24 FAQs
No. We are an advisory and consultancy practice. Where a matter requires legal representation or a legal opinion, independent advocates are instructed on your behalf and act under their own professional rules. We direct the engagement, so you hold one relationship.
A short intake call, a named point of contact, and access to your public-facing properties. For a deeper assessment, a limited set of internal documents shared under NDA.
Yes. The first conversation costs nothing. Scope and fees for any work that follows are agreed in writing before it begins.
Always, before any document is shared.
The panel members named in your scope of work, directed by the founding partners.
Yes. We are based in Mumbai and advise organisations across India.
Yes. A company that sells only to other companies still holds personal data on its employees and their families, job applicants, directors, shareholders, vendor and customer contacts, visitors, and the people on its CCTV footage. All of it falls within the Act.
No. The Act contains no turnover threshold, and no exemption for private, unlisted or business-to-business companies. Size affects how much must be done, not whether the law applies.
Notice, consent, security, breach reporting, individual rights and the remaining duties become enforceable on 13 May 2027. Prudent planning treats that date as the outer limit, not the target.
Yes. The report is yours. You can take it to any firm for execution. We are paid for the analysis, not for lock-in.
An executive sponsor. One coordinator. Two to three hours with each function head. Access to your contract repository. The rest is ours to carry.
Not as of October 2026. MeitY consulted stakeholders in January 2026 on bringing the date forward, but no amending notification had been published. Treat 13 May 2027 as the date unless a Gazette notification says otherwise.
Rule 4, which governs consent managers, takes effect on 13 November 2026, one year after the Rules were notified. From then, every consent manager must be registered with the Data Protection Board of India.
No. Nothing in the Act forces a business to accept consent through a consent manager. But every individual has the right to use one, so once registered consent managers exist you need to be able to receive, record and act on their consent and withdrawal signals.
The Schedule to the Act sets ceilings: up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore each for failing to notify a breach and for breaching the children’s provisions, and up to ₹50 crore for other breaches. The Board decides the amount only after an inquiry.
Rule 7 requires notice to each affected person and to the Data Protection Board without delay, followed by a detailed report to the Board within 72 hours.
Anyone under 18. Verifiable parental consent is needed before processing a child’s personal data, and tracking, behavioural monitoring and targeted advertising directed at children are barred, subject to narrow exemptions in the Rules.
Yes. A data fiduciary remains responsible for compliance even when a data processor does the work (section 8(1)), and may engage a processor only under a valid contract (section 8(2)). The contract should require security safeguards, prompt notice of incidents and deletion.
Until consent is withdrawn or the purpose is served, whichever is earlier, unless another law requires you to keep it (section 8(7)). Sector laws fix many retention periods, and Rule 6 sets a one-year minimum for security logs.
Not always. Section 7(i) lets an employer process staff data without consent for the purposes of employment, but it does not reach every candidate, every monitoring tool or every gig worker.
No. Unlike the GDPR, the Act creates no special category for health data: every item of digital personal data is treated the same way. Healthcare providers still carry heavier practical duties through sector record-keeping laws and the vendors that handle patient data.
ISO 9001:2015 (quality management), ISO/IEC 27001:2022 (information security), ISO/IEC 27701:2025 (privacy information management) and a Certificate of Recognition from DPIIT under Startup India.
Every Thursday, online, for one hour. You can book a slot on the Events page.
Choose a role on the Join Us page and send your full name, phone, email and a line about you, with a link to your CV.
General information, not legal advice.