---
title: "DPDP Act Compliance Advocate in Ernakulam, Kerala"
description: "DPDP Act 2023 and Rules 2025 for Kerala businesses from Ernakulam: notices, consent, breach response, vendor contracts, Board complaints. Information only."
url: "https://advaslam.com/practice/data-protection/"
image: "https://advaslam.com/og/practice/data-protection.png"
---

Practice · Advisory & compliance

# Data protection & DPDP Act advocate in Ernakulam

I advise businesses and individuals on the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025: applicability reviews, notices and consent flows, children's and employee data, vendor contracts, breach response, and complaints before the Data Protection Board and the TDSAT appeal route. I work from Ernakulam, and much of this work is done remotely.

Adv. K J Muhammed Aslam · Bar Council of Kerala · High Court Junction, Ernakulam
90 matter types · [See every matter →](https://advaslam.com/practice/data-protection/matters/) · [Contact details →](https://advaslam.com/contact/)

Coverage

## What does this area cover?

-   **[Applicability, data fiduciaries, notices and consent](https://advaslam.com/practice/data-protection/matters/applicability-fiduciary-notices-consent/)** — Whether the Act applies under s.3, who is the Data Fiduciary and who the Processor, item-wise notices under s.5 including the s.5(2) notice for consent taken before commencement, valid consent under s.6, Consent Managers, and the s.7 uses that need no consent.
-   **[Rights, children, employees, CCTV and retention](https://advaslam.com/practice/data-protection/matters/rights-children-employee-cctv-retention/)** — Access, correction, erasure and nomination requests under ss.11 to 14, the s.15 duties of Data Principals, verifiable parental consent and the bar on tracking and targeted ads at children under s.9, HR data under s.7(i), CCTV procedures and retention schedules.
-   **[Vendors, security, breach and grievances](https://advaslam.com/practice/data-protection/matters/vendor-security-breach-grievance/)** — Processor contracts under s.8(2), the Rule 6 minimum security safeguards, cross-border transfers under s.16, breach intimation to each affected person and to the Board with a detailed report within 72 hours under Rule 7, and a grievance system that answers on time.
-   **[Significant data fiduciaries, the Board, TDSAT, e-sign and domains](https://advaslam.com/practice/data-protection/matters/sdf-board-tdsat-esign-domain/)** — Significant Data Fiduciary duties under s.10, complaints to the Data Protection Board after the grievance route, voluntary undertakings under s.32, appeals to TDSAT within 60 days under s.29, consent records that stand up as evidence, phishing domains and s.37 blocking.
-   **[AI governance and compliance](https://advaslam.com/practice/data-protection/matters/ai-governance/)** — Office AI-use policies, no-training clauses in AI vendor contracts, hiring and scoring tools checked for purpose and accuracy under s.8(3), deletion of personal data from training pipelines, voice-clone consent, and the first response when a person or brand is deepfaked.

## Who must comply with the DPDP Act, and from when?

The Act applies to digital personal data processed in India, including data collected on paper and digitised later, and to processing outside India connected with offering goods or services to people in India (s.3). Purely personal or domestic use, and data that a person has made public herself, fall outside it. A shop that keeps customer numbers in a billing app, a clinic with patient records, a school with a fee portal and an employer with biometric attendance are all within it.

Commencement is phased under G.S.R. 843(E) and the DPDP Rules, 2025, both dated 13 November 2025. The Board provisions took effect that day. The Consent Manager registration rule applies one year after publication, around 14 November 2026. Most other obligations, including notices, consent, security safeguards, breach intimation, children’s data, retention and grievance redressal, apply from about 14 May 2027, eighteen months after publication. Two provisions matter for planning now: under s.5(2), customers whose consent was taken before commencement must get a notice as soon as reasonably practicable, and under s.17(3) relief for startups or other classes exists only if the government notifies it.

## What does DPDP compliance work cover for a business?

For an e-commerce seller, a hospital or clinic, a school or an employer, DPDP compliance starts with a map of the personal data held and why. From that come the consent notice under Section 5 (in English and Malayalam where customers need it), consent management and withdrawal, security safeguards, a breach-response plan, retention and erasure, grievance redressal, and contracts with the vendors that process data on the business’s behalf — see [data processing agreements](https://advaslam.com/practice/drafting/matters/agreements/#phrase-data-processing-agreement-dpa-format-dpdp-act-india). The entries are grouped under [consent notices and consent management](https://advaslam.com/practice/data-protection/matters/applicability-fiduciary-notices-consent/#section-consent-notices-and-consent-management) and [AI governance and compliance](https://advaslam.com/practice/data-protection/matters/ai-governance/). Appeals against the Data Protection Board’s orders go to the TDSAT under Section 29; a writ petition under Article 226 before the High Court of Kerala is kept for questions that route cannot answer.

