Question 1

Can a company share or sell my data to others?

Accepted Answer

Only if you have consented to that purpose in the notice, or if a legitimate use applies. A Data Fiduciary can use your data only for the purpose stated in the notice. Sharing or selling it for unrelated purposes, such as marketing, needs fresh consent, and you can withdraw consent at any time. Sharing with a Data Processor that works for the company is allowed under a contract, and the company stays accountable.

Question 2

Can I get compensation under the DPDP Act?

Accepted Answer

The DPDP Act does not give Data Principals a right to compensation. Penalties imposed by the Data Protection Board go to the Consolidated Fund of India, not to the affected person. Your remedies are to complain to the organisation and the Board, and you may still have other legal remedies (such as consumer or civil claims) under other laws.

Question 3

Can personal data be transferred outside India?

Accepted Answer

Yes. The DPDP Act allows cross-border transfers of personal data except to countries the Central Government restricts by notification (Section 16). There is no general data localisation requirement, but the Rules allow the government to specify conditions for certain data of Significant Data Fiduciaries, and sector laws (for example RBI rules for payment data) may impose stricter localisation.

Question 4

Do companies always need my consent to use my data?

Accepted Answer

Not always. Consent is the main ground, but Section 7 allows 'legitimate uses' without consent, for example: when you voluntarily give data for a stated purpose and do not object, for government benefits and services, to comply with a law or court order, for medical emergencies, during disasters, and for employment purposes. Outside those cases, the organisation must get your consent.

Question 5

Does every company need a Data Protection Officer?

Accepted Answer

No. Under the DPDP Act only Significant Data Fiduciaries must appoint a Data Protection Officer. Other organisations do not have to appoint a DPO, but they must publish the business contact information of a person who can answer Data Principals' questions about their personal data, and they must set up a grievance redressal system.

Question 6

Does the DPDP Act apply to CCTV footage?

Accepted Answer

Yes, if the CCTV footage identifies individuals and is stored or processed digitally, it is personal data. The organisation operating the cameras (a shop, office, housing society or school) should display a notice that CCTV is in use and why, keep footage secure and delete it when the purpose is served. Use by an individual purely for personal or domestic purposes (for example a home doorbell camera) is outside the Act.

Question 7

Does the DPDP Act apply to employee data?

Accepted Answer

Yes. Employers are Data Fiduciaries for employee data. Section 7(i) allows processing without consent for employment purposes and to safeguard the employer from loss or liability (for example preventing corporate espionage or maintaining confidentiality). For anything beyond that, such as marketing or sharing data with outsiders, the employer needs consent. Security safeguards and breach reporting apply as usual.

Question 8

Does the DPDP Act apply to foreign companies?

Accepted Answer

Yes. The Act applies to processing outside India if it is connected with offering goods or services to people located in India. A foreign website or app that targets Indian users must follow the Act. Separately, an Indian outsourcing firm that processes the data of people outside India under a contract with a foreign company is exempt from most provisions (the outsourcing exemption).

Question 9

Does the DPDP Act apply to individuals like me?

Accepted Answer

As an individual you are a Data Principal, so the Act mainly gives you rights: to know what data is held about you, correct or erase it, complain, and nominate someone to exercise your rights if you cannot. You also have a few duties, such as not filing false complaints or impersonating someone else.The Act does not apply to you when you handle personal data purely for personal or domestic purposes, for example keeping your family's phone contacts.

Question 10

Does the DPDP Act apply to my small business?

Accepted Answer

Yes, in most cases. If your business collects customer or employee personal data in digital form, you are a Data Fiduciary and the Act applies, even if you are small. You need to give a clear notice, get consent (or rely on a legitimate use), keep the data secure, delete it when no longer needed and respond to people's requests.The government can exempt certain classes of Data Fiduciaries, including startups, from some provisions (Section 17(3)), but there is no automatic exemption based on size alone.

Question 11

Does the DPDP Act cover sensitive personal data?

Accepted Answer

The DPDP Act does not create a separate category called 'sensitive personal data' (as the older IT Rules did). All personal data is protected, and the same core obligations apply. However, the Central Government can notify Data Fiduciaries as Significant Data Fiduciaries partly based on the sensitivity of the data they handle, which brings extra duties.

Question 12

Does the DPDP Act give me the right to be forgotten?

Accepted Answer

Yes, in substance. Section 12 gives you the right to erasure: you can ask a Data Fiduciary to erase your personal data, and it must do so unless the data is needed for the purpose you consented to or retention is required by law. Withdrawing consent also obliges the organisation to stop processing and erase your data (unless the law requires it to keep it).

Question 13

How can I complain if a company misuses my data?

Accepted Answer

First, raise your complaint with the company's grievance officer or contact point (the company must publish this and respond within the time set by the Rules, which is a maximum of 90 days).If you are not satisfied or get no response, complain to the Data Protection Board of India, which works as a digital office.Orders of the Board can be appealed to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).Avoid false or frivolous complaints: they can attract a penalty of up to Rs 10,000.

