Module 6 of 6 — DPDP Act 2023 Compliance

Significant Data Fiduciaries and Practical Compliance

Reading module · approx 14 min

Compliance with the DPDP Act is not a single event. It is an ongoing programme of data governance, consent management, breach response preparedness, and Data Principal rights management. This module covers what practical compliance looks like and what the Act's highest-obligation tier — Significant Data Fiduciaries — requires.

Significant Data Fiduciaries

The government may designate any Data Fiduciary as a Significant Data Fiduciary (SDF) based on: the volume and sensitivity of personal data processed; the risk to rights of Data Principals; potential impact on sovereignty and integrity of India; the risk to electoral democracy; national security; and public order. The designation is by notification and may impose conditions specific to the designated entity.

Significant Data Fiduciaries face additional obligations beyond those applicable to all Data Fiduciaries:

Appointment of a Data Protection Officer (DPO) who is based in India and reports to the Board of Directors
Appointment of an independent Data Auditor to conduct periodic DPDP compliance audits
Conduct of periodic Data Protection Impact Assessments (DPIAs) and algorithmic impact assessments
Additional obligations as may be prescribed by the DPDP Rules specific to their designation

Building a DPDP compliance programme

A practical DPDP compliance programme for a typical Indian business should include the following elements:

Data mapping

Identify and document all personal data collected, the purposes for which it is collected, the legal basis (consent or legitimate use), where it is stored, who has access, and whether it is shared with processors or third parties. This is the foundation of all other compliance work.

Consent infrastructure

Implement consent notices that meet the Act's requirements for specificity and accessibility. Build mechanisms for recording consent, tracking withdrawal, and linking consent records to processing activities. Ensure the withdrawal mechanism is as easy to use as the consent mechanism.

Data Principal rights fulfilment

Establish workflows for responding to Data Principal requests for information, correction, erasure, and grievance resolution. The DPDP Rules will specify timelines for response; typical data protection laws require response within 30 days.

Breach response plan

Establish a breach identification and response protocol that enables the organisation to detect a breach, assess its scope and likely harm, notify the Board within the prescribed timeline, and implement remediation. Run tabletop exercises periodically.

DPDP vs GDPR The DPDP Act is narrower than GDPR in several respects: it has fewer legal bases (no legitimate interests balancing), no right to data portability, no requirement for a privacy by design obligation, and no mandatory DPO for non-Significant Data Fiduciaries. However, its penalty exposure is comparable and in some ranges higher. Organisations that are already GDPR compliant will find DPDP compliance achievable, but the two frameworks are not identical and cannot be assumed to be equivalent.

Vendor and processor management

Ensure that Data Processing Agreements are in place with all processors, that processors are reviewed for security practices, and that contracts require processors to assist in breach notification and Data Principal rights fulfilment.