Forums

## Which court or authority hears it?

| Matter | Law | Forum | Time limit |
| --- | --- | --- | --- |
| Notice, consent, security, rights and retention duties | DPDP Act ss.4–17; DPDP Rules r.3, 5–16 | Internal compliance; Data Protection Board on complaint | Most apply from about 14 May 2027 (G.S.R. 843(E)) |
| Consent Manager registration | s.6(9); Rule 4 and First Schedule | Data Protection Board | s.6(9) and Rule 4 in force about 14 November 2026 |
| Personal data breach | s.8(6); Rule 7 | Data Protection Board and each affected Data Principal | Without delay; detailed Board report within 72 hours |
| Grievance by a Data Principal | ss.8(10), 13; Rule 14(3) | Data Fiduciary or Consent Manager | Published period, not more than 90 days |
| Complaint against a Data Fiduciary | ss.13(3), 27(1)(b), 28 | Data Protection Board (digital office) | After the grievance route is exhausted |
| Appeal against a Board order or direction | s.29 | TDSAT (Appellate Tribunal) | 60 days from receipt; later only on sufficient cause |
| Blocking access to a repeat offender's service | s.37 | Central Government on a Board reference | No fixed limit; needs penalties in two or more instances |

Limits run from the date the law specifies; check them against your own dates.

How it proceeds

## How does a matter proceed?

1.  **Applicability and data map.** A written check of whether and how the Act applies, which personal data you hold, where it sits, which vendors handle it, and whether you are fiduciary or processor for each flow.
2.  **Notices, consent and legacy data.** Standalone notices in English and Malayalam under s.5 and Rule 3, consent that can be withdrawn as easily as it was given, and a s.5(2) notice plan for the existing customer base.
3.  **Contracts, safeguards and retention.** Processor agreements under s.8(2), Rule 6 safeguards recorded in a form the Board can inspect, retention schedules, and separate handling of children's and HR data.
4.  **Breach and grievance drill.** A Rule 7 playbook: notice to affected persons and the Board without delay, the 72-hour detailed report, and a grievance desk that meets its published response period.
5.  **Board and TDSAT stage.** Replies to Board notices, mitigation material under s.33(2), a voluntary undertaking under s.32 where suitable, and the TDSAT appeal within 60 days of receiving an order.

## What should you keep ready?

-   A list of personal data collected, by form, app, website and paper register
-   Current privacy policy, terms, consent screens and CCTV signage
-   Vendor list with contracts, hosting locations and sub-processors
-   Security measures in place: access control, logging, backups and encryption
-   HR, CCTV and customer-data retention practice as actually followed
-   Any breach history, grievance log or complaint received
-   A Board notice or order, with the date of receipt, if a proceeding has begun

Reading

## Guides and articles on this area

-   [DPDP Readiness Checklist for Small Business](https://advaslam.com/guides/dpdp-readiness-checklist-small-business/) Guide
-   [DPDP Compliance Guide for Kerala Businesses to May 2027](https://advaslam.com/writing/dpdp-compliance-guide-kerala-businesses/) Article
-   [Your Personal Data Was Leaked by a Company: What You Can Do Under the DPDP Act](https://advaslam.com/writing/data-breach-victim-rights-dpdp-compensation/) Article
-   [CERT-In 6-Hour vs DPDP 72-Hour Breach Reporting: Which Clock Applies to Your Business?](https://advaslam.com/writing/cert-in-6-hour-vs-dpdp-72-hour-breach-reporting/) Article
-   [DPDP Act and Children's Data in India: Verifiable Parental Consent, Tracking Bans and What EdTech Must Change](https://advaslam.com/writing/dpdp-children-data-parental-consent-guide/) Article
-   [Cross-Border Data Transfers Under the DPDP Act: What Section 16 and Rule 15 Actually Allow](https://advaslam.com/writing/dpdp-cross-border-data-transfer-section-16/) Article

[All 7 articles in this area →](https://advaslam.com/writing/#data-protection)

These answers follow the Act, the 2025 Rules and G.S.R. 843(E); confirm the Gazette position before acting. The [DPDP readiness checklist](https://advaslam.com/guides/dpdp-readiness-checklist-small-business/) sets out ten controls, [this article on breach clocks](https://advaslam.com/writing/cert-in-6-hour-vs-dpdp-72-hour-breach-reporting/) compares CERT-In and DPDP reporting, and the [matters index](https://advaslam.com/practice/data-protection/matters/) lists each obligation.

