Question 1

When does DPDPA enforcement against Data Fiduciaries actually begin?

Accepted Answer

The Digital Personal Data Protection Act received presidential assent and was gazette-notified in August 2023, but it does not take effect all at once. The DPDP Rules, 2025 were notified in November 2025 and are being phased in three stages: the first phase, from November 2025, established and operationalised the Data Protection Board of India; the second, from November 2026, brings Consent Manager registration and related obligations into force; and the third, from May 2027, brings the core Data Fiduciary obligations into force — 26 sections of the Act and 15 of the Rules, covering notice, consent, security safeguards, and breach reporting. Until that third phase, the substantive obligations most organizations associate with the Act are not yet enforceable, though building toward them now avoids a scramble against the deadline.

Question 2

What makes an organization a Significant Data Fiduciary?

Accepted Answer

The Act allows the Central Government to designate certain Data Fiduciaries as 'Significant' based on factors such as the volume and sensitivity of personal data processed, risk to the rights of Data Principals, and potential impact on India's sovereignty and security, with the specific thresholds set out separately from the Act itself. A Significant Data Fiduciary carries additional obligations beyond the baseline: appointing a Data Protection Officer based in India, appointing an Independent Data Auditor, conducting Data Protection Impact Assessments, and undergoing regular audits. We help organizations prepare for and pass those audits and assessments; we are not ourselves an Independent Data Auditor, which is a distinct statutory role the Act reserves separately.

Question 3

Does DPDPA apply to a company that has no office in India?

Accepted Answer

Yes, in a specific circumstance. DPDPA applies to the processing of digital personal data within India, whether collected digitally or collected offline and later digitised, and it also applies extraterritorially to the processing of personal data outside India where that processing is in connection with offering goods or services to Data Principals located within India. A company with no Indian entity or office can still fall within scope purely because it serves customers or users in India; that scoping question is worth resolving early, since it determines whether the rest of the Act's obligations apply at all.

Question 4

How does DPDPA relate to GDPR and to ISO/IEC 27701?

Accepted Answer

DPDPA shares GDPR's general architecture — a lawful-basis requirement for processing, itemized notice obligations, data-principal rights, and breach notification — but it is not a copy of GDPR, and the two differ in scope, penalty structure, and specific provisions such as the legitimate-use grounds India includes outside consent. Organizations already compliant with GDPR have a head start but should not assume equivalence without a specific gap assessment. ISO/IEC 27701 is the privacy information management extension to ISO/IEC 27001, and it is the natural certification pairing for a DPDPA programme: its control structure gives an organization a certifiable, auditable framework to operate the same privacy programme a DPDPA gap assessment identifies as necessary. We advise on both ISO 27001 and ISO/IEC 27701 alongside DPDPA readiness.

Question 5

What has to happen within 72 hours of a data breach?

Accepted Answer

Under DPDPA, a Data Fiduciary must inform affected Data Principals and the Data Protection Board of India of a personal data breach without delay, and must submit a detailed report to the Board within 72 hours covering the facts of the breach, the mitigation measures taken, and the findings of any investigation into its cause. Meeting that window in practice requires a rehearsed runbook — decided-in-advance escalation paths, a pre-drafted report template, and a clear line of who has authority to notify — because 72 hours is not enough time to design a breach response process from scratch while also containing the incident. Building and testing that runbook before it is needed is a core part of this engagement.

Question 6

Is DPDPA compliance advisory the same as legal advice?

Accepted Answer

No, and this distinction matters. We provide technical and organizational advisory — data mapping, consent and notice design, security control implementation and testing, DPIAs, and breach-response engineering. Several questions that arise during a DPDPA programme are genuinely legal-interpretation questions: whether a specific processing activity qualifies under one of the Act's legitimate-use grounds instead of consent, how a contract should allocate liability between a Data Fiduciary and a Data Processor, or how the Act's provisions interact with a specific sector regulation. Those questions should go to qualified legal counsel; we build the technical programme once the legal position is settled, and we say this plainly rather than blur the line.

Question 7

What does the first engagement with Core Defences actually deliver?

Accepted Answer

A typical first engagement is a DPDPA Readiness & Gap Assessment: we map the organization's actual personal data flows, review existing notices and consent mechanisms, and evaluate current security controls against the Act's reasonable-security-safeguards obligation. The deliverable is a Records of Processing Activities (RoPA), a data flow diagram, and a prioritized gap report scoring each finding by risk and effort to close, with a remediation roadmap sequenced against the May 2027 enforcement date. That assessment becomes the basis for any follow-on implementation work, so the client always knows exactly what is unresolved and why it matters before committing to a larger programme.

DPDPA Compliance & Data Privacy

How personal data moves through a compliant organization

What does a DPDPA compliance engagement cover?

Privacy Engineering From a Security Firm — Practiced on Our Own Site

Frequently Asked Questions

Ready to secure
your future?