If your organisation collects names, phone numbers or email addresses from donors, volunteers, beneficiaries or staff, the Digital Personal Data Protection Act, 2023 applies to you, along with the DPDP Rules, 2025.
The rules are being rolled out in phases, and many organisations are still unsure what they need to do and by when.
We’ve put together a set of FAQs in the PATTIC library to help. It covers 12 areas:
- Basics and definitions (who counts as a Data Fiduciary, a Data Principal and a Data Processor)
- Consent and notice requirements
- Rights of Data Principals
- Penalties and enforcement
- Significant Data Fiduciaries
- Children’s data
- Data breaches and security
- Cross-border data transfer
- Data retention and erasure
- The Data Protection Board of India
- Exemptions
- Practical scenarios
A few of the questions it covers:
- Does a pre-ticked checkbox count as valid consent?
- Is the 1-year data retention period mandatory for every organisation?
- If a vendor collects data on your behalf, who is responsible for getting consent?
- Does the law apply to the personal data of your own employees?
Have a question about how the DPDP Act applies to your organisation? Reply below and let’s discuss.