FAQ

## Common questions

**Does the DPDP Act apply to a small business?**

Yes, if it processes digital personal data; the Act has no general small-business exemption. Under s.17(3) the Central Government may notify classes of fiduciaries, including startups, that are relieved of certain duties, but only by notification.

**When do DPDP Act obligations actually start?**

In phases. The Board provisions took effect on 13 November 2025 and the Consent Manager rule about a year later; most fiduciary obligations, including notice, consent, security and breach reporting, apply from about 14 May 2027 under G.S.R. 843(E).

**How fast must a data breach be reported under the DPDP Rules?**

Without delay, to each affected Data Principal and to the Board. Rule 7 also requires a detailed report to the Board within 72 hours of becoming aware of the breach, unless the Board allows a longer period on written request.

**Do we need to appoint a Data Protection Officer?**

Only if notified as a Significant Data Fiduciary under s.10, which requires a Data Protection Officer based in India. Every other fiduciary must still publish the contact of a person who can answer questions about its processing, under s.8(9).

**Can the Data Protection Board award me compensation?**

No. Board penalties go to the Consolidated Fund of India; a person who suffered loss from a breach needs a separate civil claim, after using the fiduciary's grievance route and, where needed, a Board complaint.

**Is a privacy policy on the website enough for DPDP compliance?**

No. The Act needs working systems: itemised notices, consent that can be withdrawn, security safeguards, breach intimation, retention and erasure, and a grievance process with a published response period of not more than 90 days.

Matters

## Every matter, by group

Each matter type with its law, forum, procedure, documents and limitation clock. [All 90 on one page →](https://advaslam.com/practice/data-protection/matters/)

-   [Applicability, data fiduciaries, notices and consent](https://advaslam.com/practice/data-protection/matters/applicability-fiduciary-notices-consent/) 18
-   [Rights, children, employees, CCTV and retention](https://advaslam.com/practice/data-protection/matters/rights-children-employee-cctv-retention/) 18
-   [Vendors, security, breach and grievances](https://advaslam.com/practice/data-protection/matters/vendor-security-breach-grievance/) 18
-   [Significant data fiduciaries, the Board, TDSAT, e-sign and domains](https://advaslam.com/practice/data-protection/matters/sdf-board-tdsat-esign-domain/) 18
-   [AI governance and compliance](https://advaslam.com/practice/data-protection/matters/ai-governance/) 18

Related

## Related practice areas

[**Cyber crime & IT Act matters**UPI and investment fraud, account freeze and lien, sextortion and deepfakes, takedowns, bail and quash, for complainants and the accused.](https://advaslam.com/practice/cyber-crime/) [**Business, banking & IPR**Contracts and company matters, cheque-bounce and MSME recovery, SARFAESI objections, trademarks, patents and copyright, arbitration and tax.](https://advaslam.com/practice/business-banking-ipr/) [**Legal drafting & documents**Legal notices and replies, agreements, pleadings, bail and quash petitions, affidavits and opinions, drafted remotely in Word and PDF.](https://advaslam.com/practice/drafting/)

About the advocate: [Adv. K J Muhammed Aslam](https://advaslam.com/profile/), enrolled with the Bar Council of Kerala; office at High Court Junction, Ernakulam.

General information, not legal advice.

Contact

[WhatsApp](https://wa.me/919497240215?text=Hello%2C%20I%20found%20advaslam.com%20and%20would%20like%20to%20discuss%20a%20matter.) [contact@advaslam.com](mailto:contact@advaslam.com) [+91 94972 40215](tel:+919497240215)

