K J Muhammed AslamAdvocate · Ernakulam
Contact

DPDP compliance

Applicability, data fiduciaries, notices and consent

18 matters from the DPDP compliance index. Each entry sets out the problem, the law, the forum, the procedure, the documents usually needed and the limitation clock. General information only — verify the current position on your facts before acting.

Contents

Does the DPDP Act apply to your business?

  1. DPDP applicability audit for Kerala business — do we fall under the Act
  2. Digitised offline data — registers, forms and CCTV logs brought online
  3. Foreign website or app serving Kerala customers — extraterritorial reach
  4. Personal or domestic use exclusion — family, household handling
  5. Publicly available data — blogs, self-published posts and statutory disclosures
  6. Startup and notified-class relaxation — s.17(3) tracker

Data fiduciaries and processors

  1. Fiduciary vs Processor — who is answerable when a vendor handles data
  2. Joint fiduciaries — marketplace, franchise and hospital-lab models
  3. Lawful purpose and purpose limitation — s.4 anchor memo

Consent notices and consent management

  1. Section 5 notice drafting — Malayalam + English, item by item
  2. Legacy data transition — s.5(2) notice for pre-Act consent
  3. Consent-flow design — free, specific, informed, unconditional, unambiguous
  4. Consent Manager — single-point consent dashboard
  5. Withdrawal — as easy to leave as to join, and what survives it
  6. Proving notice + consent — s.6(10) burden on the fiduciary

Processing without consent: legitimate uses

  1. Voluntary data (s.7(a)) and employment (s.7(i)) — consent-free but bounded
  2. State, medical-emergency and disaster uses — s.7(b)–(h) map
  3. Section 17(1)(a) — processing to enforce a legal right or claim

Does the DPDP Act apply to your business?

DPDP applicability audit for Kerala business — do we fall under the Act

Shop, clinic, startup, school or trader is unsure whether customer data handling attracts the DPDP Act at all.

What it involvesMapping what data is collected, in what form, and for whom, against s.3.
Relevant lawDPDP Act, ss.2(t)–(u) (personal data, breach), s.3 (applicability); s.17 (exemptions). DPDP Rules, 2025 r.1 (commencement: rr.1, 2, 17–21 on publication; r.4 after one year; rr.3, 5–16, 22–23 after eighteen months).
ForumInternal compliance review; Board (ss.27–28) only if a complaint/breach arises later. No court filing at audit stage.
Procedure & stage1) List data categories. 2) Test each against s.3(a)–(c). 3) Record exemptions claimed with reasons. 4) Fix gaps before the core duties commence in May 2027.
RemedyAudit memo + roadmap (now / before enforcement / ongoing). No penalty or compensation at this stage.
High Court connectionIf the Board later asserts jurisdiction over an exempt activity, writ to Kerala HC under Art.226 on jurisdictional error remains available alongside TDSAT appeal (s.29).
Documents normally requiredData inventory, collection forms, app/website flows, vendor list, prior privacy policy.
LimitationCore duties (ss.3–5, 6(1)–(8) and (10), 7–17, 27 (except 27(1)(d)), 28–34) commence May 2027 (18 months after the 13 Nov 2025 commencement notification); ss.6(9) and 27(1)(d) after one year (Nov 2026). No audit filing deadline in the Act.
We are only a small shop — are we exempt?
No blanket small-business exemption in the Act. Relaxation applies only if the Central Government notifies the business or its class (startups included) under s.17(3), or under s.17(5). Size affects risk, not applicability.

Digitised offline data — registers, forms and CCTV logs brought online

Business keeps paper registers then types them into Excel/Tally/app and assumes the Act covers only "online" collection.

What it involvesWhether s.3(a)(ii) pulls subsequent digitisation into the Act.
Relevant laws.3(a): (i) data collected in digital form; (ii) data collected in non-digital form and digitised subsequently.
ForumCompliance desk; Board if breach/complaint.
Procedure & stageTag every paper-to-digital flow; bring it under the same notice/consent/security discipline as born-digital data.
RemedyBring flow into compliance; retention/deletion schedule (s.8(7)).
High Court connectionKerala HC writ only on jurisdictional or natural-justice grounds; merits go to Board → TDSAT.
Documents normally requiredSample paper forms, Excel/Tally exports, who digitises, storage location.
Limitations.3 and the core duties commence May 2027 (18 months after the 13 Nov 2025 commencement notification).
Paper register never digitised — covered?
On Act text, no: s.3 covers digital personal data. Once digitised, yes.

