--- title: "Applicability, data fiduciaries, notices and consent" description: "Applicability, data fiduciaries, notices and consent: 18 matters, each with the law, forum, procedure, documents and limitation. DPDP applicability audit…" url: "https://advaslam.com/practice/data-protection/matters/applicability-fiduciary-notices-consent/" image: "https://advaslam.com/og.png" --- DPDP compliance # Applicability, data fiduciaries, notices and consent 18 matters from the DPDP compliance index. Each entry sets out the problem, the law, the forum, the procedure, the documents usually needed and the limitation clock. General information only — verify the current position on your facts before acting. **Contents** Does the DPDP Act apply to your business? 1. DPDP applicability audit for Kerala business — do we fall under the Act 2. Digitised offline data — registers, forms and CCTV logs brought online 3. Foreign website or app serving Kerala customers — extraterritorial reach 4. Personal or domestic use exclusion — family, household handling 5. Publicly available data — blogs, self-published posts and statutory disclosures 6. Startup and notified-class relaxation — s.17(3) tracker Data fiduciaries and processors 1. Fiduciary vs Processor — who is answerable when a vendor handles data 2. Joint fiduciaries — marketplace, franchise and hospital-lab models 3. Lawful purpose and purpose limitation — s.4 anchor memo Consent notices and consent management 1. Section 5 notice drafting — Malayalam + English, item by item 2. Legacy data transition — s.5(2) notice for pre-Act consent 3. Consent-flow design — free, specific, informed, unconditional, unambiguous 4. Consent Manager — single-point consent dashboard 5. Withdrawal — as easy to leave as to join, and what survives it 6. Proving notice + consent — s.6(10) burden on the fiduciary Processing without consent: legitimate uses 1. Voluntary data (s.7(a)) and employment (s.7(i)) — consent-free but bounded 2. State, medical-emergency and disaster uses — s.7(b)–(h) map 3. Section 17(1)(a) — processing to enforce a legal right or claim ## Does the DPDP Act apply to your business? ### DPDP applicability audit for Kerala business — do we fall under the Act Shop, clinic, startup, school or trader is unsure whether customer data handling attracts the DPDP Act at all. What it involvesMapping what data is collected, in what form, and for whom, against s.3. Relevant lawDPDP Act, ss.2(t)–(u) (personal data, breach), s.3 (applicability); s.17 (exemptions). DPDP Rules, 2025 r.1 (commencement: rr.1, 2, 17–21 on publication; r.4 after one year; rr.3, 5–16, 22–23 after eighteen months). ForumInternal compliance review; Board (ss.27–28) only if a complaint/breach arises later. No court filing at audit stage. Procedure & stage1) List data categories. 2) Test each against s.3(a)–(c). 3) Record exemptions claimed with reasons. 4) Fix gaps before the core duties commence in May 2027. RemedyAudit memo + roadmap (now / before enforcement / ongoing). No penalty or compensation at this stage. High Court connectionIf the Board later asserts jurisdiction over an exempt activity, writ to Kerala HC under Art.226 on jurisdictional error remains available alongside TDSAT appeal (s.29). Documents normally requiredData inventory, collection forms, app/website flows, vendor list, prior privacy policy. LimitationCore duties (ss.3–5, 6(1)–(8) and (10), 7–17, 27 (except 27(1)(d)), 28–34) commence May 2027 (18 months after the 13 Nov 2025 commencement notification); ss.6(9) and 27(1)(d) after one year (Nov 2026). No audit filing deadline in the Act. **We are only a small shop — are we exempt?** No blanket small-business exemption in the Act. Relaxation applies only if the Central Government notifies the business or its class (startups included) under s.17(3), or under s.17(5). Size affects risk, not applicability. ### Digitised offline data — registers, forms and CCTV logs brought online Business keeps paper registers then types them into Excel/Tally/app and assumes the Act covers only "online" collection. What it involvesWhether s.3(a)(ii) pulls subsequent digitisation into the Act. Relevant laws.3(a): (i) data collected in digital form; (ii) data collected in non-digital form and digitised subsequently. ForumCompliance desk; Board if breach/complaint. Procedure & stageTag every paper-to-digital flow; bring it under the same notice/consent/security discipline as born-digital data. RemedyBring flow into compliance; retention/deletion schedule (s.8(7)). High Court connectionKerala HC writ only on jurisdictional or natural-justice grounds; merits go to Board → TDSAT. Documents normally requiredSample paper forms, Excel/Tally exports, who digitises, storage location. Limitations.3 and the core duties commence May 2027 (18 months after the 13 Nov 2025 commencement notification). **Paper register never digitised — covered?