What processing do we oversee?
Can business owners describe the purposes, systems and parties involved?
PRIVACY LEADERSHIP GUIDE
Give common DPDP questions a responsible route.
Choose a topic for a concise discussion guide, then direct the specific legal question to the right accountable people and official sources.
Choose a topic
General guidance, accountable decisions
This page helps route questions; it does not provide advice or assess compliance for a particular organisation. Check the current official texts, effective dates, facts and applicable sector instruments.
Check official sources →Four leadership questions
What is operative now?
Do teams verify the correct provision, commencement and relevant official changes?
Who owns the next step?
Are decisions and unresolved questions routed to accountable people?
What should be retained?
Are records appropriate to purpose, access, retention and applicable obligations—and can the team distinguish what has been implemented, what can be evidenced and what remains unresolved?
Common questions to route for review
These examples preserve familiar business and technology questions as prompts. They do not determine legal applicability, compliance or the answer for a specific organisation.
A small clinic or startup
Size alone does not determine a Data Fiduciary role or Significant Data Fiduciary status. Identify who determines purpose and means for each activity, and check any official notification.
Sharing a lab report through a messaging app
Review the purpose, recipients, roles, safeguards, service-provider terms and any relevant health-sector requirements. The channel name alone does not answer the legal question.
Student or learner data
If children’s personal data may be involved, review Section 9 with Rules 10 and 12, their commencement and exemption conditions. Do not assume every education analytics use is prohibited or exempt.
An erasure request
The Act addresses correction and erasure in Section 12. Check commencement, the request’s facts and any applicable retention requirement; there is no general DPDP 72-hour erasure deadline.
Aadhaar identifiers in records
Check what identifier is collected, how it is used and which current Aadhaar or UIDAI instrument applies. A field label alone does not establish a violation.
A cloud region outside India
Review Section 16, Rules 15 and 13(4) where relevant, applicable sector instruments and commencement. Do not treat the DPDP Act as a fixed country blacklist.
An AI or agent cites a legal rule
Verify the official source, provision, version, commencement and conditions. Generated text is not a legal determination. For data used in decisions, review Section 8(3) where it applies; the Act does not create a universal human-review right.
Use the guide as a starting point
Adapt the discussion to your organisation’s real activities and responsibility model. Do not use a general guide to infer a legal exemption, role or compliance status.
Check official sources →