can be read in English or any of the 22 languages in the Eighth Schedule to the Constitution (sections 5(3) and 6(3))

For customers who consented before the Act, you must send a notice “as soon as it is reasonably practicable” (section 5(2)). You may keep processing until they withdraw.

3. Get valid consent (section 6)

Consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action. It must cover only the data necessary for the purpose. In practice:

• One toggle per purpose, off by default. No pre-ticked boxes, no bundled “I agree to everything”.
• Don’t make a service conditional on consent to something it does not need. In the Act’s telemedicine example, access to the contact list is not needed for telemedicine, so consent for it is invalid.
• Any consent term that breaches the law is invalid to that extent. Examples: waiving the right to complain to the Board, or a clause that conflicts with another law.
• Name the DPO or contact person in the consent request (section 6(3)).

4. Make withdrawal as easy as consent (section 6(4)–(6))

If consent took one tap in your app, withdrawal must take about one tap in your app. After a withdrawal, you must stop processing within a reasonable time and make your processors stop too, unless a law requires or allows you to continue. A withdrawal does not make earlier processing unlawful.

5. Be able to prove it (section 6(10))

If there is a dispute, you must prove that a notice was given and consent was obtained properly. Screenshots and a column saying consent = Y will not hold up. You need records of which notice version the person saw, what they chose, when, and through which channel. Those records must be tamper-evident.

6. Keep data accurate when it matters (section 8(3))

If data will be used to make a decision about the person, such as credit, hiring or insurance, or shared with another fiduciary, take reasonable steps to make it complete, accurate and consistent.

7. Put reasonable security safeguards in place (section 8(5), rule 6)

At a minimum:

• encryption, masking, obfuscation or tokenisation
• access control
• logging and monitoring that can detect and investigate unauthorised access
• backups for continuity
• security clauses in processor contracts
• organisational measures: policies, training, reviews

Rule 6(1)(e) requires you to keep these logs for one year unless another law requires more. A failure here carries the highest penalty in the Act: up to ₹250 crore.

8. Report personal data breaches (section 8(6), rule 7)

A “personal data breach” is wider than hacking. It covers any unauthorised processing, or accidental disclosure, loss or destruction, that affects confidentiality, integrity or availability. On becoming aware of one:

• Affected people, without delay: tell each affected person, through their account or registered contact, what happened, the likely consequences for them, what you are doing about it, what they can do to protect themselves, and a contact for questions.
• The Board, without delay: send a description of the nature, extent, timing, location and likely impact.
• The Board, within 72 hours: send a detailed report covering the facts and causes, mitigation, any findings about who caused it, remedial steps, and a report on the notices you sent to affected people.

There is no threshold. Even a small breach must be reported.

9. Erase data when the purpose is over (section 8(7)–(8), rule 8)

Erase personal data when consent is withdrawn or when it is reasonable to assume the purpose is no longer served, whichever is earlier. Make your processors erase it too, unless a law requires you to keep it. Two Rules matter here:

• Rule 8(3): keep the personal data, traffic data and processing logs for at least one year from the processing, for the purposes in the Seventh Schedule, then erase them unless another law requires longer. So “erase immediately” usually means “stop using now, and erase after the one-year minimum”.
• Third Schedule: large e-commerce platforms (2 crore+ registered users), online gaming intermediaries (50 lakh+) and social media intermediaries (2 crore+) must erase data three years after the user last engaged (or three years from the Rules’ commencement, if later). Data needed for the user to access their account, and virtual tokens stored on the platform, are excluded. They must warn the user at least 48 hours before (rule 8(2)).

10. Publish a contact and run a grievance system (sections 8(9)–(10), 13, rules 9 and 14)

On your website or app, prominently publish:

• the business contact details of your DPO, or of a person who can answer questions about processing, also included in every reply to a rights request
• how people can make rights requests
• what identifier you need from them, such as a customer ID or registered mobile number
• your grievance response period, which must not exceed 90 days (rule 14(3))

People must use your grievance process before going to the Board (section 13(3)), so a good grievance process is also your best defence.

11. Honour the rights of Data Principals (sections 11–14)

• Access: a summary of the data you hold and how you process it, plus the identities of every other fiduciary and processor you shared it with (section 11).
• Correction, completion, updating and erasure (section 12). You may refuse erasure only where you still need the data for the purpose or a law requires you to keep it.
• Grievance redressal (section 13).
• Nomination: someone who can exercise the person’s rights on death or incapacity (section 14).