Foreign website or app serving Kerala customers — extraterritorial reach

Overseas seller, SaaS or edtech with Kerala users claims "we are abroad, Indian law does not apply."

What it involvess.3(b) test — processing outside India in connection with offering goods/services to Data Principals in India.
Relevant laws.3(b); s.16 (cross-border); s.37 (blocking for repeat-penalised fiduciaries offering in India).
ForumBoard (complaint/breach); blocking direction by Central Government on Board reference (s.37).
Procedure & stageData Principal exhausts fiduciary grievance (s.13), then Board complaint (s.27(1)(b)); Board may inquire and penalise (s.33).
RemedyBoard direction/penalty (to Consolidated Fund of India); victim files separate civil suit for damages. Blocking of access in India only after 2+ penalties + hearing (s.37).
High Court connectionKerala-based principal with cause of action in Kerala may seek Art.226 relief in Kerala HC for jurisdictional/procedural illegality; TDSAT appeal otherwise (s.29, 60 days).
Documents normally requiredScreenshots of India targeting (INR pricing, Kerala delivery, ads), terms, privacy notice, order records.
LimitationTDSAT appeal 60 days from receipt of Board order (s.29(2)).

Related: s.16 (transfers); s.37 (blocking).

Can the Board fine a company with no India office?
On Act text it may inquire and penalise; enforcement practically runs through s.37 blocking and civil execution. Take advice on facts.

Personal or domestic use exclusion — family, household handling

Individual stores family contacts, home CCTV, personal diary entries and fears Board action.

What it involvess.3(c)(i) — personal data processed by an individual for personal/domestic purpose is outside the Act.
Relevant laws.3(c)(i); s.15 duties still relevant for rights misuse generally.
ForumNone, if truly domestic. If published/shared beyond household, exclusion is lost.
Procedure & stageKeep use genuinely household; if shared with a business or publicly, re-test under ss.4–8.
RemedyNone needed; informational clarity.
High Court connectionNone ordinarily. If a Board notice wrongly treats domestic use as fiduciary processing, Art.226 writ on jurisdiction is available.
Documents normally requiredBrief note on use context (who processes, for whom, where shared).
LimitationNone.
Home CCTV covering the street — domestic?
Facts matter; once footage is shared with third parties or used beyond household, get advice. Do not assume blanket cover.

Publicly available data — blogs, self-published posts and statutory disclosures

Business scrapes data the person herself put on social media, or data published under a legal duty, and claims consent is unnecessary.

What it involvess.3(c)(ii)(A)–(B) exclusion scope and its limits.
Relevant laws.3(c)(ii) + Illustration (blogger X); ss.4–6 still govern any *further* non-public processing.
ForumBoard on complaint; civil court for defamation/privacy overflow claims (Act is in addition to other laws, s.38).
Procedure & stageProve (a) who made it public and (b) under what obligation, if relying on (B); ring-fence any enrichment or repurposing for fresh s.4–6 analysis.
RemedyExclusion finding if proved; otherwise notice/consent compliance.
High Court connectionOverlap claims (privacy, Art.21) may sustain a Kerala HC writ in exceptional cases; DPDP merits go Board → TDSAT.
Documents normally requiredURL/capture of public posting, proof of who published, any statutory publication duty cited.
LimitationNone.
If it is on Instagram, can we reuse it freely?
No. The exclusion covers that publicly-available data as made public; fresh profiling, aggregation or sensitive reuse needs its own legal basis. Take advice.

Startup and notified-class relaxation — s.17(3) tracker

DPIIT-recognised startup assumes a blanket holiday from notices, retention, SDF and access duties.

What it involvess.17(3): Central Government *may* notify fiduciaries/classes including startups to whom s.5, s.8(3)/(7), ss.10–11 shall not apply; plus s.17(5) time-bound class exemptions (5-year window).
Relevant laws.17(3) Expl. (startup = recognised Pvt Ltd/partnership/LLP) + s.17(5).
ForumWatch MeitY notifications; Board applies only notified relaxations.
Procedure & stageConfirm recognition → check for any s.17(3)/(5) notification covering the business → comply fully unless notified → diary May 2027.
RemedyRelaxation only if and as notified; otherwise full duties.
High Court connectionNotification vires challenges lie to constitutional courts; Kerala HC Art.226 if cause of action in Kerala.
Documents normally requiredDPIIT recognition, notification tracker, compliance baseline.
LimitationNo relaxation without a notification; plan for full duties when ss.5, 8, 10–11 commence May 2027 (18 months after the 13 Nov 2025 commencement notification).
Recognised startup = no DPDP work?
No. Recognition alone grants nothing under s.17(3); a separate Central Government notification is needed.

