Lesson 1
The two lawful grounds for processing
Chapter II of the Act is titled Obligations of Data Fiduciary, and it opens with Section 4, the gate that every processing activity has to pass through. A Data Fiduciary, meaning the person who alone or together with others decides the purpose and means of processing, may process personal data only for a lawful purpose, and only on one of two grounds: the consent of the Data Principal, or one of the certain legitimate uses listed in Section 7.
The Act defines a lawful purpose by exclusion. It is any purpose that is not expressly forbidden by law. There is no positive list of approved purposes and no advance approval from the Board or the government. Passing the purpose test is not enough on its own, however. A purpose that no law forbids still needs one of the two grounds behind it before the data can be processed.
There is no third route. The Act does not contain a general legitimate interest ground that a Data Fiduciary can invoke because the processing feels reasonable or commercially sensible. If a processing activity rests neither on consent nor on a specific clause of Section 7, it has no lawful basis under the Act, whatever its purpose.
Section 7 lists nine legitimate uses for which consent is not needed: data the Data Principal voluntarily provided for a specific purpose and has not objected to; State subsidies, benefits, services, certificates, licences or permits; performance of a State function under law, or in the interest of the sovereignty, integrity or security of India; compliance with a legal obligation to disclose information; compliance with a judgment, decree or order of a court; responding to a medical emergency; providing medical treatment during an epidemic or other threat to public health; ensuring safety during a disaster or a breakdown of public order; and processing for employment purposes or to protect the employer from loss or liability.
Each legitimate use is narrow and purpose-bound. It justifies processing only to the extent that the particular use requires, not a general licence to skip consent. For voluntarily provided data, processing must stop once the Data Principal indicates she no longer consents to that use. For employment, processing should stay scoped to the employment relationship or the specific loss or liability it protects against, rather than general employee monitoring. Employee data is still personal data, and every other obligation, including security, accuracy and breach notification, continues to apply.
No item in the Schedule to Section 33 names Section 4 or Section 7 directly. Processing without a lawful ground is caught by the residual item for breach of any other provision, which carries a monetary penalty of up to ₹50 crore. Both sections are not yet in force: they commence on 13 May 2027, eighteen months after the DPDP Rules, 2025 were published, together with nearly all of Chapter II.
- Personal data may be processed only for a lawful purpose, meaning one not expressly forbidden by law.
- The only two grounds are the Data Principal's consent and a legitimate use listed in Section 7.
- Section 7 is a complete list of nine uses; there is no general legitimate interest ground.
- Each legitimate use is narrow and covers only the processing that particular use requires.
- Sections 4 and 7 commence on 13 May 2027.
Lesson 2
The notice that comes before consent
Where a Data Fiduciary relies on consent, Section 5 requires it to give the Data Principal a notice before, or together with, the request for consent. The notice is tied to consent: it is the information a person needs in order to give consent that is genuinely informed, and it cannot be supplied as an afterthought once processing has already begun.
The notice must tell the Data Principal what personal data will be processed and the purpose for which it will be processed. It must also explain how she can withdraw her consent, how she can exercise her rights under the Act, and how she can make a complaint to the Data Protection Board of India. In practice this means an itemised description of the data and a specific purpose, not a broad statement that data may be used for business purposes.
The Data Principal must be given the option to read the notice in English or in any language listed in the Eighth Schedule to the Constitution. A notice that is available only in one language, with no option of the others, does not meet this standard.
Section 5 also deals with consent that was collected before the Act commenced. For those Data Principals, the Data Fiduciary must send an equivalent notice as soon as reasonably practicable, covering the personal data processed and the purpose, along with the same withdrawal, rights and complaint information. It may continue processing on that earlier consent until the Data Principal withdraws it. The Data Fiduciary should not wait for some trigger event before sending this notice.
Rule 3 of the DPDP Rules, 2025 adds detail once it takes effect. The notice must stand on its own, independently of any other information the Data Fiduciary provides, and it must give the actual communication link, not merely a description, for the website or app where the Data Principal can withdraw consent, exercise her rights, or complain to the Board. A privacy policy therefore does not replace the Section 5 notice.
No Schedule item names Section 5 by number, so a missing or defective notice falls under the residual item, with a penalty of up to ₹50 crore. Section 5 is not yet in force; it commences on 13 May 2027.
- The notice must be given before, or together with, the request for consent.
- It must cover the personal data and purpose, how to withdraw consent, how to exercise rights, and how to complain to the Board.
- The Data Principal must be able to read it in English or any Eighth Schedule language.
- Consent held from before commencement needs an equivalent notice as soon as reasonably practicable.
