The DPDP Act never mentions anonymisation, so whether a dataset escapes it turns on one word in section 2(t), 'identifiable', and on who could do the identifying.
Every SDK in an app sends data to someone, and the DPDP Act holds the app answerable for what its code collects while making a vendor that uses the data for itself answerable too.
An Indian company with a DPDP programme already has most of what Singapore's PDPA asks for, but breach triage, transfers back to India, a DPO and Do Not Call checks are new work.
The DPDP Act makes businesses treat children differently but never tells them to check every user's age, so the answer lies in matching the check to the risk and keeping the result, not the evidence.
The DPDP Act names data processors in seven places and gives none of them a duty of their own, yet a vendor's exposure is real: it arrives through clients' clocks, contracts, audits and the moment the vendor starts using data for itself.
India's competition authorities now test a dominant firm's data-sharing terms as possible abuse, the DPDP Act will soon test every firm's consent screens, and a group that pools customer data across companies has to pass both.
Contract law will usually hold a user to what her AI agent books, but the DPDP Act asks whose choice a consent records, and RBI's payment rules keep the final say with her.
A target's customer data is worth only what it can lawfully be used for, and the DPDP Act's scheme exemption covers far less of a deal than most dealmakers assume.
Articles by Trayambic are general information, not legal advice.
Employee data passes through nine stages, from the first CV to the last reference call, and the DPDP Act asks a different question at each: which ground, what notice, how long, and what can go wrong.
The DPDP Act never says 'privacy by design', but its duties on consent, accuracy, security, erasure and children can only be met by controls built into the product before launch.
The DPDP Act says erase personal data when its purpose ends, but other laws, two one-year floors in the Rules and CERT-In's log directions decide what must stay, and this whitepaper shows how to reconcile them in one schedule.
Banks, NBFCs, brokers, insurers and telecom operators already answer to a sector regulator and to CERT-In; this framework shows how to meet the DPDP Act with one control library, one incident desk and one body of evidence, and how to settle the four places where the rulebooks pull apart.
For Indian companies that already comply with the GDPR, most of the machinery carries over to the DPDP Act, but many of the judgements behind it do not.
From May 2027 a single cyber incident can owe reports to CERT-In, a sector regulator, the Data Protection Board and every affected person, each on its own clock, so the response has to be designed as one system.
No business has yet been designated a Significant Data Fiduciary, but designation will arrive by notification with a twelve-month clock attached, so the businesses most likely to be named should build their DPIA, audit and algorithm review capability now.
The DPDP Act has no small-business threshold and no startup exemption yet, so founders need a short, evidenced programme they can run themselves, show investors and defend before the Board.
No. We are an advisory and consultancy practice. Where a matter requires legal representation or a legal opinion, independent advocates are instructed on your behalf and act under their own professional rules. We direct the engagement, so you hold one relationship.
