https://dpdpa.support/articles/ Plain-language, cited guides on India's Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 by Cynor Sense. en-IN Sat, 24 Oct 2026 08:30:00 +0530 https://dpdpa.support/articles/sim-binding-whatsapp-telegram-messaging-apps-dpdp-consent-2026/ https://dpdpa.support/articles/sim-binding-whatsapp-telegram-messaging-apps-dpdp-consent-2026/ Sat, 24 Oct 2026 08:30:00 +0530 Mobile & messaging As India tightens SIM-binding for messaging apps to curb fraud, businesses must separate security login verification from promotional messaging consent. — Read the full cited guide at https://dpdpa.support/articles/sim-binding-whatsapp-telegram-messaging-apps-dpdp-consent-2026/ https://dpdpa.support/articles/cert-in-php-vulnerability-60000-indian-websites-dpdp-security-2026/ https://dpdpa.support/articles/cert-in-php-vulnerability-60000-indian-websites-dpdp-security-2026/ Sat, 24 Oct 2026 08:30:00 +0530 Website security With national cyber warnings flagging 60,000 vulnerable PHP websites in India, unpatched web servers risk up to ₹250 crore security safeguard penalties from 13 May 2027. — Read the full cited guide at https://dpdpa.support/articles/cert-in-php-vulnerability-60000-indian-websites-dpdp-security-2026/ https://dpdpa.support/articles/dpdp-rules-cooperative-banks-nabard-data-security-2026/ https://dpdpa.support/articles/dpdp-rules-cooperative-banks-nabard-data-security-2026/ Sat, 24 Oct 2026 08:30:00 +0530 Cooperative banks Shared core banking vendors, branch KYC counters and ATM switches bring urban and rural cooperative lenders inside the 13 May 2027 duties. — Read the full cited guide at https://dpdpa.support/articles/dpdp-rules-cooperative-banks-nabard-data-security-2026/ https://dpdpa.support/articles/cert-in-high-severity-advisories-dpdp-72-hour-breach-reporting-2026/ https://dpdpa.support/articles/cert-in-high-severity-advisories-dpdp-72-hour-breach-reporting-2026/ Sat, 24 Oct 2026 08:30:00 +0530 CERT-In & breaches When a software vulnerability leads to unauthorized data access, engineering teams face two parallel duties: security safeguards and a 72-hour Board filing. — Read the full cited guide at https://dpdpa.support/articles/cert-in-high-severity-advisories-dpdp-72-hour-breach-reporting-2026/ https://dpdpa.support/articles/supreme-court-child-online-safety-age-gate-dpdp-parental-consent-2026/ https://dpdpa.support/articles/supreme-court-child-online-safety-age-gate-dpdp-parental-consent-2026/ Sat, 24 Oct 2026 08:30:00 +0530 EdTech & children As courts and policymakers debate online safety for minors, the DPDP Act and Rules set strict rules for under-18 parental verification and zero ad-tracking. — Read the full cited guide at https://dpdpa.support/articles/supreme-court-child-online-safety-age-gate-dpdp-parental-consent-2026/ https://dpdpa.support/articles/india-public-financial-data-breach-alerts-dark-web-dpdp-safeguards-2026/ https://dpdpa.support/articles/india-public-financial-data-breach-alerts-dark-web-dpdp-safeguards-2026/ Sat, 24 Oct 2026 08:30:00 +0530 Data breach watch When threat actors claim to leak public-sector or banking records, the DPDP Act tests whether encryption, access logs and 72-hour reporting were ready. — Read the full cited guide at https://dpdpa.support/articles/india-public-financial-data-breach-alerts-dark-web-dpdp-safeguards-2026/ https://dpdpa.support/articles/dpdp-act-data-mapping-inventory-processor-register/ https://dpdpa.support/articles/dpdp-act-data-mapping-inventory-processor-register/ Thu, 22 Oct 2026 08:30:00 +0530 Data mapping The Act never prints the acronym RoPA, yet five legal duties cannot work without a personal data inventory and a processor flow map. — Read the full cited guide at https://dpdpa.support/articles/dpdp-act-data-mapping-inventory-processor-register/ https://dpdpa.support/articles/dpdp-act-hr-recruitment-employee-payroll-data/ https://dpdpa.support/articles/dpdp-act-hr-recruitment-employee-payroll-data/ Thu, 22 Oct 2026 08:30:00 +0530 HR & employee data How the employment legitimate use works for staff payroll and workplace security, and why job applicants and payroll vendors still need specific controls. — Read the