- Rule 3 requires a standalone notice with the actual links for withdrawal, rights and complaints.
Lesson 3
Valid consent, withdrawal and Consent Managers
Section 6 sets the standard for consent. It must be free, specific, informed, unconditional and unambiguous, and it must be given through a clear affirmative action. Consent cannot be inferred from silence, from inactivity or from a pre-ticked box. It must also be limited to the personal data that is actually necessary for the specified purpose, so a request cannot sweep in data the stated purpose does not need.
Each element has a practical meaning. Free means no coercion or undue influence built into the request. Specific means tied to the purpose actually stated. Informed means the Data Principal understands, in clear and plain language, what will be processed and why. Unconditional means consent to one purpose is not bundled with another. Unambiguous means a deliberate signal, and the affirmative action is the active opt-in step that carries it.
Any part of a consent that would infringe the Act, the Rules or any other law is invalid to that extent. A Data Principal cannot validly consent away a statutory right, such as her right to complain to the Board. Every consent request must be in clear and plain language, offered in English or an Eighth Schedule language, and must give the contact details of a Data Protection Officer where one applies, or of another person authorised to respond.
Consent can be withdrawn at any time, and withdrawing must be at least as easy as giving consent was. Withdrawal does not make processing that already happened on that consent unlawful. It does mean that the Data Fiduciary, and any Data Processor acting for it, must stop processing within a reasonable time, unless another lawful basis independently permits the processing to continue.
A Data Principal may give, manage, review or withdraw her consent through a Consent Manager, who is accountable to the Data Principal. Every Consent Manager must be registered with the Board under Section 6(9). That registration requirement runs on its own clock and commences on 13 November 2026, while the rest of Section 6 commences on 13 May 2027 with the remainder of Chapter II. Neither is in force yet.
Finally, Section 6(10) places the burden of proof on the Data Fiduciary. In any dispute, it is the Data Fiduciary that must prove that valid notice was given and consent was obtained, not the Data Principal who must prove the opposite. Keeping records capable of proving this is therefore part of the obligation. A defective consent mechanism falls under the residual Schedule item, up to ₹50 crore, and failing to prove valid consent also removes the lawful ground for the processing itself.
- Consent must be free, specific, informed, unconditional and unambiguous, through a clear affirmative action.
- Silence, inactivity and pre-ticked boxes do not count, and a consent cannot waive a right under the Act.
- Withdrawal must be as easy as giving consent; the Data Fiduciary and its processors must then stop within a reasonable time.
- Consent Managers are accountable to the Data Principal; their registration with the Board commences on 13 November 2026.
- The Data Fiduciary bears the burden of proving valid notice and consent.
Lesson 4
Accountability, accuracy, security and breaches
Section 8 contains the general obligations of a Data Fiduciary. Unlike Sections 4 to 7, which govern the ground for processing, Section 8 applies on top of whichever ground is used. Its starting point, in sub-section (1), is that the Data Fiduciary is responsible for complying with the Act no matter what any contract says, and whether or not the Data Principal has kept to her own duties under Section 15.
A Data Fiduciary may engage a Data Processor only under a valid contract, under sub-section (2). There is no exception for informal arrangements. The Data Fiduciary stays accountable for what its processors do, and once Rule 6 takes effect, the processor contract should bind the processor to the same security safeguards the Data Fiduciary itself must take.
Where personal data is likely to be used to make a decision that affects the Data Principal, or is disclosed to another Data Fiduciary, the Data Fiduciary must ensure the data is complete, accurate and consistent. More generally, sub-section (4) requires technical and organisational measures to make sure the Act is actually observed, not merely documented.
Sub-section (5) requires reasonable security safeguards to prevent a personal data breach. Rule 6 spells out what this includes once in force: encryption, masking or similar measures; access control; monitoring and logging; backups; processor contracts that bind the same safeguards; and retaining breach-related logs for one year. Failing to take reasonable security safeguards carries the Act's single highest penalty, up to ₹250 crore.
If a breach happens, sub-section (6) requires the Data Fiduciary to intimate both the Board and every affected Data Principal. Under Rule 7, that notification must be made without delay, followed by a full report to the Board within 72 hours covering the cause, the impact and the mitigation. Failing to notify carries a penalty of up to ₹200 crore. A breach notification is also the most common route by which the Board's inquiry powers under Section 27 come into play.
When fixing a penalty within the Schedule's ceiling, the Board must weigh factors including the gravity and duration of the breach and how quickly and effectively it was mitigated, so documented mitigation matters. All of Section 8 is not yet in force; it commences on 13 May 2027.
- The Data Fiduciary remains responsible for compliance regardless of any contract.