12. Handle children and persons with disability carefully (section 9, rules 10–12)

• Verifiable consent of a parent is needed before processing any data of a child (under 18). You must check that the parent is an identifiable adult, using reliable identity and age details you already hold or a virtual token from an authorised entity such as DigiLocker (rule 10).
• For a person with disability who has a lawful guardian, verify that the guardian was appointed by a court, a designated authority or a local level committee (rule 11).
• Never carry out tracking, behavioural monitoring or targeted advertising directed at children (section 9(3)). Never process children’s data in a way likely to harm their well-being (section 9(2)).
• The Fourth Schedule lifts the parental-consent and tracking restrictions for some narrow cases. Examples are health services, educational institutions’ own educational and safety monitoring, crèches, school transport tracking, and confirming that a user is not a child. The exemption covers only what is necessary.

Penalty for breaching section 9: up to ₹200 crore.

Cross-border transfers (section 16, rule 15)

Transfers abroad are allowed unless the government restricts a country by notification. Rule 15 adds that the government may set requirements for making data available to foreign states. Sector rules can be stricter and still apply (section 16(2)), such as RBI’s payment-data localisation. SDFs may be told to keep specified data in India (rule 13(4)).

Legitimate uses: when you don’t need consent

Section 7 lists the uses that need no consent. These are the ones most businesses use:

Clause	Use	Typical business example	Watch out
7(a)	The person voluntarily gave data for a specified purpose and has not objected	Sending a receipt to the mobile number a shopper gave at the counter; a broker using details a renter shared to find a flat	Only for that purpose. Stop when they say they no longer want it. Rights under sections 11 and 12 still apply.
7(d)	Meeting a legal duty to disclose to the State	Tax, statutory reporting to regulators	Only what the other law requires.
7(e)	Complying with a judgment, decree or order	Court orders, attachment orders
7(f)–(h)	Medical emergency, epidemic, disaster or breakdown of public order	Hospital emergency care	Narrow. Not a general health exemption.
7(i)	Employment purposes, and protecting the employer from loss or liability	Payroll, attendance, background checks the job requires, preventing leaks of trade secrets	Not a blank cheque. Keep it to what employment actually needs.

Separately, section 17(1) disapplies most of Chapters II and III for:

• enforcing legal rights or claims
• prevention, detection, investigation or prosecution of offences
• recovering defaulted loans from financial institutions

Section 8(1) and section 8(5) still apply in these cases.

Marketing, profiling, analytics beyond what the service needs, and sharing with partners almost always need consent.

Are you a Significant Data Fiduciary?

The government will notify SDFs based on:

• the volume and sensitivity of personal data
• risk to the rights of Data Principals
• impact on sovereignty and integrity, electoral democracy, security of the State and public order (section 10(1))

No list has been published yet. If you hold data on millions of people, or health, financial or children’s data at scale, prepare as if you will be notified. SDFs must:

• appoint a Data Protection Officer based in India and responsible to the board, who is also the grievance point of contact
• appoint an independent data auditor
• carry out a Data Protection Impact Assessment (DPIA) and an audit every 12 months, and send the Board the significant observations (rule 13(1)–(2))
• run due diligence that its algorithms and technical measures do not put Data Principals’ rights at risk (rule 13(3))
• comply with any data localisation requirement notified for specified data (rule 13(4))

Penalty for breaching section 10: up to ₹150 crore.

Penalties

Breach	Maximum penalty
Failing to take reasonable security safeguards (section 8(5))	₹250 crore
Failing to notify the Board or affected people of a breach (section 8(6))	₹200 crore
Breaching the duties on children (section 9)	₹200 crore
Breaching SDF duties (section 10)	₹150 crore
Breaching any other provision	₹50 crore
A Data Principal breaching their duties (section 15), for example false complaints	₹10,000

These are maximums. The Board imposes a penalty only after an inquiry finds a significant breach and gives you a hearing (section 33(1)). When setting the amount, it considers the nature, gravity and duration of the breach, the data involved, whether the breach is repeated, any gain made or loss avoided, how quickly and effectively you mitigated, proportionality, and the likely impact of the penalty on you (section 33(2)). Good records of what you did, and when, directly reduce your exposure.

Running the programme: 30, 60 and 90 days

Days 0–30: discover

• Appoint the owner, form a working group (legal, product, engineering, operations, HR, security), and set a weekly review.
• Build the data inventory and record of processing: each system, data category, purpose, legal basis, processors, retention and location.
• List every collection point: app screens, web forms, branch or counter forms, call-centre scripts, WhatsApp, events, QR codes, partner referrals.
• List every vendor that touches personal data, and collect their contracts.
• Flag children’s data, sensitive data (financial, health, biometric, location, precise identity documents) and cross-border flows.

Days 31–60: decide and design

• Map a legal basis for each purpose. Kill purposes you cannot justify. Decide a retention period for each data category, noting where other laws set a minimum.
• Write the notice for each journey, then get it translated into the languages your customers use. All 22 must be available on request.
• Redesign consent screens and the withdrawal path in every channel.
• Draft the processor contract addendum: security, breach notice to you, erasure on instruction, retaining logs for one year, sub-processors, and audit rights.
• Design the rights and grievance workflow: intake, identity check, owners, internal deadlines, templates.
• Write the breach run-book: severity triage, decision owner, notice templates, a Board report template, and a 72-hour timeline.