full cited guide at https://dpdpa.support/articles/dpdp-act-hr-recruitment-employee-payroll-data/ https://dpdpa.support/articles/dpdp-act-saas-cloud-gcc-outsourcing-processors/ https://dpdpa.support/articles/dpdp-act-saas-cloud-gcc-outsourcing-processors/ Thu, 22 Oct 2026 08:30:00 +0530 SaaS, cloud & GCCs Where a technology company acts as a Data Processor versus a Data Fiduciary, how the foreign outsourcing exemption works, and what cloud logging requires. — Read the full cited guide at https://dpdpa.support/articles/dpdp-act-saas-cloud-gcc-outsourcing-processors/ https://dpdpa.support/articles/dpdp-act-schools-coaching-edtech-student-data/ https://dpdpa.support/articles/dpdp-act-schools-coaching-edtech-student-data/ Thu, 22 Oct 2026 08:30:00 +0530 Schools & EdTech How student admissions, parent portals, learning apps and bus tracking work under the children’s data rules and the Fourth Schedule. — Read the full cited guide at https://dpdpa.support/articles/dpdp-act-schools-coaching-edtech-student-data/ https://dpdpa.support/articles/dpdp-act-ecommerce-d2c-marketplaces-logistics/ https://dpdpa.support/articles/dpdp-act-ecommerce-d2c-marketplaces-logistics/ Thu, 22 Oct 2026 08:30:00 +0530 E-commerce & D2C How online stores and marketplaces handle checkout notices, shipping aggregators, WhatsApp marketing opt-ins and the three-year inactivity rule. — Read the full cited guide at https://dpdpa.support/articles/dpdp-act-ecommerce-d2c-marketplaces-logistics/ https://dpdpa.support/articles/dpdp-act-fintech-nbfc-digital-lending-kyc/ https://dpdpa.support/articles/dpdp-act-fintech-nbfc-digital-lending-kyc/ Thu, 22 Oct 2026 08:30:00 +0530 Fintech & lending How the Act and Rules apply across onboarding, identity verification, credit bureau pulls, lending service providers and debt recovery. — Read the full cited guide at https://dpdpa.support/articles/dpdp-act-fintech-nbfc-digital-lending-kyc/ https://dpdpa.support/articles/dpdp-act-gsr-843e-enforcement-sections-technology-stack/ https://dpdpa.support/articles/dpdp-act-gsr-843e-enforcement-sections-technology-stack/ Wed, 21 Oct 2026 08:30:00 +0530 Timeline How the three MeitY commencement dates map to consent systems, attribute-based access control, encryption, one-year audit logs and 24x7 security operations. — Read the full cited guide at https://dpdpa.support/articles/dpdp-act-gsr-843e-enforcement-sections-technology-stack/ https://dpdpa.support/articles/dpdp-act-and-it-act-2000-which-prevails/ https://dpdpa.support/articles/dpdp-act-and-it-act-2000-which-prevails/ Wed, 07 Oct 2026 08:30:00 +0530 Other laws The DPDP Act adds to other laws and prevails only to the extent of a conflict. It amends the IT Act, including omitting 43A, from 13 May 2027. — Read the full cited guide at https://dpdpa.support/articles/dpdp-act-and-it-act-2000-which-prevails/ https://dpdpa.support/articles/dpdp-security-safeguards-checklist-small-business/ https://dpdpa.support/articles/dpdp-security-safeguards-checklist-small-business/ Wed, 07 Oct 2026 08:30:00 +0530 Security safeguards The Rules list seven minimum safeguards, from data security to keeping logs for a year. The duty starts on 13 May 2027. — Read the full cited guide at https://dpdpa.support/articles/dpdp-security-safeguards-checklist-small-business/ https://dpdpa.support/articles/transfer-personal-data-outside-india/ https://dpdpa.support/articles/transfer-personal-data-outside-india/ Wed, 07 Oct 2026 08:30:00 +0530 Cross-border The Act allows transfers abroad unless the government restricts a country by notification. The Rules add requirements about foreign States, and stricter Indian law still applies. — Read the full cited guide at https://dpdpa.support/articles/transfer-personal-data-outside-india/ https://dpdpa.support/articles/dpdp-act-small-business-customer-lead-data/ https://dpdpa.support/articles/dpdp-act-small-business-customer-lead-data/ Wed, 07 Oct 2026 08:30:00 +0530 Small business The law has no size test. These are the duties that start on 13 May 2027, with our own first steps for a shop, an app, a coaching institute or a salon, clearly labelled. — Read the full cited guide at https://dpdpa.support/articles/dpdp-act-small-business-customer-lead-data/ https://dpdpa.support/articles/childrens-data-dpdp-act-parental-consent/ https://dpdpa.support/articles/childrens-data-dpdp-act-parental-consent/ Wed, 07 Oct 2026 08:30:00 +0530 Children’s data A child is anyone under 18. You need a parent’s verifiable consent first, and you may not track, behaviourally monitor or target ads at children unless an exemption applies. — Read the full cited guide at https://dpdpa.support/articles/childrens-data-dpdp-act-parental-consent/ https://dpdpa.support/articles/personal-data-breach-rule-7/ https://dpdpa.support/articles/personal-data-breach-rule-7/ Wed, 07 Oct 2026 08:30:00 +0530 Breach Two filings to the Board and a notice to every affected person. What each must contain, and when it is due. — Read the full cited guide at https://dpdpa.support/articles/personal-data-breach-rule-7/ https://dpdpa.support/articles/complain-to-data-protection-board-appeal-60-days/ https://dpdpa.support/articles/complain-to-data-protection-board-appeal-60-days/ Wed, 07 Oct 2026 08:30:00 +0530 Data Protection Board A person uses your grievance process first. The Board then checks, inquires and hears you, and an order can be appealed within 60 days. — Read the full cited guide at https://dpdpa.support/articles/complain-to-data-protection-board-appeal-60-days/ https://dpdpa.support/articles/dpdp-act-clinics-hospitals-patient-data/ https://dpdpa.support/articles/dpdp-act-clinics-hospitals-patient-data/ Wed, 07 Oct 2026 08:30:00 +0530 Clinics and hospitals Patient records are personal data like any other. The Act lists medical emergencies as a use that needs no consent, and the Rules give clinics a limited exemption for children’s data. — Read the full cited guide at https://dpdpa.support/articles/dpdp-act-clinics-hospitals-patient-data/ https://dpdpa.support/articles/dpdpa-penalties-explained/ https://dpdpa.support/articles/dpdpa-penalties-explained/ Wed, 07 Oct 2026 08:30:00 +0530 Penalties The Schedule sets maximums. The Board fixes an amount only after an inquiry finds a significant breach, using seven factors set out in the Act. — Read the full cited guide at https://dpdpa.support/articles/dpdpa-penalties-explained/ https://dpdpa.support/articles/are-startups-exempt-from-the-dpdp-act/ https://dpdpa.support/articles/are-startups-exempt-from-the-dpdp-act/ Wed, 07 Oct 2026 08:30:00 +0530 Startups The Act has no startup test. The government may notify startups out of five named provisions. We have seen no such notification as of 7 Oct 2026. Duties start on 13 May 2027. — Read the full cited guide at https://dpdpa.support/articles/are-startups-exempt-from-the-dpdp-act/ https://dpdpa.support/articles/dpdp-act-timeline-2025-2026-2027/ https://dpdpa.support/articles/dpdp-act-timeline-2025-2026-2027/ Wed, 07 Oct 2026 08:30:00 +0530 Timeline Two instruments dated 13 November 2025 set three dates. Most duties on businesses start on the third. — Read the full cited guide at https://dpdpa.support/articles/dpdp-act-timeline-2025-2026-2027/ https://dpdpa.support/articles/significant-data-fiduciary-dpo-dpia-who-needs-them/ https://dpdpa.support/articles/significant-data-fiduciary-dpo-dpia-who-needs-them/ Wed, 07 Oct 2026 08:30:00 +0530 Significant Data Fiduciary Only a Significant Data Fiduciary, which the Central Government notifies, must appoint a DPO and run DPIAs. Those duties start on 13 May 2027. — Read the full cited guide at https://dpdpa.support/articles/significant-data-fiduciary-dpo-dpia-who-needs-them/ https://dpdpa.support/articles/does-the-dpdp-act-apply-to-my-business/ https://dpdpa.support/articles/does-the-dpdp-act-apply-to-my-business/ Wed, 07 Oct 2026 08:30:00 +0530 Scope Coverage turns on two questions about your data, then three exclusions. There is no size threshold. — Read the full cited guide at https://dpdpa.support/articles/does-the-dpdp-act-apply-to-my-business/ https://dpdpa.support/articles/how-long-keep-customer-data-dpdp/ https://dpdpa.support/articles/how-long-keep-customer-data-dpdp/ Tue, 06 Oct 2026 08:30:00 +0530 Retention Erase when the purpose ends unless a law says to keep it. Logs and related data are kept for at least one year for