** On Act text, no: s.3 covers digital personal data. Once digitised, yes. ### Foreign website or app serving Kerala customers — extraterritorial reach Overseas seller, SaaS or edtech with Kerala users claims "we are abroad, Indian law does not apply." What it involvess.3(b) test — processing outside India in connection with offering goods/services to Data Principals in India. Relevant laws.3(b); s.16 (cross-border); s.37 (blocking for repeat-penalised fiduciaries offering in India). ForumBoard (complaint/breach); blocking direction by Central Government on Board reference (s.37). Procedure & stageData Principal exhausts fiduciary grievance (s.13), then Board complaint (s.27(1)(b)); Board may inquire and penalise (s.33). RemedyBoard direction/penalty (to Consolidated Fund of India); victim files separate civil suit for damages. Blocking of access in India only after 2+ penalties + hearing (s.37). High Court connectionKerala-based principal with cause of action in Kerala may seek Art.226 relief in Kerala HC for jurisdictional/procedural illegality; TDSAT appeal otherwise (s.29, 60 days). Documents normally requiredScreenshots of India targeting (INR pricing, Kerala delivery, ads), terms, privacy notice, order records. LimitationTDSAT appeal 60 days from receipt of Board order (s.29(2)). **Related:** s.16 (transfers); s.37 (blocking). **Can the Board fine a company with no India office?** On Act text it may inquire and penalise; enforcement practically runs through s.37 blocking and civil execution. Take advice on facts. ### Personal or domestic use exclusion — family, household handling Individual stores family contacts, home CCTV, personal diary entries and fears Board action. What it involvess.3(c)(i) — personal data processed by an individual for personal/domestic purpose is outside the Act. Relevant laws.3(c)(i); s.15 duties still relevant for rights misuse generally. ForumNone, if truly domestic. If published/shared beyond household, exclusion is lost. Procedure & stageKeep use genuinely household; if shared with a business or publicly, re-test under ss.4–8. RemedyNone needed; informational clarity. High Court connectionNone ordinarily. If a Board notice wrongly treats domestic use as fiduciary processing, Art.226 writ on jurisdiction is available. Documents normally requiredBrief note on use context (who processes, for whom, where shared). LimitationNone. **Home CCTV covering the street — domestic?** Facts matter; once footage is shared with third parties or used beyond household, get advice. Do not assume blanket cover. ### Publicly available data — blogs, self-published posts and statutory disclosures Business scrapes data the person herself put on social media, or data published under a legal duty, and claims consent is unnecessary. What it involvess.3(c)(ii)(A)–(B) exclusion scope and its limits. Relevant laws.3(c)(ii) + Illustration (blogger X); ss.4–6 still govern any \*further\* non-public processing. ForumBoard on complaint; civil court for defamation/privacy overflow claims (Act is in addition to other laws, s.38). Procedure & stageProve (a) who made it public and (b) under what obligation, if relying on (B); ring-fence any enrichment or repurposing for fresh s.4–6 analysis. RemedyExclusion finding if proved; otherwise notice/consent compliance. High Court connectionOverlap claims (privacy, Art.21) may sustain a Kerala HC writ in exceptional cases; DPDP merits go Board → TDSAT. Documents normally requiredURL/capture of public posting, proof of who published, any statutory publication duty cited. LimitationNone. **If it is on Instagram, can we reuse it freely?** No. The exclusion covers that publicly-available data as made public; fresh profiling, aggregation or sensitive reuse needs its own legal basis. Take advice. ### Startup and notified-class relaxation — s.17(3) tracker DPIIT-recognised startup assumes a blanket holiday from notices, retention, SDF and access duties. What it involvess.17(3): Central Government \*may\* notify fiduciaries/classes including startups to whom s.5, s.8(3)/(7), ss.10–11 shall not apply; plus s.17(5) time-bound class exemptions (5-year window). Relevant laws.17(3) Expl. (startup = recognised Pvt Ltd/partnership/LLP) + s.17(5). ForumWatch MeitY notifications; Board applies only notified relaxations. Procedure & stageConfirm recognition → check for any s.17(3)/(5) notification covering the business → comply fully unless notified → diary May 2027. RemedyRelaxation only if and as notified; otherwise full duties. High Court connectionNotification vires challenges lie to constitutional courts; Kerala HC Art.226 if cause of action in Kerala. Documents normally requiredDPIIT recognition, notification tracker, compliance baseline. LimitationNo relaxation without a notification; plan for full duties when ss.5, 8, 10–11 commence May 2027 (18 months after the 13 Nov 2025 commencement notification). **Recognised startup = no DPDP work?** No. Recognition alone grants nothing under s.17(3); a separate Central Government notification is needed. ## Data fiduciaries and processors ### Fiduciary vs Processor — who is answerable when a vendor handles data Business says "our IT vendor holds the data, so they are liable" after a leak or complaint. What it involvesFixing roles under s.2(i)/(k) and the non-delegable duty in s.8(1). Relevant lawss.2(i), 2(k), 8(1)–(2) (valid contract for processors), 8(5)–(6) (security + breach). ForumBoard inquiry (ss.27–28); TDSAT appeal (s.29). Procedure & stageRole memo → s.8(2) written contract → incident ownership matrix → Board-ready evidence file. RemedyCorrect allocation + contracts; penalty on fiduciary if roles blurred (to Consolidated Fund of India); civil suit separately for inter-party/vendor indemnity and victim loss. High Court connectionContract/indemnity recovery by suit before competent civil court in Kerala; writ only for Board-process illegality. Documents normally requiredVendor agreements, access logs, role matrix, sub-processor list. Limitations.8 duties commence May 2027 (18 months after the 13 Nov 2025 commencement notification). **Can the contract shift DPDP liability to the processor?