Expert articles on DPDP compliance, IP law, cyber law, and legal advisory for Indian businesses
The DPDP Rules, 2025 turn the DPDP Act into day-to-day obligations — notice format, consent withdrawal, breach reporting, children's data and more. Here is what the final Rules require and by when.
Under the DPDP Act a privacy notice is not a formality — it is what makes consent valid. Here is exactly what a DPDP-compliant notice must contain, in plain language, with a checklist.
If you use foreign cloud, analytics or SaaS tools, you are transferring personal data outside India. Here is how Section 16 of the DPDP Act treats cross-border transfers, and what you must do.
Access, correction, erasure, nomination, grievance — the DPDP Act gives people rights over their data, and your business must be ready to act on them within time. Here is a practical workflow.
The DPDP Act's penalties run up to ₹250 crore, decided by the Data Protection Board. Here is how the penalty structure works, how the Board adjudicates, and how to reduce your exposure.
The DPDP Act gives children's personal data special protection, including verifiable parental consent and a ban on tracking and targeted advertising. Here is what organisations must do.
Employee and HR data is personal data too. Here is how the DPDP Act applies to the employee lifecycle, the lawful bases you can rely on, and what employers should put in place.
When a vendor processes personal data for you, the DPDP Act requires a valid contract. Here is what a data-processing agreement should cover and how to manage processor risk.
You cannot keep personal data forever. The DPDP Act requires erasure when consent is withdrawn or the purpose is served. Here is how retention and erasure work, and how to get it right.