DPDP Consulting

The DPDP introduces specific rules around transferring personal data outside India. While the Act recognises that global data flows are essential for business, it places restrictions to ensure the personal data of Indian residents is not exposed to jurisdictions with weak privacy protections. Under the DPDP, cross-border transfers are permitted by default, unless the Indian government specifically restricts certain countries or territories through notification. This means organisations need to closely monitor which destinations are approved or restricted. Businesses should also ensure that contracts, security measures, and vendor agreements provide sufficient safeguards when personal data is transferred outside India. Preparing now will help avoid disruption once restrictions are finalised.

The DPDP requires organisations, known as Data Fiduciaries, to adopt appropriate safeguards to protect personal data throughout its lifecycle. Safeguards include technical measures such as encryption, secure storage and access controls, as well as organisational steps like clear policies, staff training and regular audits. The Act also expects businesses to collect only the data they need, obtain valid consent and maintain transparent practices that allow individuals to understand how their information is being used. When working with third parties or transferring data outside India, additional contractual and security safeguards must be in place.

The DPDP is often compared to the EU’s GDPR, but there are notable differences. For instance, the DPDP is shorter and simpler in structure, focusing mainly on consent, purpose limitation and accountability. Unlike the GDPR, which restricts cross-border transfers unless safeguards are in place, the DPDP allows international transfers by default unless certain countries are specifically restricted by the Indian government. The DPDP also introduces the concept of “significant data fiduciaries,” where larger or higher-risk organisations have additional obligations. While the GDPR includes many individual rights (like portability and objection), the DPDP limits these to a narrower set, such as access, correction and erasure.

One of the DPDP’s unique aspects is its emphasis on simplicity and accessibility. For example, organisations must make consent notices available in multiple Indian languages to ensure individuals understand how their data is being used. The Act also creates the Data Protection Board of India, a new body responsible for the enforcement and adjudication of disputes, which is different from the independent data protection authorities seen in Europe. Another factor at play is the government’s power to exempt specific organisations, sectors or even categories of processing from parts of the law, which makes compliance planning more dynamic. These features mean businesses need to pay attention not just to the text of the law, but also to evolving rules and government notifications.