Days 61–90: build, test, train

• Ship the new consent flows. Connect them to your systems so a withdrawal actually stops processing downstream.
• Run a re-notice campaign to existing customers (section 5(2)).
• Turn on logging and retention jobs. Test that an erasure request really erases data in every system and at every vendor, apart from data held under a legal lock.
• Run a breach tabletop exercise against the 72-hour clock.
• Train frontline staff: counters, call centres, sales, HR, support.
• Publish the contact details, the rights page and the grievance timelines.

Ongoing

• Review every new feature, vendor and campaign for privacy before launch.
• Review the inventory, notices and vendor contracts every quarter.
• Run a DPIA and audit every year if you are, or may become, an SDF.
• Keep evidence: consent records, withdrawal handling, rights responses, breach logs and training records.

Who owns what

Key: R = does the work, A = signs off and answers for it, C = consulted, I = kept informed.

Activity	Board / CEO	DPO or privacy owner	Legal	Product	Engineering / IT	Security	Operations / CX	HR
Data inventory	I	A	C	R	R	C	R	R
Legal basis per purpose	I	A	R	C	I	I	C	C
Notices and consent UX	I	A	C	R	R	I	C	I
Withdrawal propagation		A	I	C	R	C	C
Processor contracts		A	R	I	C	C	C
Security safeguards	I	C	I	I	R	A	I
Breach response	I	A	R	C	R	R	R	I
Rights and grievances		A	C	C	R	I	R	C
Training	I	A	C	I	I	C	R	R
Annual DPIA/audit (SDF)	A	R	C	C	C	C	C	C

The master checklist

Use this as a baseline. The industry guides add sector-specific items.

Governance

• [Leadership] Appoint an accountable DPDP owner (a DPO if you are, or may be, an SDF) with authority and budget.
• [DPO] Write a short privacy policy for staff, and a public privacy notice that matches what you actually do.
• [DPO] Set up a privacy review step for every new product, feature, vendor and marketing campaign.
• [Leadership] Report DPDP readiness to the board or partners every quarter.
• [HR] Train all staff who handle personal data, and keep attendance records.

Inventory and legal basis

• [Product] List every collection point (app, web, counter, phone, WhatsApp, paper, partners).
• [Eng] List every system, database, log, backup, spreadsheet and shared drive that holds personal data.
• [DPO] Record each purpose with its data items, legal basis (consent or a section 7 clause), retention period and processors.
• [Legal] Remove or redesign any purpose without a lawful ground.
• [DPO] Flag children’s data, data of persons with disability, sensitive data and cross-border flows.
• [Legal] Check data minimisation: delete fields you collect “in case they are useful”.

Notice and consent

• [Legal] Write an itemised notice per journey: data items, purposes, the service each enables, links to withdraw, exercise rights and complain to the Board.
• [Product] Make the notice available in English and every Eighth Schedule language on request. Translate first into the languages your customers use most.
• [Product] Use one choice per purpose, off by default, with a clear affirmative action and no bundling.
• [Product] Show the DPO or contact person in the consent request.
• [Eng] Record each consent with the exact notice version, the choices, a timestamp, the channel and the identifier, in a tamper-evident store.
• [Product] Send a notice to customers who consented before the Act (section 5(2)).
• [Ops] Capture consent given on paper or by phone in the same system, and mark how it was captured.

Withdrawal and processors

• [Product] Make withdrawal available in every channel where consent was given, with about the same effort.
• [Eng] Make sure every system checks consent before processing, and stops when it is withdrawn.
• [Eng] Notify processors of withdrawals and erasures, and record their confirmation.
• [Legal] Sign a valid contract with every processor covering security, breach notice, erasure, keeping logs for one year, sub-processors and audit rights.
• [DPO] Keep a processor register with contract dates and renewals.

Security

• [Security] Encrypt personal data at rest and in transit; mask or tokenise where possible.
• [Security] Apply least-privilege access, MFA and quarterly access reviews.
• [Eng] Log access to personal data, monitor for anomalies, and keep logs for at least one year.
• [Eng] Keep tested backups and a continuity plan.
• [Security] Run a vulnerability assessment or penetration test at least once a year.

Breach

• [Security] Write a breach run-book with severity levels, decision owners and a 72-hour timeline.
• [Legal] Prepare templates: the notice to affected people (rule 7(1) contents), the first intimation to the Board, and the 72-hour report.
• [Eng] Be able to identify affected people and their registered contacts quickly.
• [DPO] Run a tabletop exercise every year and record the lessons learned.
• [Legal] Map other reporting duties that run alongside DPDP, such as CERT-In and your sector regulator.

