FAQ: Data Protection India

The DPDP Act allows the Data Protection Board of India to impose financial penalties of up to 250 crore rupees for a single instance of non-compliance, with the exact amount scaled to the nature, severity, and duration of the breach - failure to implement reasonable security safeguards and failure to notify a breach carry among the highest penalty ceilings under the Act.  Read full answer →

Yes — the Digital Personal Data Protection (DPDP) Act applies to any processing of personal data of individuals located in India, including by entities outside India, if that processing is connected with offering goods or services to those individuals — physical presence in India isn't a prerequisite for the law to apply.  Read full answer →

Valid consent under the DPDP Act must be free, specific, informed, unconditional, and unambiguous, given through a clear affirmative action, and accompanied by an itemized notice describing exactly what personal data is collected and for what purpose - pre-checked boxes, bundled consent for unrelated purposes, and vague blanket permissions do not meet this standard.  Read full answer →

Yes, in general the DPDP Act does not impose a blanket data localization requirement or a whitelist of approved countries for cross-border transfer, unlike some other jurisdictions, but the central government retains power to restrict transfers to specific countries by notification, so transfers should be checked against the current restricted list before assuming they are unconstrained.  Read full answer →

The DPDP Act requires a Data Fiduciary to notify the Data Protection Board of India and affected data principals of a personal data breach without delay — the rules specify a defined reporting window measured in hours from becoming aware of the breach, making an internal incident-response plan a practical necessity, not just good practice.  Read full answer →