DPDP Act questions, answered with care.

Q1. Does the DPDP Act apply to manufacturing companies and organisations that only do B2B business?

Yes, it can. Applicability is not limited to any industry. Manufacturing, textile, B2B and other organisations fall within the Act when they process digital personal data, for example data about employees, vendors, contractors and customer contacts.

Q2. Is personal information that is publicly available on websites or in public documents exempt from consent?

The Act excludes personal data that the Data Principal has made publicly available, and personal data made public by another person under a legal obligation.

The fact that information can be found on the internet is not enough, on its own, to qualify for this exclusion.

Q3. Does the Act apply to an Indian service provider that processes personal data only of people outside India, under a contract with an overseas client?

Section 17(1)(d) provides an exemption for certain processing carried out in India under contracts with entities outside India. Three situations should be looked at separately:

• Processing personal data of personnel working in India.
• Processing personal data of individuals in India as part of outsourced activities.
• Processing the Indian organisation does for its own purposes, not solely for the overseas client.

The exact reach of the exemption needs separate legal verification.

Status: Verify the exact scope of the exemption with a lawyer.

Q4. Does the Act apply when personal data is collected through a newsletter platform hosted outside India?

It can. Collecting personal data from people in India for services offered in India can bring the activity within the Act, even if the technology platform is hosted overseas. A properly implemented consent checkbox is one way to obtain consent.

Q5. Can an organisation reuse its existing GDPR policies for DPDP compliance?

Potentially, after a gap assessment. GDPR documents are a reasonable starting point, but the provisions on lawful grounds, notices, consent and rights may need changes to meet the DPDP framework.

Q6. Are internal investigations, vigilance activities and background verification exempt from the Act?

No general exemption was identified. Personal data processed during investigations, background checks or vigilance work must be assessed against the Act's provisions.

Q7. How does the Act affect journalism and news publishers?

Applying privacy obligations to journalism is complex, because constitutional freedoms and privacy rights meet. No definitive conclusion was given, and the result of pending legal proceedings was not settled.

Status: Open question. Needs further legal analysis.

Q8. Should non-disclosure agreements include data protection clauses if only business contact details are exchanged?

Information that relates only to a company is different from personal data about identifiable people. If personal information of employees, representatives or business contacts is exchanged, DPDP obligations may apply. Whether a contract clause is needed, and how wide it should be, depends on what is actually shared.

Q9. Can an organisation offer money or rewards in return for consent?

Consent must be free and unconditional. Whether an incentive undermines that depends on the facts. No single answer fits every incentive-based arrangement.

Status: Depends on the facts.

Q10. Is an "Accept All" button enough if people get no granular choices?

It may be a compliance concern where people cannot meaningfully choose which purposes they agree to. The right design of a consent screen needs further assessment.

Q11. Can valid consent be collected by phone call or an IVR system?

Yes. Consent can be collected through a telephone mechanism, including an affirmative action such as pressing a designated number. The detailed rules for recording, proving and withdrawing that consent were not covered.

Q12. Is consent on a signed paper form valid?

Yes. Consent can be collected on physical forms, but the organisation must still be able to show that the legal requirements were met.

Q13. How long does consent last?

There is no fixed validity period. Consent is tied to the purpose it was given for and remains relevant until that purpose is fulfilled, subject to withdrawal and other legal requirements.

Q14. Can a business send promotions to an existing customer without separate marketing consent?

Consent should be obtained for promotional activity. Processing needed to complete a purchase is different from processing for later marketing.

Q15. How should consent be collected at exhibitions, trade shows and events with many participants?

Build suitable consent steps into event registration. No particular technical solution was prescribed, and not every way data might be collected at an event was covered.

Q16. What consent duties apply to data collected through advertising and lead-generation platforms?

The question was raised, but no substantive answer was recorded.

Status: Not answered.

Q17. Is fresh consent needed for loyalty-programme data an organisation already holds?

The question was acknowledged, but no substantive answer was recorded.

Status: Not answered.

Q18. What should organisations do about old customer data when earlier consent records are missing or do not meet current requirements?

Legacy consent was identified as an issue that needs further explanation. It was not settled whether fresh consent is needed in every case or whether another approach would be enough.

Status: Unresolved.

Q19. Must people be able to withdraw consent in the same way they gave it?

Withdrawal should be available through a mechanism comparable to the one used to give consent. The detailed legal and technical requirements were not examined.