3rd Floor, Lalan Towers (KGL Builders), Vanchi Square, High Court Junction, Ernakulam, Kerala 682031 · Monday – Saturday, 10:00 – 18:30 (by appointment)

```json
{"@context":"https://schema.org","@graph":[{"@type":"WebSite","@id":"https://advaslam.com/#website","url":"https://advaslam.com","name":"Adv. K J Muhammed Aslam","alternateName":"advaslam.com","publisher":{"@id":"https://advaslam.com/#person"},"inLanguage":"en-IN"},{"@type":"Person","@id":"https://advaslam.com/#person","name":"K J Muhammed Aslam","alternateName":["Adv. K J Muhammed Aslam","Advocate K J Muhammed Aslam","Muhammed Aslam K J","Adv. Aslam"],"honorificPrefix":"Adv.","jobTitle":"Advocate","description":"Advocate enrolled with the Bar Council of Kerala, practising from High Court Junction, Ernakulam: cyber and technology law, data protection (DPDP), business, banking and IPR, and litigation before the High Court of Kerala and the courts at Ernakulam.","url":"https://advaslam.com/profile/","image":"https://advaslam.com/og.png","telephone":"+919497240215","email":"contact@advaslam.com","address":{"@type":"PostalAddress","streetAddress":"3rd Floor, Lalan Towers (KGL Builders), Vanchi Square, High Court Junction","addressLocality":"Ernakulam","addressRegion":"Kerala","postalCode":"682031","addressCountry":"IN"},"alumniOf":{"@type":"CollegeOrUniversity","name":"Bharata Mata School of Legal Studies"},"memberOf":[{"@type":"Organization","name":"Bar Council of Kerala","url":"https://barcouncilkerala.org/lawyer-registry-list"},{"@type":"Organization","name":"Kerala High Court Advocates' Association","url":"https://khcaa.com/"}],"identifier":[{"@type":"PropertyValue","propertyID":"Bar Council of Kerala Enrolment No.","value":"K/001823/2026"},{"@type":"PropertyValue","propertyID":"KHCAA Membership No.","value":"OAJ 358"}],"knowsAbout":["Information Technology Act 2000","Cyber crime law","Technology law and technology contracts","Digital Personal Data Protection Act 2023","DPDP compliance","Data protection and privacy law","Business and commercial law","Contract drafting and negotiation","Banking and finance law","Negotiable Instruments Act cheque dishonour","SARFAESI Act","Intellectual property law","Copyright and trademark law","Patent infringement","GST and income-tax law","Blockchain and cryptocurrency technology","Web3 wallets and NFTs","Drone regulation and DigitalSky framework","Writ petitions under Article 226","Criminal law","Civil and consumer litigation","Family and succession law","Service and labour law","Legal drafting","Mediation and dispute resolution"],"knowsLanguage":["en","ml"],"workLocation":{"@id":"https://advaslam.com/#practice"},"hasCredential":[{"@type":"EducationalOccupationalCredential","credentialCategory":"Enrolment as an advocate","identifier":"K/001823/2026","recognizedBy":{"@type":"Organization","name":"Bar Council of Kerala"},"description":"Enrolled as an advocate with the Bar Council of Kerala (K/001823/2026), 2026"},{"@type":"EducationalOccupationalCredential","credentialCategory":"degree","educationalLevel":"Bachelor","recognizedBy":{"@type":"CollegeOrUniversity","name":"Bharata Mata School of Legal Studies"},"description":"BBA LLB (Hons.), Bharata Mata School of Legal Studies (2025)"},{"@type":"EducationalOccupationalCredential","credentialCategory":"Remote Pilot Certificate","recognizedBy":{"@type":"Organization","name":"Directorate General of Civil Aviation, India"},"description":"DGCA Remote Pilot Certificate, issued 2022"}],"subjectOf":[{"@type":"CreativeWork","name":"Govind Babu v. State of Kerala (Crl.M.C. No. 5640 of 2026, 2026:KER:69496)","url":"https://indiankanoon.org/doc/151180872/","datePublished":"2026-09-10","publisher":{"@type":"Organization","name":"High Court of Kerala"}},{"@type":"CreativeWork","name":"Viji Sagar v. State of Kerala (Crl.M.C. No. 1603 of 2026, 2026:KER:20803)","url":"https://indiankanoon.org/doc/193042273/","datePublished":"2026-03-09","publisher":{"@type":"Organization","name":"High Court of Kerala"}},{"@type":"CreativeWork","name":"Anjana v. Manoharan A.P. (C.R.P. No. 442 of 2025, 2026:KER:10054)","url":"https://indiankanoon.org/doc/68585852/","datePublished":"2026-02-05","publisher":{"@type":"Organization","name":"High Court of Kerala"}}],"sameAs":["https://www.linkedin.com/in/azlubro","https://portal.khcaa.com/advocate?id=10480","https://lexosys.com"]},{"@type":"LegalService","@id":"https://advaslam.com/#practice","name":"Adv. K J Muhammed Aslam — Advocate, Ernakulam","url":"https://advaslam.com","image":"https://advaslam.com/og.png","telephone":"+919497240215","email":"contact@advaslam.com","address":{"@type":"PostalAddress","streetAddress":"3rd Floor, Lalan Towers (KGL Builders), Vanchi Square, High Court