** No. s.8(1) applies irrespective of any agreement to the contrary. The contract governs inter se recovery, not Board liability. ### Joint fiduciaries — marketplace, franchise and hospital-lab models Two entities jointly decide why and how customer data is used but neither owns compliance. What it involvess.2(i) ("alone or in conjunction") applied to platform-seller, franchisor-franchisee, hospital-diagnostic splits. Relevant lawss.2(i), 4, 8(1)–(3) (accuracy where data is shared/used for decisions). ForumBoard; apportionment fact-specific. Procedure & stageJoint-controller memo, single-facing notice allocation, accuracy and grievance ownership, s.8(2) processor contracts below each fiduciary. RemedyClear RACI + notices; penalty risk reduced via mitigation record (s.33(2)(e)). High Court connectionInter-party disputes by civil suit/arbitration in Kerala per contract; Board merits to TDSAT. Documents normally requiredCommercial agreements, data-flow diagram, customer-facing notices. Limitationss.4 and 8 commence May 2027 (18 months after the 13 Nov 2025 commencement notification). **Can we name only one fiduciary in the notice?** The notice must reflect reality; hiding a joint decision-maker weakens s.6(10) proof. Disclose accurately. ### Lawful purpose and purpose limitation — s.4 anchor memo Forms collect "extra fields just in case" for an unstated future use. What it involvess.4: processing only per Act and for lawful purpose (not expressly forbidden) via consent (4(1)(a)) or legitimate uses (4(1)(b)). Relevant laws.4; ss.5–7 (how purpose is fixed and evidenced). ForumDesign review; Board on complaint. Procedure & stageOne specified purpose per collection → necessity test per field → forbid-list check → mirror in notice + vault. RemedyPurpose-trim + fresh notice/consent for any expansion. High Court connectionPurpose-limitation pleaded as the root breach in Board complaints arising from Kerala processing; writ only for process error. Documents normally requiredPurpose register, field-necessity matrix, notice copies. Limitations.4 commences May 2027 (18 months after the 13 Nov 2025 commencement notification). **Can we reuse old data for a new AI feature?** Not on the old purpose. New purpose needs a fresh s.5 notice + s.6 consent (or a fitting s.7/17 basis). ## Consent notices and consent management ### Section 5 notice drafting — Malayalam + English, item by item App/website/form has a bundled "terms + privacy" paragraph that does not state data, purpose, rights or Board-complaint path. What it involvess.5(1) notice accompanying/preceding consent; s.5(3)/s.6(3) language access; Rules r.3 contents (standalone; clear and plain language; itemised personal data; specified purpose and goods/services/uses; link and means to withdraw consent, exercise rights and complain to the Board). Relevant lawss.5(1)–(3), 6(3), 6(10) (proof burden); DPDP Rules, 2025 (G.S.R. 846(E), 13 Nov 2025) r.3 on notice contents. ForumCompliance drafting; Board tests adequacy on complaint. Procedure & stageDraft standalone notice → state data + specified purpose → withdrawal/rights path → Board-complaint path → DPO/authorised contact → offer English + Eighth Schedule language access (Malayalam in Kerala) → version and log. RemedyBoard-ready notice + consent record; reduces s.33 exposure via demonstrable compliance. High Court connectionNotice-validity disputes arising in Kerala feed Board → TDSAT; writ only for process illegality. Documents normally requiredCurrent terms/policy, data-purpose map, DPO contact, Malayalam translation QA. LimitationRules notified 13 Nov 2025; s.5 and r.3 commence May 2027 (18 months after the 13 Nov 2025 commencement notification). **Can the notice sit inside long terms?** Rule 3 requires the notice to be presented and understandable independently of any other information, in clear and plain language. Bundling weakens proof under s.6(10). ### Legacy data transition — s.5(2) notice for pre-Act consent Database built before commencement has no s.5 notices; business may continue until withdrawal but must inform "as soon as reasonably practicable." What it involvess.5(2)(a)–(b) one-time information duty + continued processing until withdrawal. Relevant laws.5(2) + Illustration (e-commerce app); ss.6(4)–(6) (withdrawal effects); s.5(2) statutory transition for pre-commencement consent; Rules r.3 sets notice contents (no separate transition rule). ForumCompliance rollout; Board on later complaint. Procedure & stageSegment legacy base → send s.5(2) notice (data + purpose + rights + Board path) by email/in-app/effective method → log delivery/bounce → honour withdrawals promptly. RemedyDeemed compliant continuation unless withdrawn; withdrawal triggers s.6(6)/s.8(7) stop-and-erase track. High Court connectionBulk-messaging legality (UCC/DLT) may independently need TRAI-compliant routing for Kerala recipients. Documents normally requiredLegacy dump inventory, notice copy (EN+ML), delivery logs, withdrawal register. Limitation"As soon as reasonably practicable" after s.5 commences (May 2027, 18 months after the 13 Nov 2025 commencement notification); document effort continuously. **Must we re-take consent from every old customer?