Q20. What evidence should an organisation keep to show valid consent?

Keep consent records in a system that suits your size, from a dedicated consent-management platform to a simpler internal record such as a spreadsheet. What matters is being able to demonstrate and manage consent. Whether any particular method is sufficient was not independently established.

Q21. Can a privacy notice and a consent request be in the same form?

Yes. A notice may come with the consent request or be given beforehand. Its timing and presentation must still meet the notice and consent requirements.

Q22. Does the DPDP Act need more detailed purpose descriptions than the GDPR?

The DPDP framework offers a narrower set of grounds for processing than the GDPR. How much detail each framework requires about purposes was not conclusively examined.

Status: Partially answered.

Q23. Can an organisation refuse a service if someone will not give the personal data needed to provide it?

Yes, where the data is genuinely necessary to deliver the service. This is different from asking for unrelated information and refusing service when people decline to give it.

Q24. Can a business rely on a declaration from another company instead of getting consent from the employees whose data it receives?

Be careful about treating consent as something that can be bundled into a general corporate declaration. No definitive framework was given for when direct consent or another lawful ground applies.

Status: Needs case-specific assessment.

Q25. Can contact details in the notices clause of a commercial agreement be used without separate consent?

Contact details voluntarily given in an agreement can be processed for the limited purpose of delivering contractual notices. It was not established whether the same details can be used for unrelated purposes.

Q26. Can an education provider get student consent through an intermediary or referral partner?

The organisation that decides the purpose and means of processing is the Data Fiduciary. Another organisation or person may help obtain consent on the Data Fiduciary's behalf. The contractual and operational requirements were not explained.

Q27. Is it mandatory to appoint a registered Consent Manager?

No. Organisations are not automatically required to appoint one, and may run their own internal consent-management processes.

Q28. Must an organisation register as a Consent Manager just because it collects and keeps consent records?

No. Running internal consent management is different from the regulated role of a registered Consent Manager.

Q29. Can a Data Fiduciary act as its own Consent Manager?

A Data Fiduciary can keep its own consent mechanisms without becoming a registered Consent Manager. Conflict-of-interest restrictions apply to registered Consent Managers.

Q30. If a person appoints a Consent Manager, must every Data Fiduciary connect to it?

The discussion indicated that universal integration with every registered Consent Manager is not mandatory, and described API integration as optional. This interpretation was not independently verified.

Status: Verify before relying on it.

Q31. Is a Consent Manager just software, or must it be a regulated organisation?

A registered Consent Manager is a regulated entity, not merely a software application, and it carries specific governance responsibilities.

Q32. Who is responsible for showing compliance when a Consent Manager is used?

The Data Fiduciary keeps the responsibility for demonstrating compliance. The Consent Manager helps manage consent on behalf of Data Principals.

Q33. Should a large organisation use an external Consent Manager or build an internal system?

This is an organisational and commercial decision. Scale, operational complexity, technology, cost and governance needs all matter. Using a third-party system does not transfer your statutory obligations.

Q34. Must employers get individual consent for all employee data, including payroll, tax and provident fund information?

Separate consent may not be needed for every employment-related activity, where another lawful ground applies. Employment and statutory obligations are the relevant considerations. Sources gave differing references to subsections of Section 7, so the exact statutory basis needs verification.

Status: Verify the exact legal basis.

Q35. Does the employment-related legitimate use cover activities that are not required by law or the job?

Routine employment processing is different from extra activities that are not necessary for employment, such as taking part in promotional or marketing events. Those may need separate consent or another lawful ground.

Q36. Can employers process family members' data for provident fund nominations and insurance without separate consent from those family members?

The employment-related provision may be relevant, but it does not automatically cover every use of a spouse's or relative's data. Consider consent or another legal basis, including any statutory requirement.

Q37. Can an Indian employer send employee data to overseas group companies for payroll, performance management and global HR?

The employment-related legitimate uses may support processing that is genuinely necessary for employment. Section 16 generally permits international transfers, subject to any restrictions the government applies. A full cross-border compliance assessment was not given.

Q38. Can an employer refuse a voluntary benefit if the employee will not provide the data needed to run it?

Yes, where delivering the benefit genuinely needs that data. The information requested must be relevant to the stated purpose and must not be used to force unrelated processing.

Q39. Can organisations rely on the employment relationship alone to process all employee information?

No. Employment-related processing can fall within certain legitimate uses, but an employment agreement is not unrestricted permission for every possible purpose.