Retention and erasure

• [DPO] Set a retention period for each data category, and record the legal reason for any longer retention.
• [Eng] Automate erasure when the purpose ends or consent is withdrawn, after the one-year log minimum.
• [Eng] Make processors erase data too, and get confirmation.
• [Product] If you fall in the Third Schedule, send the 48-hour pre-erasure warning and erase after three years of inactivity.

Rights and grievances

• [Product] Publish how to make a request, what identifier you need, and your grievance response period (no more than 90 days).
• [Ops] Run a workflow for access, correction, completion, updating, erasure, nomination and grievances, with owners and deadlines.
• [Ops] Verify identity proportionately. Do not ask for more data than you already hold.
• [Eng] Be able to produce an access summary, including the list of fiduciaries and processors you shared data with.
• [DPO] Record every request, decision and response.

Children and guardians

• [Product] Find out whether children use your service, even if it is not meant for them.
• [Product] Add an age gate and verifiable parental consent where children are present.
• [Product] Switch off tracking, behavioural monitoring and targeted ads for children.
• [Legal] If you rely on a Fourth Schedule exemption, document which one and its limits.

Significant Data Fiduciary readiness

• [Leadership] Assess the likelihood of being notified (volume, sensitivity, risk).
• [DPO] Prepare a DPIA method, and choose an independent data auditor.
• [Eng] Review algorithms that affect people for risk to their rights.
• [Eng] Know where every dataset is stored, in case localisation is required.

Where myconsentapp comes in (and where it doesn’t)

myconsentapp is a proposed Consent Manager. It is built to handle the consent, notice, withdrawal, rights and evidence part of the Act end to end, and to record the rest.

Duty	What myconsentapp does	What you still own
Itemised notice (section 5, rule 3)	You define purposes and data items once; the platform generates versioned notices with the rights, withdrawal and Board-complaint block, and your DPO contact.	The words of each purpose and the decision to collect.
Eighth Schedule languages	Notices can be published in English and all 22 Eighth Schedule languages. Optional machine-translation drafts are flagged for human review.	Reviewing translations.
Valid consent (section 6)	A hosted consent page, an embeddable widget and SDKs (TypeScript, Python, Java, Go). Each purpose has a separate toggle, off by default.	Putting the request at the right moment in your journey.
Proof (section 6(10))	Every event is signed and hash-chained. The person gets a receipt, and anyone can check it with the public verifier. Evidence packs (PDF/JSON) are ready for the Board.	Keeping your own systems consistent with the record.
Checking before processing	A verify API answers “may I process this purpose now?”. It returns not permitted as soon as consent is withdrawn.	Calling it before you process.
Withdrawal (section 6(4)–(6))	One-tap withdrawal for the person; signed webhooks to you; acknowledgement deadlines with overdue alerts.	Actually stopping processing in your systems.
Processors (section 8(2), (7)(b))	A processor registry with contract dates and expiry flags. Processors are notified of withdrawals and erasures, and erasure is not complete until they confirm.	Signing the contracts.
Consent captured offline	Record paper, phone or counter consents in the same ledger, marked as not verified by the person.	The paper trail.
Retention and erasure (section 8(7), rule 8)	Retention periods per purpose, an automatic retention job, erase-on-withdrawal, and legal retention obligations shown in the notice.	Deleting data in your own databases.
Rights and grievances (sections 11–14, rule 14)	A rights inbox for access, correction, erasure and grievances, with SLA timers. Nomination and nominee claims.	Your answers and the underlying data.
Children and guardians (section 9, rules 10–11)	An age gate and guardian verification through DigiLocker. Purposes flagged as tracking or advertising can never be marked child-safe. Lawful-guardian links.	Deciding whether children are present.
Breach (section 8(6), rule 7)	A breach register with a 72-hour clock, Rule 7 notices to affected people, and Board report documents.	Detecting the breach and investigating it.
Audit	A verifiable audit log and analytics/MIS reports.
Data residency	Consent records are hosted in India.

What myconsentapp does not do:

• discover data across your systems
• run your security programme
• provide a website cookie-banner scanner
• run a full DPIA workflow (it provides a DPIA template)
• act as your legal counsel

Find your industry guide

The duties are the same for everyone, but the risks differ. Pick the guide closest to your business:

• Small and everyday businesses: small businesses and MSMEs, retail stores, restaurants and loyalty programmes, professional services, NGOs and non-profits
• Commerce and platforms: e-commerce and D2C, travel and hospitality, online gaming, social media and content platforms, media, adtech and marketing
• Financial services: banks, NBFCs and lenders, fintech and payments, insurance
• Health, education and children: healthcare, diagnostics and pharmacies, edtech, schools and coaching
• People and operations: employers and HR, real estate and housing societies, logistics, mobility and delivery, telecom and ISPs
• Technology vendors: SaaS, IT and BPO providers acting as processors