DPDP Compliance:Twelve Duties,Three Deadlines

No. Unlike the Significant Data Fiduciary category, which the Central Government notifies based on volume and sensitivity of data and other factors, the baseline Data Fiduciary duties apply regardless of headcount, revenue or user count. A ten-person startup processing the personal data of Indian users is a Data Fiduciary with the same core obligations as a bank. The Third Schedule retention rules do carry user-count thresholds, but those add a duty for large platforms rather than removing one for small ones.

No. This claim circulates widely and it is wrong. Section 33 of the Act has exactly two sub-sections: sub-section (1) lets the Board impose the penalty specified in the Schedule, and sub-section (2) lists the seven matters the Board must have regard to when fixing the amount. There is no sub-section (3) and no doubling provision. The Schedule's highest figure is 250 crore rupees, and it attaches to one duty only — the security-safeguards duty in section 8(5). Failure to report a breach sits in a separate 200 crore band, and most other contraventions fall into a 50 crore residual band.

Not as a general rule. Rule 15 permits transfer of personal data outside India, subject to any requirements the Central Government specifies by general or special order about making that data available to a foreign State or to a person or entity under its control. The one localisation duty in the Rules sits in rule 13(4) and applies only to Significant Data Fiduciaries, for classes of personal data the Central Government specifies on a committee's recommendation. Sector rules are a separate matter, and RBI's payment-data circular is stricter than DPDP.

Yes, where the processing relates to offering goods or services to Data Principals in India. Section 3 extends the Act to processing of digital personal data outside India where that processing is in connection with any activity related to offering goods or services to Data Principals within the territory of India. A US or Singapore SaaS company with Indian customers is in scope, which is why DPDP clauses are now appearing in Indian enterprise procurement paperwork aimed at foreign vendors.

Less than you fear on security, more than you expect on consent and retention. Rule 6's seven measures map closely onto an existing ISMS, so that phase is largely evidence mapping. What is genuinely new: itemised notice rather than categorised, withdrawal at parity with capture, verifiable parental consent for everyone under eighteen, the 48-hour pre-erasure warning, and rule 8(3)'s one-year minimum log retention — which runs against the delete-on-request reflex GDPR trains.

No. There is no DPDP certificate or registry for ordinary Data Fiduciaries. Notified Significant Data Fiduciaries owe an annual DPIA and an audit by an independent data auditor under section 10(2) and rule 13, and must furnish significant observations to the Board — but that is an obligation rather than a credential. For everyone else, compliance is demonstrated through artefacts: notice versions, consent and withdrawal records, log retention, a breach register against both rule 7 clocks, erasure job records, and a grievance log measured against your published period.