Other DPDP duties
DPDP Act duties for Significant Data Fiduciaries, Consent Managers and transfers, what the product does not do, and when the Rules apply.
The remaining duties under India's DPDP Act, 2023 and DPDP Rules, 2025: Significant Data Fiduciaries, Consent Managers and transfers, with what the product does not do.
Confirm the citations
Where the product cites a section or rule in its own messages, this page uses the same citation. This is not legal advice. Confirm each citation with your counsel.
How to read the tables#
- Duty is a short version of the section or rule beside it. Read the text itself before you rely on it.
- A DPDP rule is an enabled region rule under the DPDP law, the preset for India.
- You are the Data Fiduciary. The product processes consent records for you.
Significant Data Fiduciary#
| Duty | Section or rule | What the product does | What remains yours |
|---|---|---|---|
| Appoint a Data Protection Officer based in India. | Section 10(2)(a) | Project settings holds the officer's name and contact and publishes them. The Significant Data Fiduciary page records that the officer is based in India and whom they answer to. | The appointment. |
| Appoint an independent data auditor. Run a Data Protection Impact Assessment and an audit every twelve months, with a report to the Board. | Section 10(2); Rule 13(1), (2) | The Significant Data Fiduciary page keeps each assessment and audit: who carried it out, the significant observations, the SHA-256 of the report and when it reached the Board. It shows when the next is due and prepares the report for the Board as JSON and text. Receipts, daily anchors and the audit log are evidence an auditor can check. | The auditor, the assessment, the audit and giving the report to the Board. |
| Check that technical measures, including algorithmic software, do not put people's rights at risk. | Rule 13(3) | The same page keeps a register of this due diligence. | The due diligence. |
| Keep the personal data the Government specifies inside India. | Rule 13(4) | The page records whether this applies. The DPDP Act check compares it with the country the operator states in DEPLOYMENT_COUNTRY. |
Choosing where the deployment runs. |
Meet the duties of a Significant Data Fiduciary shows the page.
Consent Manager#
| Duty | Section or rule | What the product does | What remains yours |
|---|---|---|---|
| Register as a Consent Manager and meet its obligations. | Section 6(7) to (9); Rule 4; First Schedule | The product serves the Data Fiduciary. It does not act as a Consent Manager, a separate role that opens for registration on 13 November 2026. The consent portal lets a person review every consent, withdraw any of them and download the records, as part of your own duties. Your server creates the link with consentPortalLink. |
Deciding whether to accept consent through a registered Consent Manager. The product can record it: see Accept consent from a Consent Manager. |
Cross-border transfer#
| Duty | Section or rule | What the product does | What remains yours |
|---|---|---|---|
| Transfer outside India only where the Government has not restricted it, and under any stricter law. | Section 16; Rules 13(4), 15 | The product makes no transfer of its own beyond the webhooks, scans and translation calls you set up. Location is resolved from a local database or from headers. No outside geolocation service is called. The operator states where the deployment keeps data. Settings shows it under Where your data is kept, and the DPDP Act check shows it as a note. | Where the deployment runs. Which translation service you choose, since form wording is sent to it. Where your webhook endpoints are. |
Data processing lists every outside call.
What the product does not do#
Every mapping table assumes this list.
| The product does not | What happens instead |
|---|---|
| Send email or SMS | Confirmation links, breach notices, the notice before inactivity erasure and replies to rights requests reach your systems as API responses or webhooks. You send them to the person. |
| Carry out a Data Protection Impact Assessment or an audit | It keeps a register of each, with the SHA-256 of its report. The assessment, the audit and the report are yours. |
| Act as a Consent Manager | It serves the Data Fiduciary. A Consent Manager is a separate role under section 6(7) to (9) and Rule 4. |
| Look for data outside websites | The scanner and the browser runtime find cookies, storage keys and third-party hosts on web pages. They do not look inside mobile apps, databases, servers or files. |
| Verify a parent or guardian | Your systems do the checking and tell the product which method was used. |
| Correct your business data | A correction request is tracked here and carried out by your team in your own systems. |
| Stop your processing | In the browser it holds tags and deletes the known first-party cookies of a withdrawn purpose. It tells your servers by webhook, and answers the consent check your systems call before they process. Acting on the answer, in your systems and at your Data Processors, is your step. For each partner registered as a Data Processor it writes a stop task with a due date, lists it in the webhook and tracks what was reported. |
The DPDP Act check#
The DPDP Act check has its own page in the top bar. It combines what the scanner saw, visiting as someone in India, with the project's set-up and open work.
Each check has four parts: a status, what was found, the fix, and the provision it rests on. The status is one of PASS, FAIL, WARN, INFO or NOT_CHECKED.
| Area | Checks |
|---|---|
| Site | The notice is shown under the Act. Nothing that needs consent runs before a choice. Accept and reject are both on the first layer. Purposes are itemised. English and the 22 languages are offered. Contact, rights link and complaint link are present. Withdrawal is available after answering. Pages use HTTPS. The site publishes the contact, how to make a rights request and the response period. |
| Set-up | A DPDP rule covers India and is opt-in. Its form is published. Purposes are itemised and described. Each purpose is based on consent or names a section 7 use. A privacy contact is set. An endpoint receives consent.withdrawn. The response period is at most 90 days. Evidence is kept at least a year. Inactivity erasure has a subject.erasure_notice subscriber. People can raise a grievance. A named grievance officer is reported; without one, the check says grievances go to the privacy contact. Children are shown for information only. Significant Data Fiduciary duties are a note until the project is marked as one; then six checks test the officer, the auditor, the yearly assessment and audit, algorithmic due diligence and keeping data in India. |
| Operations | Overdue requests. Breach reports due to the Board. |
The check covers what the product can see: a website and this project. It is not an audit of your organisation and it is not legal advice. Run the DPDP check shows how to use it.
When the Rules apply#
| From | What applies |
|---|---|
| 13 November 2025 | Rules 1, 2 and 17 to 21: definitions and the Data Protection Board |
| 13 November 2026 | Rule 4: registration and obligations of Consent Managers |
| 13 May 2027 | Rules 3, 5 to 16, 22 and 23: notice, security, breach, erasure and retention, contact, children, Significant Data Fiduciaries, rights, transfers |
The dates follow Rule 1: publication in the Gazette on 13 November 2025, then one year and eighteen months after it. The Act's sections start on the same three dates, by G.S.R. 843(E). See DPDP rule set.
Sources#
- The Gazette text of the Act.
- The Gazette text of the Rules: G.S.R. 846(E), dated 13 November 2025.
- The commencement of the Act: G.S.R. 843(E), dated 13 November 2025.
- The Government's explainer of November 2025. It describes the 90-day period for access, correction, updating and erasure requests as well as grievances. Rule 14(3) itself sets it for grievances.