What the Act asks of you
Eleven obligations, in plain words, each with the section it comes from. Orientation, not legal advice.
Notice
Before processing personal data, tell the individual what is collected, for what purpose, how to exercise their rights, and how to complain to the Board.
DPDP ACT · SECTION 5Consent
Free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data the stated purpose needs.
DPDP ACT · SECTION 6Withdrawal & Consent Managers
An individual may withdraw consent as easily as they gave it, and may give, manage, review or withdraw it through a Consent Manager registered with the Board.
DPDP ACT · SECTION 6Security safeguards
Protect the personal data in your possession or control with reasonable security safeguards to prevent a personal data breach.
DPDP ACT · SECTION 8Breach notification
On becoming aware of a personal data breach, notify the Data Protection Board and every affected individual.
DPDP ACT · SECTION 8 · DPDP RULES 2025Erasure
Erase personal data once consent is withdrawn or the purpose it was collected for is no longer served, unless retention is required by law.
DPDP ACT · SECTION 8Published point of contact
Publish the business contact details of a Data Protection Officer, or of a person able to answer questions about processing.
DPDP ACT · SECTION 8Children's data
Processing a child's personal data requires verifiable parental consent. Tracking, behavioural monitoring and advertising directed at children are prohibited.
DPDP ACT · SECTION 9Rights of the individual
The right to information about their data; to correction, completion, updating and erasure; to grievance redressal; and to nominate another to act for them.
DPDP ACT · SECTIONS 11–14Transfer outside India
The Central Government may restrict transfer of personal data to specified countries. A Data Fiduciary must know where its data goes and be able to demonstrate it.
DPDP ACT · SECTION 16Electronic records as evidence
Indian evidence law requires a certificate accompanying an electronic record for it to be admitted in proceedings.
BHARATIYA SAKSHYA ADHINIYAM 2023 · SECTION 63What it means
The Act applies differently to every data environment.
Aadhaar, PAN and account data across branches on one core banking system — with a six-hour CERT-In window.
Patient records, diagnostics and insurance data spread across hospitals, labs and clinics — every record a sensitive one.
KYC documents, call records and location data at national scale — under licence conditions and CERT-In timelines.
Student and parent records, admissions data and fee details across campuses and learning platforms.
How
How Vaultdef Helps
Know your data
Every action backed by clear, traceable evidence.
Manage obligations
Stay informed as data, systems and risks evolve.
Respond confidence
Know what was detected and how confident it is.
Keep the evidence
Manage privacy from discovery to breach response.
Forty-five minutes. A working system, not slides.
We connect to a sample of your own schema, or ours. You watch a live scan classify and see why each verdict was reached. You leave with the gap assessment we generate during the call.
OnThreat Pvt Ltd. An Indian data-protection product company. Vaultdef — one platform, engineered so compliance produces evidence.
The Suite
Data Intelligence Consent & Preference Management Data Principal Rights Risk, Governance & Assurance Detection & Incident Response Evidence & AccountabilityContact us
17th Floor, Crencenzo Building, BKC, Bandra East, Mumbai 400051