Junction","addressLocality":"Ernakulam","addressRegion":"Kerala","postalCode":"682031","addressCountry":"IN"},"geo":{"@type":"GeoCoordinates","latitude":9.9889,"longitude":76.2748},"hasMap":"https://www.google.com/maps/search/?api=1&query=Lalan+Towers+High+Court+Junction+Ernakulam","areaServed":[{"@type":"City","name":"Ernakulam"},{"@type":"City","name":"Kochi"},{"@type":"State","name":"Kerala"},{"@type":"Country","name":"India"}],"openingHoursSpecification":{"@type":"OpeningHoursSpecification","dayOfWeek":["Monday","Tuesday","Wednesday","Thursday","Friday","Saturday"],"opens":"10:00","closes":"18:30"},"founder":{"@id":"https://advaslam.com/#person"},"knowsAbout":["Cyber crime and IT Act matters","Data protection and DPDP Act compliance","Business, banking, intellectual property and tax","Legal drafting","Criminal law: bail, quash and appeals","Writ petitions before the High Court of Kerala","Civil, property and consumer matters","Family and succession matters","Service and labour matters"]},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://advaslam.com/"},{"@type":"ListItem","position":2,"name":"Practice","item":"https://advaslam.com/practice/"},{"@type":"ListItem","position":3,"name":"Data protection & DPDP compliance","item":"https://advaslam.com/practice/data-protection/"}]},{"@type":"Service","@id":"https://advaslam.com/practice/data-protection/#service","name":"Data protection & DPDP compliance","serviceType":"Data protection & DPDP compliance","description":"DPDP Act 2023 and Rules 2025 for Kerala businesses from Ernakulam: notices, consent, breach response, vendor contracts, Board complaints. Information only.","url":"https://advaslam.com/practice/data-protection/","keywords":"DPDP Act compliance Kerala, DPDP Rules 2025, data breach 72 hours DPDP, DPDP consent notice, data processing agreement India, Data Protection Board complaint","provider":{"@id":"https://advaslam.com/#practice"},"areaServed":[{"@type":"City","name":"Ernakulam"},{"@type":"State","name":"Kerala"}]},{"@type":"WebPage","@id":"https://advaslam.com/practice/data-protection/#webpage","url":"https://advaslam.com/practice/data-protection/","name":"DPDP Act Compliance Advocate in Ernakulam, Kerala","description":"DPDP Act 2023 and Rules 2025 for Kerala businesses from Ernakulam: notices, consent, breach response, vendor contracts, Board complaints. Information only.","dateModified":"2026-09-28T00:00:00.000Z","about":{"@id":"https://advaslam.com/practice/data-protection/#service"},"inLanguage":"en-IN"},{"@type":"FAQPage","mainEntity":[{"@type":"Question","name":"Does the DPDP Act apply to a small business?","acceptedAnswer":{"@type":"Answer","text":"Yes, if it processes digital personal data; the Act has no general small-business exemption. Under s.17(3) the Central Government may notify classes of fiduciaries, including startups, that are relieved of certain duties, but only by notification."}},{"@type":"Question","name":"When do DPDP Act obligations actually start?","acceptedAnswer":{"@type":"Answer","text":"In phases. The Board provisions took effect on 13 November 2025 and the Consent Manager rule about a year later; most fiduciary obligations, including notice, consent, security and breach reporting, apply from about 14 May 2027 under G.S.R. 843(E)."}},{"@type":"Question","name":"How fast must a data breach be reported under the DPDP Rules?","acceptedAnswer":{"@type":"Answer","text":"Without delay, to each affected Data Principal and to the Board. Rule 7 also requires a detailed report to the Board within 72 hours of becoming aware of the breach, unless the Board allows a longer period on written request."}},{"@type":"Question","name":"Do we need to appoint a Data Protection Officer?","acceptedAnswer":{"@type":"Answer","text":"Only if notified as a Significant Data Fiduciary under s.10, which requires a Data Protection Officer based in India. Every other fiduciary must still publish the contact of a person who can answer questions about its processing, under s.8(9)."}},{"@type":"Question","name":"Can the Data Protection Board award me compensation?","acceptedAnswer":{"@type":"Answer","text":"No. Board penalties go to the Consolidated Fund of India; a person who suffered loss from a breach needs a separate civil claim, after using the fiduciary's grievance route and, where needed, a Board complaint."}},{"@type":"Question","name":"Is a privacy policy on the website enough for DPDP compliance?","acceptedAnswer":{"@type":"Answer","text":"No. The Act needs working systems: itemised notices, consent that can be withdrawn, security safeguards, breach intimation, retention and erasure, and a grievance process with a published response period of not more than 90 days."}}]}]}
```