purposes the Rules list, then erased. Large platforms have a three-year limit. — Read the full cited guide at https://dpdpa.support/articles/how-long-keep-customer-data-dpdp/ https://dpdpa.support/articles/privacy-policy-indian-website/ https://dpdpa.support/articles/privacy-policy-indian-website/ Tue, 06 Oct 2026 08:30:00 +0530 Privacy page The law does not use the words privacy policy. It asks for a notice, a contact, a way to make requests and a grievance period. — Read the full cited guide at https://dpdpa.support/articles/privacy-policy-indian-website/ https://dpdpa.support/articles/dpdp-registration-or-licence-for-my-business/ https://dpdpa.support/articles/dpdp-registration-or-licence-for-my-business/ Tue, 06 Oct 2026 08:30:00 +0530 Registration Only Consent Managers register with the Board; those rules come into force on 13 November 2026. Significant Data Fiduciaries are notified by the government. Other businesses meet the duties from 13 May 2027. — Read the full cited guide at https://dpdpa.support/articles/dpdp-registration-or-licence-for-my-business/ https://dpdpa.support/articles/delete-request-vs-keep-invoices-dpdp/ https://dpdpa.support/articles/delete-request-vs-keep-invoices-dpdp/ Tue, 06 Oct 2026 08:30:00 +0530 Erasure Erase on request unless keeping the data is necessary for the purpose or to comply with a law. The Act and Rules name no invoice period, so the period comes from the other law. — Read the full cited guide at https://dpdpa.support/articles/delete-request-vs-keep-invoices-dpdp/ https://dpdpa.support/articles/processors-vendors-data-processing-agreement/ https://dpdpa.support/articles/processors-vendors-data-processing-agreement/ Tue, 06 Oct 2026 08:30:00 +0530 Vendors The Act keeps the duty with you whatever the contract says, and requires a valid contract for processors engaged to help you offer goods or services. — Read the full cited guide at https://dpdpa.support/articles/processors-vendors-data-processing-agreement/ https://dpdpa.support/articles/dpdp-zoho-tally-google-workspace-whatsapp-business/ https://dpdpa.support/articles/dpdp-zoho-tally-google-workspace-whatsapp-business/ Tue, 06 Oct 2026 08:30:00 +0530 Vendors Where a supplier stores or handles customer data for you, it is your Data Processor and you stay responsible. What the law asks, with Zoho, Tally, Google Workspace and WhatsApp Business as examples of where data sits. — Read the full cited guide at https://dpdpa.support/articles/dpdp-zoho-tally-google-workspace-whatsapp-business/ https://dpdpa.support/articles/data-principal-rights-90-day-grievance-limit/ https://dpdpa.support/articles/data-principal-rights-90-day-grievance-limit/ Tue, 06 Oct 2026 08:30:00 +0530 Rights The Act gives people four rights against a Data Fiduciary. The Rules cap the grievance response period at 90 days. The 90 days covers the reply to a grievance. — Read the full cited guide at https://dpdpa.support/articles/data-principal-rights-90-day-grievance-limit/ https://dpdpa.support/articles/consent-notice-section-5-rule-3/ https://dpdpa.support/articles/consent-notice-section-5-rule-3/ Tue, 06 Oct 2026 08:30:00 +0530 Consent Every request for consent needs a notice that comes with it or before it. The Act and the Rules set the minimum contents. — Read the full cited guide at https://dpdpa.support/articles/consent-notice-section-5-rule-3/ https://dpdpa.support/articles/data-fiduciary-data-processor-data-principal/ https://dpdpa.support/articles/data-fiduciary-data-processor-data-principal/ Tue, 06 Oct 2026 08:30:00 +0530 Definitions The three roles in the DPDP Act on one page, with the Act’s definitions in plain words and what each role owes. — Read the full cited guide at https://dpdpa.support/articles/data-fiduciary-data-processor-data-principal/ https://dpdpa.support/articles/consent-managers-dpdp-13-november-2026/ https://dpdpa.support/articles/consent-managers-dpdp-13-november-2026/ Tue, 06 Oct 2026 08:30:00 +0530 Consent Managers Registration of Consent Managers starts on 13 November 2026. Data Fiduciary duties start later, on 13 May 2027. — Read the full cited guide at https://dpdpa.support/articles/consent-managers-dpdp-13-november-2026/