Question 14

How do I comply with the DPDP Act? (first steps for a business)

Accepted Answer

Map your data: what personal data you collect, why, where it is stored and who gets it.Update notices and consent: clear, simple notice and a consent request in English or an Eighth Schedule language, with an easy way to withdraw.Secure the data: encryption, access control, logging, backups, vendor contracts with processors.Prepare for breaches: an incident plan to inform the Board and affected people and report within 72 hours.Set up rights handling: a grievance contact and process to answer access, correction and erasure requests.Delete data that is no longer needed, and get verifiable parental consent for children's data.Check whether you may be notified as a Significant Data Fiduciary.The main obligations apply from 13 May 2027.

Question 15

How is a Significant Data Fiduciary decided?

Accepted Answer

The Central Government notifies an SDF under Section 10, based on: the volume and sensitivity of personal data processed; risk to the rights of Data Principals; potential impact on the sovereignty and integrity of India; risk to electoral democracy; security of the State; and public order. An organisation does not become an SDF on its own: it happens only through notification.

Question 16

How long can a company keep my personal data?

Accepted Answer

Only as long as it is needed for the purpose you gave it for, or as long as the law requires. Once you withdraw consent or the purpose is served, the Data Fiduciary must erase the data and ask its Data Processors to do the same. The Rules also require retaining certain logs and records (for example for security and legal purposes) for at least one year, and large e-commerce, gaming and social media platforms have specific retention and erasure timelines.

Question 17

Is the DPDP Act applicable to non-digital or paper records?

Accepted Answer

The DPDP Act applies to digital personal data and to personal data that was collected on paper and later digitised. Paper records that are never digitised are not covered by this Act, although other laws or contracts may still protect them.

Question 18

Is the DPDP Act in force now?

Accepted Answer

The Act has been passed and the DPDP Rules, 2025 were notified in November 2025. The law is being switched on in phases:Immediately (November 2025): provisions on the Data Protection Board of India and definitions.13 November 2026: Consent Manager provisions (Rule 4).13 May 2027: the main obligations on organisations, such as notice, consent, security safeguards, breach reporting and data principal rights.Organisations should use the time before May 2027 to prepare.

Question 19

Is there a different rule for children's data?

Accepted Answer

Yes. A child is anyone under 18. Before processing a child's personal data, a Data Fiduciary must get verifiable consent of the parent or lawful guardian. It must not undertake tracking, behavioural monitoring or targeted advertising directed at children, nor processing likely to cause detrimental effect on their well-being. The Rules exempt certain classes (for example healthcare and educational institutions) for specified purposes. Breaching these duties can lead to a penalty up to Rs 200 crore.

Question 20

What are my rights under the DPDP Act?

Accepted Answer

As a Data Principal you have the right to:Access information about your personal data being processed (Section 11).Correct, complete, update and erase your personal data (Section 12).Grievance redressal: to have your complaint answered by the organisation (Section 13).Nominate another person to exercise your rights in case of your death or incapacity (Section 14).Withdraw consent at any time.You also have duties (Section 15), such as not filing false or frivolous complaints.

Question 21

What are the duties of a Data Principal?

Accepted Answer

Section 15 gives Data Principals a few duties: comply with all applicable laws; not impersonate another person when giving data; not suppress material information when providing data for official identity documents; not file false or frivolous complaints; and give only verifiably authentic information when exercising the right to correction or erasure. Breach can attract a penalty of up to Rs 10,000.

Question 22

What are the exemptions under the DPDP Act?

Accepted Answer

Section 17 exempts some situations from parts of the Act, for example: processing for enforcing legal rights or claims, by courts and regulators, for prevention and investigation of offences, processing in India of data of people outside India under a contract with a foreign person (the outsourcing exemption), mergers and demergers, recovery of loans by financial institutions, research, archiving or statistical purposes (with safeguards), and certain classes of Data Fiduciaries such as startups. The Central Government may also exempt State instrumentalities for security, sovereignty and public order.

Question 23

What are the extra obligations of a Significant Data Fiduciary?

Accepted Answer

Appoint a Data Protection Officer based in India, responsible to the Board of Directors.Appoint an independent data auditor to evaluate compliance.Carry out a periodic Data Protection Impact Assessment (DPIA) and data audit (at least once every 12 months under the Rules).Follow any additional measures the Rules specify, including due diligence on algorithmic software used to process personal data.Breach of these obligations can attract a penalty of up to Rs 150 crore.

Question 24

What are the key features of the DPDP Act?

Accepted Answer

Applies to digital personal data, including processing outside India for services to people in India.Consent-based processing with clear notice, plus a list of legitimate uses.Rights of access, correction, erasure, grievance redressal and nomination.Special protection for children (under 18).Extra duties for Significant Data Fiduciaries.Breach notification to the Board and affected people.Data Protection Board of India to enforce, with penalties up to Rs 250 crore.

DPDP Rules 2025 & Act Knowledge Base

Comprehensive Compliance Guides

Popular Q&A Topics