** On s.5(2) text, no — give the notice and continue until withdrawal. Fresh consent is needed only for a new/expanded purpose. ### Consent-flow design — free, specific, informed, unconditional, unambiguous Pre-ticked boxes, take-it-or-leave-it bundles (e.g., contacts access for a telemedicine app) and vague "improve services" purposes. What it involvess.6(1) five tests + necessity limit + s.6(2) severance of unlawful parts. Relevant laws.6(1)–(3) + Illustrations (telemedicine contacts; insurance waiver void); s.6(10) proof. ForumBoard on complaint; design review pre-enforcement. Procedure & stageOne purpose per affirmative action → necessity check per data item → plain-language request (EN+ML access, s.6(3)) → DPO contact → timestamped record. RemedyEnforceable consent record; invalid part severed under s.6(2) without killing the lawful remainder. High Court connectionContractual-consent disputes in Kerala civil courts read alongside s.6; DPDP validity itself goes Board → TDSAT. Documents normally requiredScreen flows, consent copy, necessity matrix, consent logs. Limitations.6 consent duties commence May 2027 (18 months after the 13 Nov 2025 commencement notification). **Is 'I agree to all' enough?** No. Consent must be specific to the specified purpose and limited to necessary data (s.6(1)). ### Consent Manager — single-point consent dashboard Business or individual wants to route give/manage/review/withdraw through a Board-registered Consent Manager. What it involvess.6(7)–(9): principal may act via Manager; Manager accountable to principal; registration with Board under prescribed conditions. Relevant laws.6(7)–(9); s.27(1)(c)–(d) (Board inquiry into Manager breaches); Rules r.4 + First Schedule (Part A registration conditions, incl. Indian company and net worth not less than Rs.2 crore; Part B obligations). ForumBoard (registration + breach inquiry); TDSAT appeal. Procedure & stageWatch registration framework (r.4 in force Nov 2026) → evaluate Manager's conflict/technical fit → integrate interoperable flow → keep fiduciary-side records regardless. Remedyclean withdrawal/proof trail; Manager breach actionable before Board (penalty to Consolidated Fund of India). High Court connectionKerala users' Manager disputes follow Board → TDSAT; writ only for jurisdictional/procedural error. Documents normally requiredManager registration proof, integration spec, consent-receipt logs. LimitationRule 4 comes into force one year after publication of the Rules (13 Nov 2025 notification), i.e. Nov 2026; s.6(9) and s.27(1)(d) commence on the same one-year date. **Does using a Consent Manager absolve the fiduciary?** No. The fiduciary still owns ss.4–8 compliance and s.6(10) proof. ### Withdrawal — as easy to leave as to join, and what survives it Customer withdraws in-app but marketing emails continue; business fears it must also unwind completed orders. What it involvess.6(4) ease parity; s.6(5) consequences on principal + prior legality preserved (e-commerce Illustration); s.6(6) cease + cause processors to cease unless otherwise authorised. Relevant laws.6(4)–(6) + Illustrations (shopping app; telecom bill email); s.8(7) erasure track. ForumFiduciary grievance (s.13) → Board complaint. Procedure & stageOne-tap withdrawal → stop + instruct processors → retain only what another law or surviving purpose requires → log. RemedyComplaint closure; penalty only for post-withdrawal over-processing (to Consolidated Fund of India); victim's loss by civil suit. High Court connectionCompleted-supply obligations enforced as contract claims in Kerala courts; DPDP stop-duty runs in parallel. Documents normally requiredWithdrawal button proof, processor instructions, retention justification. Limitation"Within reasonable time" (s.6(6)) — act without delay; the Rules fix no separate period. **Withdrawal cancels a paid order already shipped?** No. s.6(5) preserves prior legality; the Illustration keeps fulfilment of paid orders while stopping fresh app use. ### Proving notice + consent — s.6(10) burden on the fiduciary Complaint alleges no notice/no consent; business has only oral claims or scattered screenshots. What it involvesIn any proceeding where consent is the basis, fiduciary must prove notice + consent per Act/Rules. Relevant laws.6(10); ss.5–6; s.28(7) Board civil-court powers (summons, affidavits, documents). ForumBoard inquiry; TDSAT on appeal. Procedure & stageMaintain consent vault: notice version + language served, timestamp, affirmative action, purpose-data map, withdrawal log; produce on inquiry. RemedyProceedings closed if proof holds; adverse inference + penalty track if not (to Consolidated Fund of India). High Court connectionKerala HC writ will not re-weigh consent evidence; it tests only legality/fairness of Board process. Keep the vault trial-ready. Documents normally requiredConsent vault exports, version history, delivery/read logs. LimitationContinuous; produce within Board-directed time in inquiry. **Are server logs enough?