Data fiduciaries and processors

Fiduciary vs Processor — who is answerable when a vendor handles data

Business says "our IT vendor holds the data, so they are liable" after a leak or complaint.

What it involvesFixing roles under s.2(i)/(k) and the non-delegable duty in s.8(1).
Relevant lawss.2(i), 2(k), 8(1)–(2) (valid contract for processors), 8(5)–(6) (security + breach).
ForumBoard inquiry (ss.27–28); TDSAT appeal (s.29).
Procedure & stageRole memo → s.8(2) written contract → incident ownership matrix → Board-ready evidence file.
RemedyCorrect allocation + contracts; penalty on fiduciary if roles blurred (to Consolidated Fund of India); civil suit separately for inter-party/vendor indemnity and victim loss.
High Court connectionContract/indemnity recovery by suit before competent civil court in Kerala; writ only for Board-process illegality.
Documents normally requiredVendor agreements, access logs, role matrix, sub-processor list.
Limitations.8 duties commence May 2027 (18 months after the 13 Nov 2025 commencement notification).
Can the contract shift DPDP liability to the processor?
No. s.8(1) applies irrespective of any agreement to the contrary. The contract governs inter se recovery, not Board liability.

Joint fiduciaries — marketplace, franchise and hospital-lab models

Two entities jointly decide why and how customer data is used but neither owns compliance.

What it involvess.2(i) ("alone or in conjunction") applied to platform-seller, franchisor-franchisee, hospital-diagnostic splits.
Relevant lawss.2(i), 4, 8(1)–(3) (accuracy where data is shared/used for decisions).
ForumBoard; apportionment fact-specific.
Procedure & stageJoint-controller memo, single-facing notice allocation, accuracy and grievance ownership, s.8(2) processor contracts below each fiduciary.
RemedyClear RACI + notices; penalty risk reduced via mitigation record (s.33(2)(e)).
High Court connectionInter-party disputes by civil suit/arbitration in Kerala per contract; Board merits to TDSAT.
Documents normally requiredCommercial agreements, data-flow diagram, customer-facing notices.
Limitationss.4 and 8 commence May 2027 (18 months after the 13 Nov 2025 commencement notification).
Can we name only one fiduciary in the notice?
The notice must reflect reality; hiding a joint decision-maker weakens s.6(10) proof. Disclose accurately.

Lawful purpose and purpose limitation — s.4 anchor memo

Forms collect "extra fields just in case" for an unstated future use.

What it involvess.4: processing only per Act and for lawful purpose (not expressly forbidden) via consent (4(1)(a)) or legitimate uses (4(1)(b)).
Relevant laws.4; ss.5–7 (how purpose is fixed and evidenced).
ForumDesign review; Board on complaint.
Procedure & stageOne specified purpose per collection → necessity test per field → forbid-list check → mirror in notice + vault.
RemedyPurpose-trim + fresh notice/consent for any expansion.
High Court connectionPurpose-limitation pleaded as the root breach in Board complaints arising from Kerala processing; writ only for process error.
Documents normally requiredPurpose register, field-necessity matrix, notice copies.
Limitations.4 commences May 2027 (18 months after the 13 Nov 2025 commencement notification).
Can we reuse old data for a new AI feature?
Not on the old purpose. New purpose needs a fresh s.5 notice + s.6 consent (or a fitting s.7/17 basis).

Section 5 notice drafting — Malayalam + English, item by item

App/website/form has a bundled "terms + privacy" paragraph that does not state data, purpose, rights or Board-complaint path.

