What the DPDP Act actually requires, and what we found when we checked our own product against it first.
Section 8(6) names two separate notification audiences, not one — the Data Protection Board and affected Data Principals. And the decision that something is a reportable breach shouldn't rest on the one person with the most pressure for the answer to be no.
READ THE POST →If your privacy programme was built against GDPR first, unlearn this: Section 4 allows exactly two lawful grounds, and Section 7's list of "legitimate uses" is closed — not a general-purpose balancing test you can argue your way into.
READ THE POST →The DPDP Act doesn't give an unconditional right to deletion. Section 8(7)(a) puts a specific, lawful brake on it — and shredding an encryption key is the wrong way to resolve the collision with a statutory retention duty.
READ THE POST →An acknowledgment email is not the same as a closed request. What Sections 11–14 actually require, and why a rights request has to be tracked against every system it touches, not just the one the support team happens to look at.
READ THE POST →Privacy consultants hand out Data Protection Impact Assessments like a universal prescription. Under DPDP, that advice is sometimes just wrong — knowing whether you're a notified Significant Data Fiduciary matters more than filling in the template.
READ THE POST →The Act never says "artificial intelligence." There is one AI-adjacent obligation across the Act and its Rules, it binds Significant Data Fiduciaries only — quoted here verbatim with its digest. And the obligations that will actually reach your models are somewhere else entirely.
READ THE POST →Almost every DPDP explainer leads with "penalties of up to ₹250 crore" as if it's a flat ceiling for any violation. It isn't — it's one line in a seven-tier schedule, tied to one specific failure. The actual breakdown, with sections.
READ THE POST →Most "DPDP compliance checklists" are a lead-gen form wearing a listicle's clothes. This one names the actual section for every item — notice, consent, breach response, and data-principal rights — so you can go read the text instead of taking our word for it.
READ THE POST →"We log everything" is not the same claim as "our logs can't be quietly edited after the fact." How the hash-chained, Ed25519-signed audit trail actually works, why it's not an audit opinion, and a live verifier you can check it against yourself.
READ THE POST →"Consent Manager," "Significant Data Fiduciary," and "Data Protection Board" get used loosely in a lot of DPDP explainers. The Act defines all three precisely — what each one actually means, with the section numbers, and where Consent Tree itself stands against each.
READ THE POST →Most consent banners take one click to accept and a support ticket to undo. That's not a UX nitpick — it's a compliance gap you can point at with a section number. Where the Act draws the line, why almost everyone gets it backwards, and where we found the same gap in our own product first.
READ THE POST →