** They help if they tie notice version + purpose + affirmative action + identity together. Fragmented logs usually fail. ## Processing without consent: legitimate uses ### Voluntary data (s.7(a)) and employment (s.7(i)) — consent-free but bounded Pharmacy receipt on SMS, broker enquiry, and routine HR processing are pushed through heavy consent flows or, conversely, treated as unlimited. What it involvess.7(a) (voluntarily provided data for specified purpose, no opt-out indicated; Illustrations: pharmacy, broker) and s.7(i) (employment / safeguarding employer — espionage, trade secrets, benefits). Relevant laws.7(a), 7(i); s.4 (lawful purpose); s.8(1)/(5) still apply except where s.17 lifts Chapters. ForumBoard on overreach complaint. Procedure & stageRecord voluntariness + specified purpose → stop when principal signals stop (broker Illustration) → for HR, necessity + confidentiality memo. RemedyLawful non-consent basis if bounded; consent track if purpose expands. High Court connectionEmployment disputes in Kerala labour fora/courts run alongside; DPDP basis pleaded as s.7(i) with HR records. Documents normally requiredMessage/request copy, purpose note, HR policy excerpt, stop-signal log. LimitationNone in Act; cease promptly on opt-out signal. **HR needs no consent ever?** No. s.7(i) covers employment-linked necessity; fresh purposes (e.g., marketing to staff) need s.6 consent. ### State, medical-emergency and disaster uses — s.7(b)–(h) map Hospital, local body or contractor handling health/disaster data is unsure when consent can be skipped. What it involvespinning the exact s.7(b)–(h) trigger (subsidy/benefit/service; State function; legal disclosure duty; judgment/decree; medical emergency; epidemic/public health; disaster/public order) and the necessity limit — each clause is purpose-bound; no blanket State exemption. Relevant laws.7(b) (subsidy/benefit/service/certificate/licence/permit, prescribed + Illust. maternity benefits); 7(c) State function/sovereignty; 7(d) disclosure duty; 7(e) judgment/decree compliance; 7(f) medical emergency; 7(g) epidemic/public health; 7(h) disaster/public-order breakdown (Disaster Mgmt Act meaning). ForumBoard on complaint; writ courts for State-action legality. Procedure & stagePin the exact clause → document trigger (prescription, emergency, order) → minimise → revert to consent track when emergency ends. RemedyLawful-basis finding if trigger proved; otherwise consent/notice cure. High Court connectionKerala HC writs test State-action proportionality (Art.21 privacy, Puttaswamy) alongside DPDP; DPDP penalty merits stay Board → TDSAT. Documents normally requiredGovernment order/prescription, medical-emergency record, judgment copy, purpose-minimisation note. LimitationDuration of the triggering purpose only. **Can a private hospital invoke 7(f) for routine files?** No. 7(f)–(h) are emergency-bound. Routine care stays on consent (or contract-read-with-consent) track. ### Section 17(1)(a) — processing to enforce a legal right or claim Lawyer, bank or business needs to use personal data to file, defend or enforce a claim and fears consent withdrawal blocks the case file. What it involvesExemption from Ch.II (except s.8(1)/(5)), Ch.III and s.16 where processing is \*necessary\* for enforcing a legal right/claim. Relevant laws.17(1)(a); s.17 illustration scheme; s.8(1)/(5) still apply; s.38 (other laws continue). ForumCourt/tribunal where the underlying claim lies; Board if a DPDP complaint alleges over-collection. Procedure & stageNecessity memo (claim → data → why needed) → minimise → retain litigation hold → cite s.17(1)(a) in Board reply with court papers. RemedyExemption recognised to the extent necessary; excess processing stays actionable. High Court connectionKerala HC as the forum for the underlying suit/writ itself; DPDP exemption pleaded there and, if needed, before the Board. Documents normally requiredPleadings, notices, data-necessity note, retention hold instruction. LimitationLimitation of the underlying claim (per that statute), not DPDP. **Related:** s.17(1)(b). **Does 17(1)(a) allow keeping all customer data 'for legal safety'?** No. Only what is necessary for the specific right/claim. Blanket hoarding is not covered. More in this area ## Data protection & DPDP compliance: other matters - Applicability, data fiduciaries, notices and consent - [Rights, children, employees, CCTV and retention](https://advaslam.com/practice/data-protection/matters/rights-children-employee-cctv-retention/) - [Vendors, security, breach and grievances](https://advaslam.com/practice/data-protection/matters/vendor-security-breach-grievance/) - [Significant data fiduciaries, the Board, TDSAT, e-sign and domains](https://advaslam.com/practice/data-protection/matters/sdf-board-tdsat-esign-domain/) - [AI governance and compliance](https://advaslam.com/practice/data-protection/matters/ai-governance/) [Every matter in this area, on one page →](https://advaslam.com/practice/data-protection/matters/) [Data protection & DPDP compliance: the practice area →](https://advaslam.com/practice/data-protection/) Procedure guides - [DPDP Readiness Checklist for Small Business](https://advaslam.com/guides/dpdp-readiness-checklist-small-business/) Contact [WhatsApp](https://wa.me/919497240215?text=Hello%2C%20I%20found%20advaslam.com%20and%20would%20like%20to%20discuss%20a%20matter.) [contact@advaslam.com](mailto:contact@advaslam.com) [+91 94972 40215](tel:+919497240215) 3rd Floor, Lalan Towers (KGL Builders), Vanchi Square, High Court Junction, Ernakulam, Kerala 682031 · Monday – Saturday, 10:00 – 18:30 (by appointment) ```json {"@context":"https://schema.org","@graph":[{"@type":"WebSite","@id":"https://advaslam.com/#website","url":"https://advaslam.com","name":"Adv. K J Muhammed Aslam","alternateName":"advaslam.com","publisher":{"@id":"https://advaslam.com/#person"},"inLanguage":"en-IN"},{"@type":"Person","@id":"https://advaslam.com/#person","name":"K J Muhammed Aslam","alternateName":["Adv. K J Muhammed Aslam","Advocate K J Muhammed Aslam","Muhammed Aslam K J","Adv. Aslam"],"honorificPrefix":"Adv.","jobTitle":"Advocate","description":"Advocate enrolled with the Bar Council of Kerala, practising from High Court Junction, Ernakulam: cyber and technology law, data protection (DPDP), business, banking and IPR, and litigation before the High Court of Kerala and the courts at Ernakulam.","url":"https://advaslam.com/profile/","image":"https://advaslam.com/og.png","telephone":"+919497240215","email":"contact@advaslam.com","address":{"@type":"PostalAddress","streetAddress":"3rd Floor, Lalan Towers (KGL Builders), Vanchi Square, High Court Junction","addressLocality":"Ernakulam","addressRegion":"Kerala","postalCode":"682031","addressCountry":"IN"},"alumniOf":{"@type":"CollegeOrUniversity","name":"Bharata Mata School of Legal Studies"},"memberOf":[{"@type":"Organization","name":"Bar Council of Kerala","url":"https://barcouncilkerala.org/lawyer-registry-list"},{"@type":"Organization","name":"Kerala High Court Advocates' Association","url":"https://khcaa.com/"}],"identifier":[{"@type":"PropertyValue","propertyID":"Bar Council of Kerala Enrolment No.","value":"K/001823/2026"},{"@type":"PropertyValue","propertyID":"KHCAA Membership No.","value":"OAJ 358"}],"knowsAbout":["Information Technology Act 2000","Cyber crime law","Technology law and technology contracts","Digital Personal Data Protection Act 2023","DPDP compliance","Data protection and privacy law","Business and commercial law","Contract drafting and negotiation","Banking and finance law","Negotiable Instruments Act cheque dishonour","SARFAESI Act","Intellectual property law","Copyright and trademark law","Patent infringement","GST and income-tax law","Blockchain and cryptocurrency technology","Web3 wallets and NFTs","Drone regulation and DigitalSky framework","Writ petitions under Article 226","Criminal law","Civil and consumer litigation","Family and succession law","Service and labour law","Legal drafting","Mediation and dispute resolution"],"knowsLanguage":["en","ml"],"workLocation":{"@id":"https://advaslam.com/#practice"},"hasCredential":[{"@type":"EducationalOccupationalCredential","credentialCategory":"Enrolment as an advocate","identifier":"K/001823/2026","recognizedBy":{"@type":"Organization","name":"Bar Council of Kerala"},"description":"Enrolled as an advocate with the Bar Council of Kerala (K/001823/2026), 2026"},{"@type":"EducationalOccupationalCredential","credentialCategory":"degree","educationalLevel":"Bachelor","recognizedBy":{"@type":"CollegeOrUniversity","name":"Bharata Mata School of Legal Studies"},"description":"BBA LLB (Hons.), Bharata Mata School of Legal Studies (2025)"},{"@type":"EducationalOccupationalCredential","credentialCategory":"Remote Pilot Certificate","recognizedBy":{"@type":"Organization","name":"Directorate General of Civil Aviation, India"},"description":"DGCA Remote Pilot Certificate, issued 2022"}],"subjectOf":[{"@type":"CreativeWork","name":"Govind Babu v. State of Kerala (Crl.M.C. No. 5640 of 2026, 2026:KER:69496)","url":"https://indiankanoon.org/doc/151180872/","datePublished":"2026-09-10","publisher":{"@type":"Organization","name":"High Court of Kerala"}},{"@type":"CreativeWork","name":"Viji Sagar v. State of Kerala (Crl.M.C. No. 1603 of 2026, 2026:KER:20803)","url":"https://indiankanoon.org/doc/193042273/","datePublished":"2026-03-09","publisher":{"@type":"Organization","name":"High Court of Kerala"}},{"@type":"CreativeWork","name":"Anjana v. Manoharan A.P. (C.R.P. No. 442 of 2025, 2026:KER:10054)","url":"https://indiankanoon.org/doc/68585852/","datePublished":"2026-02-05","publisher":{"@type":"Organization","name":"High Court of Kerala"}}],"sameAs":["https://www.linkedin.com/in/azlubro","https://portal.khcaa.com/advocate?id=10480","https://lexosys.com"]},{"@type":"LegalService","@id":"https://advaslam.com/#practice","name":"Adv. K J Muhammed Aslam — Advocate, Ernakulam","url":"https://advaslam.com","image":"https://advaslam.com/og.png","telephone":"+919497240215","email":"contact@advaslam.com","address":{"@type":"PostalAddress","streetAddress":"3rd Floor, Lalan Towers (KGL Builders), Vanchi Square, High Court Junction","addressLocality":"Ernakulam","addressRegion":"Kerala","postalCode":"682031","addressCountry":"IN"},"geo":{"@type":"GeoCoordinates","latitude":9.9889,"longitude":76.2748},"hasMap":"https://www.google.com/maps/search/?api=1&query=Lalan+Towers+High+Court+Junction+Ernakulam","areaServed":[{"@type":"City","name":"Ernakulam"},{"@type":"City","name":"Kochi"},{"@type":"State","name":"Kerala"},{"@type":"Country","name":"India"}],"openingHoursSpecification":{"@type":"OpeningHoursSpecification","dayOfWeek":["Monday","Tuesday","Wednesday","Thursday","Friday","Saturday"],"opens":"10:00","closes":"18:30"},"founder":{"@id":"https://advaslam.com/#person"},"knowsAbout":["Cyber crime and IT Act matters","Data protection and DPDP Act compliance","Business, banking, intellectual property and tax","Legal drafting","Criminal