Consent Manager obligations under the DPDP Act kick in on 13 November 2026, and the core compliance obligations become enforceable on 13 May 2027. Most companies holding customer, employee, or vendor data haven't mapped what they collect, let alone built the consent flow the law now requires.
Lynx Legal Partners LLP helps founder-run and India-facing companies work out what the Digital Personal Data Protection Act actually requires of them — whether you're a software firm processing client data under an MSA, a GCC running employee and cross-border data flows, a D2C brand with a marketplace's worth of customer records, or a funded startup that's never had a compliance calendar.
Most businesses don't know whether they're a Data Fiduciary or a Significant Data Fiduciary — and that classification changes what the law demands of you, including whether you need a designated Data Protection Officer. We start by finding out, then build the programme around the answer.
A fixed-fee DPDP gap-check — mapping what personal data you collect and process, your fiduciary classification, your consent and vendor-contract exposure, and breach readiness, priced upfront. Clients typically move into a remediation sprint, an ongoing compliance retainer, and — for Significant Data Fiduciaries — a standing DPO-of-record arrangement.
Duties around registered Consent Managers become active — affecting how you capture, record, and honour consent.
The Act's substantive compliance requirements — notice, consent, data-principal rights, breach reporting — become enforceable.
The ceiling under the Act, for failing to take reasonable security safeguards to prevent a personal data breach.
Yes. Section 3 applies the Act to digital personal data processed within India, whether it was collected digitally or digitised afterwards. A purely Indian customer base does not put you outside the Act — it puts you squarely inside it. The Act separately reaches processing outside India where it relates to offering goods or services to people in India. Employee, contractor and vendor records are personal data too, not just customer records.
The DPDP Rules, 2025 were published on 13 November 2025 and commence in stages. On 13 November 2026, Rule 4 and section 6(9) take effect, bringing the Consent Manager registration framework live. On 13 May 2027, the substantive regime follows — notice and consent, data-principal rights, breach reporting, Significant Data Fiduciary duties and the Board's enforcement powers. Until that date, most DPDP obligations are not yet legally binding on your business.
A Significant Data Fiduciary is one the Central Government notifies as significant under section 10, judged on the volume and sensitivity of data processed, risk to data principals' rights, and risks to India's sovereignty, electoral democracy, State security and public order. It is not self-declared, and the Act sets no user-count threshold. As at September 2026 no designations have been notified. We assess your likely exposure so designation would not be disruptive.
Only if you are designated a Significant Data Fiduciary. Section 10(2)(a) requires an SDF to appoint a Data Protection Officer based in India, answerable to the board or equivalent, who serves as the contact point for grievances. Every other Data Fiduciary must still publish the contact details of a person able to answer questions about its processing. We act as DPO-of-record where a company wants that function covered without an internal hire.
We scope DPDP gap assessments as a fixed fee, quoted upfront rather than billed against hours, so the cost is known before work starts. What moves the scope is how many systems and vendors touch personal data, whether employee and cross-border flows are included, and the state of your existing notices and contracts. Send us what you collect and how, and we will come back with scope and fee.
Yes. The DPDP Act imposes no general data-localisation requirement. Section 16 allows the Central Government to restrict transfers to particular countries or territories by notification, and no such restrictions have been notified to date. Sectoral rules are unaffected — RBI payment-data requirements and similar regulator-specific obligations continue to apply in their own right. For group and GCC structures the real work sits in intra-group agreements and processing terms.
₹250 crore is the highest figure in the Schedule to the Act, and it attaches to one failure specifically: breach of the section 8(5) obligation to take reasonable security safeguards. The other tiers sit below it — ₹200 crore for failing to give breach notice under section 8(6), ₹200 crore for children's-data obligations, ₹150 crore for Significant Data Fiduciary duties, and ₹50 crore for any other breach. The Data Protection Board imposes them after inquiry.
No. GDPR work gives you a real head start on data mapping and security, but the regimes diverge where it counts. DPDP has no legitimate-interest basis — you need consent or one of the specific legitimate uses in section 7. It treats everyone under 18 as a child requiring verifiable parental consent, against GDPR's 13-to-16 range. Notice content, breach reporting and data-principal rights all differ. The gap usually shows up in consent design and vendor contracts.
Send us what data you collect and how — we'll flag what's exposed, fixed-fee, in one week.
Copyright© 2026 Lynx Legal Partners LLP
Lynx Legal Partners LLP · LLPIN: ABB-6277 · Registered office: Mumbai
