DPDP Act Consultant and Advisor in India

Audience

Who this is for

Indian companies that collect customer, employee or patient data, and whose boards want a clear view of readiness
Global Capability Centres working out what the section 17(1)(d) exemption covers, and what it does not
Foreign companies offering goods or services to people in India, which the Act reaches under section 3

Obligations

What the Act requires of most organisations

For an ordinary Data Fiduciary, the work is practical and specific:

Clear notices and consent that can be evidenced, or a recorded legitimate use
Reasonable security safeguards. Failing here carries the highest penalty in the Act, up to ₹250 crore
Breach intimation to the Data Protection Board and to every affected person. Failing to notify carries up to ₹200 crore
Deleting data once its purpose is served, and a working grievance process with a named contact

Not required

What it does not require of most organisations

A Data Protection Officer, an independent data auditor and periodic Data Protection Impact Assessments are obligations of Significant Data Fiduciaries under section 10. Most companies are not one. I will tell you if you are likely to be, and I will not sell you a DPO or an audit you do not need.

Engagement

Ways to work together

Engagement	What you get	Typical length
Board briefing	A session for the board or audit committee: what the Act means for this company, the exposure, and the questions to ask management	Half day
Readiness review	Data mapping at the level the Act needs, a gap assessment against each obligation, and a prioritised plan the board can track	3–4 weeks
Programme oversight	Monthly independent review of the programme your team or another firm is delivering, reported to the board	Monthly, 6–12 months
Delivery	Notices, consent records, breach process aligned to both DPDP and CERT-In's six-hour reporting, retention and deletion rules	Scoped per project

FAQ

Common questions

Does the DPDP Act apply to our GCC?

Partly. Processing of foreign individuals' data under a contract with a foreign entity is largely exempt under section 17(1)(d), but the duty to take reasonable security safeguards still applies, and your own Indian employee and vendor data is fully covered. Read the full answer

Is DPDP breach notification 72 hours?

Notice to the Board and affected people is due without delay, and a detailed report to the Board within 72 hours. CERT-In's six-hour reporting applies in parallel. Read the full answer

Do we need a Data Protection Officer?

Only if you are a Significant Data Fiduciary under section 10. Every Data Fiduciary must publish the contact details of someone who can answer people's questions about their data.

DPDP Act consultant and advisor for Indian companies and GCCs