law: bail, quash and appeals","Writ petitions before the High Court of Kerala","Civil, property and consumer matters","Family and succession matters","Service and labour matters"]},{"@type":"CollectionPage","name":"Applicability, data fiduciaries, notices and consent","description":"Applicability, data fiduciaries, notices and consent: 18 matters, each with the law, forum, procedure, documents and limitation. DPDP applicability audit…","url":"https://advaslam.com/practice/data-protection/matters/applicability-fiduciary-notices-consent/","inLanguage":"en-IN","dateModified":"2026-09-28T00:00:00.000Z","isPartOf":{"@id":"https://advaslam.com/#website"},"author":{"@id":"https://advaslam.com/#person"},"mainEntity":{"@type":"ItemList","numberOfItems":18,"itemListElement":[{"@type":"ListItem","position":1,"name":"DPDP applicability audit for Kerala business — do we fall under the Act","url":"https://advaslam.com/practice/data-protection/matters/applicability-fiduciary-notices-consent/#dpdp-applicability-audit-for-kerala-business-do-we-fall-under-the-act"},{"@type":"ListItem","position":2,"name":"Digitised offline data — registers, forms and CCTV logs brought online","url":"https://advaslam.com/practice/data-protection/matters/applicability-fiduciary-notices-consent/#digitised-offline-data-registers-forms-and-cctv-logs-brought-online"},{"@type":"ListItem","position":3,"name":"Foreign website or app serving Kerala customers — extraterritorial reach","url":"https://advaslam.com/practice/data-protection/matters/applicability-fiduciary-notices-consent/#foreign-website-or-app-serving-kerala-customers-extraterritorial-reach"},{"@type":"ListItem","position":4,"name":"Personal or domestic use exclusion — family, household handling","url":"https://advaslam.com/practice/data-protection/matters/applicability-fiduciary-notices-consent/#personal-or-domestic-use-exclusion-family-household-handling"},{"@type":"ListItem","position":5,"name":"Publicly available data — blogs, self-published posts and statutory disclosures","url":"https://advaslam.com/practice/data-protection/matters/applicability-fiduciary-notices-consent/#publicly-available-data-blogs-self-published-posts-and-statutory-disclosures"},{"@type":"ListItem","position":6,"name":"Fiduciary vs Processor — who is answerable when a vendor handles data","url":"https://advaslam.com/practice/data-protection/matters/applicability-fiduciary-notices-consent/#fiduciary-vs-processor-who-is-answerable-when-a-vendor-handles-data"},{"@type":"ListItem","position":7,"name":"Joint fiduciaries — marketplace, franchise and hospital-lab models","url":"https://advaslam.com/practice/data-protection/matters/applicability-fiduciary-notices-consent/#joint-fiduciaries-marketplace-franchise-and-hospital-lab-models"},{"@type":"ListItem","position":8,"name":"Section 17(1)(a) — processing to enforce a legal right or claim","url":"https://advaslam.com/practice/data-protection/matters/applicability-fiduciary-notices-consent/#section-171a-processing-to-enforce-a-legal-right-or-claim"},{"@type":"ListItem","position":9,"name":"Section 5 notice drafting — Malayalam + English, item by item","url":"https://advaslam.com/practice/data-protection/matters/applicability-fiduciary-notices-consent/#section-5-notice-drafting-malayalam-english-item-by-item"},{"@type":"ListItem","position":10,"name":"Legacy data transition — s.5(2) notice for pre-Act consent","url":"https://advaslam.com/practice/data-protection/matters/applicability-fiduciary-notices-consent/#legacy-data-transition-s52-notice-for-pre-act-consent"},{"@type":"ListItem","position":11,"name":"Consent-flow design — free, specific, informed, unconditional, unambiguous","url":"https://advaslam.com/practice/data-protection/matters/applicability-fiduciary-notices-consent/#consent-flow-design-free-specific-informed-unconditional-unambiguous"},{"@type":"ListItem","position":12,"name":"Consent Manager — single-point consent dashboard","url":"https://advaslam.com/practice/data-protection/matters/applicability-fiduciary-notices-consent/#consent-manager-single-point-consent-dashboard"},{"@type":"ListItem","position":13,"name":"Withdrawal — as easy to leave as to join, and what survives it","url":"https://advaslam.com/practice/data-protection/matters/applicability-fiduciary-notices-consent/#withdrawal-as-easy-to-leave-as-to-join-and-what-survives-it"},{"@type":"ListItem","position":14,"name":"Proving notice + consent — s.6(10) burden on the fiduciary","url":"https://advaslam.com/practice/data-protection/matters/applicability-fiduciary-notices-consent/#proving-notice-consent-s610-burden-on-the-fiduciary"},{"@type":"ListItem","position":15,"name":"Voluntary data (s.7(a)) and employment (s.7(i)) — consent-free but bounded","url":"https://advaslam.com/practice/data-protection/matters/applicability-fiduciary-notices-consent/#voluntary-data-s7a-and-employment-s7i-consent-free-but-bounded"},{"@type":"ListItem","position":16,"name":"State, medical-emergency and disaster uses — s.7(b)–(h) map","url":"https://advaslam.com/practice/data-protection/matters/applicability-fiduciary-notices-consent/#state-medical-emergency-and-disaster-uses-s7bh-map"},{"@type":"ListItem","position":17,"name":"Startup and notified-class relaxation — s.17(3) tracker","url":"https://advaslam.com/practice/data-protection/matters/applicability-fiduciary-notices-consent/#startup-and-notified-class-relaxation-s173-tracker"},{"@type":"ListItem","position":18,"name":"Lawful