Blog
Expert insights, best practices, and updates on India's Digital Personal Data Protection Act
Rule 6 of the DPDP Rules 2025 makes access and modification logs a documented legal obligation for every Data Fiduciary, not an IT security best practice. Here is what that shift actually means for your compliance programme.
Most engineering teams read Rule 6 as a technical checklist and declare compliance once SSL is on and databases are encrypted. In our experience, that is precisely the gap the DPBI will probe after a breach, not whether the controls existed, but who owned them, when they were last reviewed, and whether the board was told.
India's DPDPA gives users six enforceable rights over their personal data, and they will start exercising them. Here is what compliance and CX teams must prepare for before the first request arrives.
India's DPDPA creates a new licensed intermediary. When it goes live, it changes consent architecture for every Data Fiduciary in the country. Here is what to expect and what to prepare for.
Rule 6's security safeguards obligation doesn't stop at your organisation's boundary, it flows downstream to every vendor who touches personal data on your behalf. Most processor contracts in use today don't reflect this, and the liability gap lands squarely with the Data Fiduciary.
Rule 6 of the DPDPA mandates reasonable security safeguards for every Data Fiduciary, but "reasonable" is deliberately undefined. This is the consolidated reference guide for what to implement, how to evidence it, and how to make defensible choices where the law stays silent.
Under India's DPDPA, engaging a KYC provider, cloud vendor, or email platform doesn't transfer your legal accountability, it multiplies it. Here's what Data Fiduciaries must contractually lock down before handing personal data to any processor.
A recent blog listed eight "government-registered" Consent Managers in India. Their own disclaimer reveals it means Companies Act incorporation — not DPDPA registration. Here's what the law actually requires, and why the honest answer is zero.
Finding personal data in your systems is step one. Connecting it to a specific Data Principal, under a specific consent purpose, with a traceable lineage path — that's the work that actually makes rights fulfilment, breach response, and deletion validation possible.
Compliance audits shouldn't happen once a quarter in a spreadsheet. They should run continuously, flagging issues in real time across every purpose and collection point in your system. That's what AI Insights does.
India's DPDPA treats cookies very differently from GDPR. No implied consent, no "legitimate interest" for tracking, and notices must work in Indian languages. Here's what Indian websites need to implement before the May 2027 deadline.
Most organisations have a consent banner. Almost none have a consent lifecycle. Under the DPDPA, that gap is the difference between compliance and liability.
Answers to the most common questions about consent management platforms, DPDPA 2023, and how truConsent simplifies compliance for Indian businesses.
Subscribe to our newsletter and stay updated on DPDPA compliance insights.
By subscribing, you agree to receive updates from TruConsent.Unsubscribe anytime.
Protected by reCAPTCHA