Q40. What safeguards should apply when employees, such as sales staff, handle customers' personal data?

Set up internal mechanisms and standard operating procedures for how employees access, use, store and handle personal data. No detailed technical control framework was given.

Q41. Is a statutory auditor a Data Fiduciary or a Data Processor?

One response described the statutory auditor as a Data Processor. Employee, vendor and customer data the auditor sees still falls under the framework. No detailed role analysis was presented.

Status: Asserted, not conclusively analysed.

Q42. What DPDP obligations apply when an organisation hires external advocates or legal professionals?

Legal professionals who handle personal data may need appropriate data protection safeguards. An advocate may act as a Data Processor for the organisation that engages them. When a lawyer acts independently was not examined.

Q43. What obligations apply to B2B organisations that process data of employees, contractors, vendors, partners and customer representatives?

B2B relationships can involve personal data even though the transaction is commercial. The detailed analysis of obligations and best practice was deferred.

Status: No comprehensive answer.

Q44. Can organisations share personal data with government authorities for assessments, inspections or audits without separate consent?

Separate consent may not be needed in some circumstances involving government authorities, and Section 17 was referred to. The specific conditions and government powers were not explained.

Status: Verify with a lawyer before relying on this.

Q45. How should consent be obtained for processing a child's personal data?

Rule 10 of the DPDP Rules deals with verifiable parental consent. A detailed step-by-step process was not provided.

Q46. Who can give consent for an orphaned child or a child under a Child Welfare Committee?

An appropriately authorised authority linked to the Child Welfare Committee may be able to act under the applicable procedures. The answer itself acknowledged that the legislation and rules do not make the position clear.

Status: Unresolved. Needs further legal analysis.

Q47. How should healthcare organisations handle data of an adult patient who is unconscious or cannot consent?

The Act has legitimate-use provisions for medical emergencies, so relevant personal data may be processed in qualifying emergencies. Notice requirements and the position of relatives acting for the patient were not examined.

Q48. Who is responsible when a third-party vendor suffers a breach of your customer or employee data?

The Data Fiduciary remains responsible for its obligations even when an external vendor does the processing. The exact contractual and statutory liability of each party was not covered.

Q49. Can an organisation shift its legal liability for a breach to a Data Processor by contract?

A Data Fiduciary cannot simply transfer its statutory responsibility to a Data Processor. How liability is shared between the two by contract is a separate question.

Q50. How should liability caps, indemnities and breach duties be negotiated in Data Processing Agreements?

The question concerned processors seeking liability caps tied to service fees while the Data Fiduciary may face large statutory exposure. No detailed recommendation or reliable way to estimate penalties was given.

Status: Not substantively answered.

Q51. Must organisations run privacy audits or get certifications to show DPDP compliance?

Audits and certifications can help provide evidence of compliance. The discussion did not separate voluntary assurance from audits or certifications that the law specifically requires.

Status: Partially answered. Mandatory requirements not established.

Q52. Are CCTV photographs and videos captured for security exempt from the Act?

Not automatically. Security purposes do not by themselves create an exemption. The lawful basis for collection, continued processing and retention should be examined.

Q53. Which retention period applies when different laws set different requirements?

Account for retention periods under other applicable laws. If a law requires longer retention, that must be considered before you delete the information.

Q54. How can a person make sure a business deletes their mobile number after a purchase and invoice?

Organisations should set up internal procedures for erasure. The discussion did not describe a specific request process for individuals, or how to balance erasure requests against legal retention duties.

Q55. How should an organisation roll out DPDP compliance across its operations?

The question was raised but no detailed method was given. The topic needs a separate examination.

Status: Not substantively answered.

Q56. Can a company that manages shareholder records rely on depository information instead of getting consent from every shareholder?

People who hold securities in dematerialised form give their data to the depository ecosystem for identifiable purposes. Later processing by an issuer company or its Registrar and Transfer Agent may be connected to those original purposes, such as shareholder servicing, corporate actions and regulatory duties. Giving appropriate notice is important. It was not conclusively established that all such processing is exempt from separate consent.

Q57. Does signing a Data Processing Agreement with a Registrar and Transfer Agent settle the issuer's consent obligations?

Not by itself. The discussion covered the relationship between shareholders, depositories, issuers and service providers, but did not establish that signing a Data Processing Agreement removes the need to assess the lawful basis and notice duties.

Status: Partially answered.