- Data Processors may be engaged only under a valid contract.
- Data used for a decision about the Data Principal, or disclosed to another Data Fiduciary, must be complete, accurate and consistent.
- Failing to take reasonable security safeguards can draw a penalty of up to ₹250 crore.
- A breach must be notified to the Board and every affected Data Principal; Rule 7 requires a full report to the Board within 72 hours.
Lesson 5
Erasure, contact details and grievances
Sub-sections (7) and (8) of Section 8 deal with how long personal data may be kept. A Data Fiduciary must erase personal data once the Data Principal withdraws her consent, or once the purpose for which it was collected is no longer being served, whichever is earlier. It must also cause its Data Processors to erase the data. The one exception is where retention is required by another law.
This means retention has to be justified by a live purpose or a legal requirement. Data kept indefinitely in case it becomes useful later, or erased by the Data Fiduciary but left in place with a vendor, does not meet the obligation.
Under sub-section (9), a Data Fiduciary must publish, on its website or app, the business contact information of a Data Protection Officer or of another person who can answer the Data Principal's questions about the processing of her personal data. Section 6 separately requires the same contact details to appear in every consent request. A Data Protection Officer is mandatory for a Significant Data Fiduciary, which under Section 10 must appoint one based in India; other Data Fiduciaries may name another contact person instead.
Sub-section (10) requires an effective mechanism to redress the grievances of Data Principals. This connects to the Data Principal's right under Section 13 to readily available grievance redressal. The Data Fiduciary must respond within the period the Rules prescribe, under Rule 14, and the Data Principal must use this internal channel before she can take a complaint to the Board. The grievance mechanism is therefore the real first line for complaints, not a formality.
None of these duties has its own item in the Schedule, so each falls under the residual item, with a penalty of up to ₹50 crore. The Central Government can notify certain Data Fiduciaries or classes of them, including startups, as exempt from specific duties such as accuracy and erasure, but only by notification; until an organisation or its class is actually notified, the full obligations apply. Like the rest of Section 8, these duties commence on 13 May 2027.
- Erase personal data once consent is withdrawn or the purpose is no longer served, whichever is earlier, unless another law requires retention.
- Data Processors must also be made to erase the data.
- Publish the business contact details of a Data Protection Officer or another responsible person on the website or app.
- Run an effective grievance mechanism; Data Principals must use it before complaining to the Board.
- These duties fall under the residual penalty of up to ₹50 crore.
Lesson 6
Processing children's personal data
Under the Act, a child is anyone under 18. The definition of Data Principal extends to the parent or lawful guardian where the individual is a child, and to the lawful guardian where she is a person with disability. Section 9 builds on this by setting extra rules for processing the personal data of children and of persons with disability who have a lawful guardian.
Before processing the personal data of a child, a Data Fiduciary must obtain the verifiable consent of a parent or lawful guardian. The same applies to the personal data of a person with disability who has a lawful guardian, where consent must come from that guardian. Rule 10 of the DPDP Rules, 2025 sets the mechanisms for verifiable consent once it takes effect.
Two things are barred outright, whatever consent has been obtained. A Data Fiduciary must not undertake processing that is likely to cause any detrimental effect on the well-being of a child. It also must not undertake tracking, behavioural monitoring or targeted advertising directed at children. Parental consent does not unlock either of these.
The Central Government can prescribe classes of Data Fiduciaries, or purposes, that are exempt from the verifiable-consent and no-tracking rules. Rule 12 does this narrowly. It exempts certain classes, including clinical establishments, schools, crèches and school-transport operators, for processing tied to health, safety or education. It also exempts certain purposes whoever carries them out, including government benefits in the child's interest, creating an email account, real-time location for safety, and age-gating itself.
The government can also notify an age above which a specific Data Fiduciary is exempt from these duties, once it is satisfied that the Data Fiduciary processes children's data in a verifiably safe manner. This is not a general safe harbour: it applies only to a Data Fiduciary the government has actually notified.
Breach of the Section 9 obligations carries a penalty of up to ₹200 crore under the Schedule to Section 33. Section 9 is not yet in force; it commences on 13 May 2027.
- A child is anyone under 18.
- Verifiable consent of a parent or lawful guardian is required before processing a child's personal data.
- Tracking, behavioural monitoring and targeted advertising directed at children are barred even with consent.
- Rule 12 exempts specific classes and purposes, narrowly; an age-threshold exemption applies only to a notified Data Fiduciary.
- Breach of Section 9 can draw a penalty of up to ₹200 crore.
Check yourself
5 random questions from this module. Answers are marked straight away and don't count toward the exam.