Konfirmity Updates

DPDP Breach Notification: The Two Clocks in Rule 7

Rule 7 gives the Board a 72-hour detailed submission, but affected individuals must be told without delay. The DPDP breach notification runbook, clock by clock.

DPDP Consent Notice Requirements: What Rule 3 Actually Demands

What rule 3 demands of a DPDP consent notice: an itemised description of data and purposes, standalone wording, and withdrawal as easy as giving consent was.

DPDP Cross Border Data Transfer: Rule 15, Rule 13(4) and What Each One Actually Restricts

Rule 15 permits DPDP cross border data transfer outside India. The only localisation duty sits in rule 13(4) and applies to Significant Data Fiduciaries.

Data Principal Rights Under DPDP: Rule 14 as a Build Specification

Rule 14 of the DPDP Rules makes Data Principal rights a product surface: published request means, an identifier scheme, nomination, and a ninety-day clock.

DPDP Data Retention and Erasure: What Rule 8 Actually Requires

DPDP data retention pulls two ways. Rule 8 forces erasure after three years of inactivity for three named classes, and a one-year floor on everybody else.

DPDP Act Penalties: The Seven Bands and What They Attach To

DPDP Act penalties run in seven bands up to 250 crore rupees, and the largest attaches to a single duty. What the Schedule says, and what it does not say.

DPDP Security Safeguards: What Rule 6 Actually Demands

Rule 6 of the DPDP Rules sets seven minimum security safeguards. What each one demands in engineering terms, what evidence proves it, and the one-year catch.

Significant Data Fiduciary Under DPDP: Section 10 and Rule 13

A Significant Data Fiduciary is one the Central Government notifies under section 10 — not a threshold you cross. What rule 13 then requires, duty by duty.

DPDP vs GDPR: How Much of Your GDPR Programme Carries Over

DPDP vs GDPR for teams that already did GDPR: what reuses cleanly, why lawful basis will not port, and the breach, retention and transfer gaps to close.

Essential Eight Application Control: Why It Stalls and How to Finish

Application control is the Essential Eight strategy most often left unfinished. What it covers, why deployments stall in audit mode, and how to reach enforcement.

The Essential Eight Assessment: How to Rate Yourself Honestly

How an Essential Eight assessment works, the evidence each strategy needs, and the four places self-assessments overstate maturity before a buyer finds out.

Essential Eight Backups: The Strategy That Decides a Ransomware Outcome

Regular backups is the only Essential Eight strategy aimed at recovery. What it requires beyond a successful job log, and why untested restores fail when it matters.