K J Muhammed AslamAdvocate · Ernakulam
Contact

DPDP compliance

DPDP Act 2023 — Kerala Business Readiness

A working index of the Digital Personal Data Protection Act 2023 and the DPDP Rules 2025 for Kerala businesses — applicability and roles, notices and consent, children’s data, breach response and the 72-hour clock, retention and security safeguards, vendor and processor terms, rights requests, the Board and TDSAT route, e-sign and domain questions, and AI-governance readiness. Rule numbers and statutory dates carry a verify note; confirm the Gazette position before acting. General information only.

90 matters in 5 groups · Data protection & DPDP compliance →

Applicability, data fiduciaries, notices and consent

18 matters

  1. DPDP applicability audit for Kerala business — do we fall under the Act
  2. Digitised offline data — registers, forms and CCTV logs brought online
  3. Foreign website or app serving Kerala customers — extraterritorial reach
  4. Personal or domestic use exclusion — family, household handling
  5. Publicly available data — blogs, self-published posts and statutory disclosures
  6. Fiduciary vs Processor — who is answerable when a vendor handles data
  7. Joint fiduciaries — marketplace, franchise and hospital-lab models
  8. Section 5 notice drafting — Malayalam + English, item by item
  9. Withdrawal — as easy to leave as to join, and what survives it
  10. State, medical-emergency and disaster uses — s.7(b)–(h) map
  11. Startup and notified-class relaxation — s.17(3) tracker
  12. Lawful purpose and purpose limitation — s.4 anchor memo

Rights, children, employees, CCTV and retention

18 matters

  1. DSAR — right to access summary, sharing trail and processing note (s.11)
  2. Correction cascade — wrong phone, address or name across systems and vendors
  3. Erasure — delete me, unless purpose survives or law says keep
  4. Nomination — s.14 nominee for death or incapacity
  5. Section 15 defence — answering false, frivolous or impersonated requests
  6. No tracking, monitoring or targeted ads at children — s.9(3) hard line
  7. Notified child-processing classes and verifiably-safe exemption — s.9(4)/(5) watch
  8. School-vendor pack — student app, bus GPS and fee-portal checklist
  9. HR pack — attendance, payroll and performance data under s.7(i)
  10. Ex-employee data — references, dues and deletion after exit
  11. CCTV SOP — shop, clinic and apartment cameras with people data
  12. Facial recognition on private premises — high-risk memo, default no
  13. Retention schedules — purpose-over means delete, unless law says keep
  14. PMLA/banking 10-year override — when another law beats erasure
  15. Hospital retention — treatment records vs delete-me requests
  16. Grievance-first rule — Board will not hear you before the fiduciary does
  17. Data Principal duties + Rs.10,000 track — the quiet penalty on individuals

Vendors, security, breach and grievances

18 matters

  1. DPA drafting — s.8(2) valid-contract clauses Kerala vendors will sign
  2. Tiering — processor, sub-processor or second fiduciary
  3. Cross-border transfer — s.16 blacklist model and what to write in the DPA
  4. Breach indemnity — who pays when the processor leaks
  5. Reasonable safeguards checklist — s.8(5) without inventing mandates
  6. ISO 27001 mapping — using audit language without overclaiming
  7. Ransomware — when encryption of your own data is a personal data breach
  8. 72-hour + without-delay notices — Board and each affected principal
  9. Breach playbook — contain, assess, notify, submit, document, mitigate
  10. Late notice — delay condonation and mitigation story
  11. Victim push — breach victim's complaint to the Board
  12. Grievance mechanism + officer — s.8(10)/s.13 front door that must work
  13. Grievance SLA — counting the response window without guessing
  14. Law-enforcement sharing shield — s.11(2) replies without tipping off
  15. Accuracy duty — s.8(3) where data decides loans, jobs or admissions
  16. Publish the contact — s.8(9) DPO or answerable person on the website
  17. Processor erasure cascade — stopping the copies after stop

Significant data fiduciaries, the Board, TDSAT, e-sign and domains

18 matters

  1. SDF readiness — will the Government notify us as Significant
  2. DPO appointment — India-based, Board-facing, grievance-owning
  3. DPIA drafting — description, risk, management for SDF processing
  4. Independent data audit — auditor who evaluates SDF compliance
  5. Board complaint drafting — s.27(1)(b) after grievance exhaust
  6. Voluntary undertaking — s.32 corporate-probation strategy
  7. How the Board starts — breach intimation, reference, court direction, suo-motu screen
  8. Mitigation for quantum — s.33(2) seven-factor story
  9. TDSAT appeal — 60 days, sufficient cause, 6-month endeavour
  10. Mediation — s.31 Board-directed settlement track
  11. INDRP + WHOIS — phishing domain using your brand to harvest data
  12. Phishing + blocking — s.37 DPDP vs s.69A IT Act takedown routes
  13. Intermediary clock — reports, acknowledgement and GAC/69A overlay
  14. E-commerce seller + platform — who owns the customer-data breach
  15. Section 37 blocking deep-dive — the 2-penalty gate most blogs skip

AI governance and compliance

18 matters

  1. AI use policy for the office — which tools, which data, who approves
  2. Hallucination SOP — AI output never goes to court or client unverified
  3. Hiring-AI review — DPIA-style check before CV screening tools decide
  4. Shadow IT — personal Gmail, free bots and USB models with customer data
  5. AI vendor contracts — no-train clause for AI SaaS handling your data
  6. AI procurement checklist — DPDP + security before purchase
  7. Prompts and recordings stored — AI retention breach hiding in chat history
  8. Employee data for AI training — s.7(i) does not mean free corpus
  9. Training-data deletion pipeline — honouring s.12/s.8(7) inside ML systems
  10. Deepfake response sprint — first 24 hours for a Kerala victim
  11. Brand deepfake — company director faked for fraud or defamation
  12. School deepfake — minor targeted; child-safety overlay
  13. Voice-clone consent — using a person's voice in AI content
  14. Automated decisions — loan, screening or pricing tools and s.8(3) accuracy
  15. Research datasets — s.17(2)(b) archive/research/statistical path for AI data

Contact

WhatsApp[email protected]+91 94972 40215

3rd Floor, Lalan Towers (KGL Builders), Vanchi Square, High Court Junction, Ernakulam, Kerala 682031 · Monday – Saturday, 10:00 – 18:30 (by appointment)

A note before you read on. In keeping with the Bar Council of India Rules, this website provides information about Adv. K J Muhammed Aslam, and general legal information, only to those who seek it of their own accord. It is not an advertisement or solicitation, and nothing here is legal advice. By continuing, you acknowledge you are visiting voluntarily. Full disclaimer.