What it involvess.5(1) notice accompanying/preceding consent; s.5(3)/s.6(3) language access; Rules r.3 contents (standalone; clear and plain language; itemised personal data; specified purpose and goods/services/uses; link and means to withdraw consent, exercise rights and complain to the Board).
Relevant lawss.5(1)–(3), 6(3), 6(10) (proof burden); DPDP Rules, 2025 (G.S.R. 846(E), 13 Nov 2025) r.3 on notice contents.
ForumCompliance drafting; Board tests adequacy on complaint.
Procedure & stageDraft standalone notice → state data + specified purpose → withdrawal/rights path → Board-complaint path → DPO/authorised contact → offer English + Eighth Schedule language access (Malayalam in Kerala) → version and log.
RemedyBoard-ready notice + consent record; reduces s.33 exposure via demonstrable compliance.
High Court connectionNotice-validity disputes arising in Kerala feed Board → TDSAT; writ only for process illegality.
Documents normally requiredCurrent terms/policy, data-purpose map, DPO contact, Malayalam translation QA.
LimitationRules notified 13 Nov 2025; s.5 and r.3 commence May 2027 (18 months after the 13 Nov 2025 commencement notification).
Can the notice sit inside long terms?
Rule 3 requires the notice to be presented and understandable independently of any other information, in clear and plain language. Bundling weakens proof under s.6(10).

Withdrawal — as easy to leave as to join, and what survives it

Customer withdraws in-app but marketing emails continue; business fears it must also unwind completed orders.

What it involvess.6(4) ease parity; s.6(5) consequences on principal + prior legality preserved (e-commerce Illustration); s.6(6) cease + cause processors to cease unless otherwise authorised.
Relevant laws.6(4)–(6) + Illustrations (shopping app; telecom bill email); s.8(7) erasure track.
ForumFiduciary grievance (s.13) → Board complaint.
Procedure & stageOne-tap withdrawal → stop + instruct processors → retain only what another law or surviving purpose requires → log.
RemedyComplaint closure; penalty only for post-withdrawal over-processing (to Consolidated Fund of India); victim's loss by civil suit.
High Court connectionCompleted-supply obligations enforced as contract claims in Kerala courts; DPDP stop-duty runs in parallel.
Documents normally requiredWithdrawal button proof, processor instructions, retention justification.
Limitation"Within reasonable time" (s.6(6)) — act without delay; the Rules fix no separate period.
Withdrawal cancels a paid order already shipped?
No. s.6(5) preserves prior legality; the Illustration keeps fulfilment of paid orders while stopping fresh app use.

State, medical-emergency and disaster uses — s.7(b)–(h) map

Hospital, local body or contractor handling health/disaster data is unsure when consent can be skipped.

What it involvespinning the exact s.7(b)–(h) trigger (subsidy/benefit/service; State function; legal disclosure duty; judgment/decree; medical emergency; epidemic/public health; disaster/public order) and the necessity limit — each clause is purpose-bound; no blanket State exemption.
Relevant laws.7(b) (subsidy/benefit/service/certificate/licence/permit, prescribed + Illust. maternity benefits); 7(c) State function/sovereignty; 7(d) disclosure duty; 7(e) judgment/decree compliance; 7(f) medical emergency; 7(g) epidemic/public health; 7(h) disaster/public-order breakdown (Disaster Mgmt Act meaning).
ForumBoard on complaint; writ courts for State-action legality.
Procedure & stagePin the exact clause → document trigger (prescription, emergency, order) → minimise → revert to consent track when emergency ends.
RemedyLawful-basis finding if trigger proved; otherwise consent/notice cure.
High Court connectionKerala HC writs test State-action proportionality (Art.21 privacy, Puttaswamy) alongside DPDP; DPDP penalty merits stay Board → TDSAT.
Documents normally requiredGovernment order/prescription, medical-emergency record, judgment copy, purpose-minimisation note.
LimitationDuration of the triggering purpose only.
Can a private hospital invoke 7(f) for routine files?
No. 7(f)–(h) are emergency-bound. Routine care stays on consent (or contract-read-with-consent) track.

More in this area

Data protection & DPDP compliance: other matters

Every matter in this area, on one page →
Data protection & DPDP compliance: the practice area →

Procedure guides

Contact

WhatsApp[email protected]+91 94972 40215

3rd Floor, Lalan Towers (KGL Builders), Vanchi Square, High Court Junction, Ernakulam, Kerala 682031 · Monday – Saturday, 10:00 – 18:30 (by appointment)

A note before you read on. In keeping with the Bar Council of India Rules, this website provides information about Adv. K J Muhammed Aslam, and general legal information, only to those who seek it of their own accord. It is not an advertisement or solicitation, and nothing here is legal advice. By continuing, you acknowledge you are visiting voluntarily. Full disclaimer.