purpose and purpose limitation — s.4 anchor memo","url":"https://advaslam.com/practice/data-protection/matters/applicability-fiduciary-notices-consent/#lawful-purpose-and-purpose-limitation-s4-anchor-memo"}]}},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://advaslam.com/"},{"@type":"ListItem","position":2,"name":"Practice","item":"https://advaslam.com/practice/"},{"@type":"ListItem","position":3,"name":"Data protection & DPDP compliance","item":"https://advaslam.com/practice/data-protection/"},{"@type":"ListItem","position":4,"name":"Matters","item":"https://advaslam.com/practice/data-protection/matters/"},{"@type":"ListItem","position":5,"name":"Applicability, data fiduciaries, notices and consent","item":"https://advaslam.com/practice/data-protection/matters/applicability-fiduciary-notices-consent/"}]},{"@type":"FAQPage","@id":"https://advaslam.com/practice/data-protection/matters/applicability-fiduciary-notices-consent/#faq","isPartOf":{"@id":"https://advaslam.com/#website"},"mainEntity":[{"@type":"Question","name":"We are only a small shop — are we exempt?","acceptedAnswer":{"@type":"Answer","text":"No blanket small-business exemption in the Act. Relaxation applies only if the Central Government notifies the business or its class (startups included) under s.17(3), or under s.17(5). Size affects risk, not applicability."}},{"@type":"Question","name":"Paper register never digitised — covered?","acceptedAnswer":{"@type":"Answer","text":"On Act text, no: s.3 covers digital personal data. Once digitised, yes."}},{"@type":"Question","name":"Can the Board fine a company with no India office?","acceptedAnswer":{"@type":"Answer","text":"On Act text it may inquire and penalise; enforcement practically runs through s.37 blocking and civil execution. Take advice on facts."}},{"@type":"Question","name":"Home CCTV covering the street — domestic?","acceptedAnswer":{"@type":"Answer","text":"Facts matter; once footage is shared with third parties or used beyond household, get advice. Do not assume blanket cover."}},{"@type":"Question","name":"If it is on Instagram, can we reuse it freely?","acceptedAnswer":{"@type":"Answer","text":"No. The exclusion covers that publicly-available data as made public; fresh profiling, aggregation or sensitive reuse needs its own legal basis. Take advice."}},{"@type":"Question","name":"Can the contract shift DPDP liability to the processor?","acceptedAnswer":{"@type":"Answer","text":"No. s.8(1) applies irrespective of any agreement to the contrary. The contract governs inter se recovery, not Board liability."}},{"@type":"Question","name":"Can we name only one fiduciary in the notice?","acceptedAnswer":{"@type":"Answer","text":"The notice must reflect reality; hiding a joint decision-maker weakens s.6(10) proof. Disclose accurately."}},{"@type":"Question","name":"Does 17(1)(a) allow keeping all customer data 'for legal safety'?","acceptedAnswer":{"@type":"Answer","text":"No. Only what is necessary for the specific right/claim. Blanket hoarding is not covered."}},{"@type":"Question","name":"Can the notice sit inside long terms?","acceptedAnswer":{"@type":"Answer","text":"Rule 3 requires the notice to be presented and understandable independently of any other information, in clear and plain language. Bundling weakens proof under s.6(10)."}},{"@type":"Question","name":"Must we re-take consent from every old customer?","acceptedAnswer":{"@type":"Answer","text":"On s.5(2) text, no — give the notice and continue until withdrawal. Fresh consent is needed only for a new/expanded purpose."}},{"@type":"Question","name":"Is 'I agree to all' enough?","acceptedAnswer":{"@type":"Answer","text":"No. Consent must be specific to the specified purpose and limited to necessary data (s.6(1))."}},{"@type":"Question","name":"Does using a Consent Manager absolve the fiduciary?","acceptedAnswer":{"@type":"Answer","text":"No. The fiduciary still owns ss.4–8 compliance and s.6(10) proof."}},{"@type":"Question","name":"Withdrawal cancels a paid order already shipped?","acceptedAnswer":{"@type":"Answer","text":"No. s.6(5) preserves prior legality; the Illustration keeps fulfilment of paid orders while stopping fresh app use."}},{"@type":"Question","name":"Are server logs enough?","acceptedAnswer":{"@type":"Answer","text":"They help if they tie notice version + purpose + affirmative action + identity together. Fragmented logs usually fail."}},{"@type":"Question","name":"HR needs no consent ever?","acceptedAnswer":{"@type":"Answer","text":"No. s.7(i) covers employment-linked necessity; fresh purposes (e.g., marketing to staff) need s.6 consent."}},{"@type":"Question","name":"Can a private hospital invoke 7(f) for routine files?","acceptedAnswer":{"@type":"Answer","text":"No. 7(f)–(h) are emergency-bound. Routine care stays on consent (or contract-read-with-consent) track."}},{"@type":"Question","name":"Recognised startup = no DPDP work?","acceptedAnswer":{"@type":"Answer","text":"No. Recognition alone grants nothing under s.17(3); a separate Central Government notification is needed."}},{"@type":"Question","name":"Can we reuse old data for a new AI feature?","acceptedAnswer":{"@type":"Answer","text":"Not on the old purpose. New purpose needs a fresh s.5 notice + s.6 consent (or a fitting s.7/17 basis)."}}]}]} ```