dpdpa

What it does

The skill acts as an expert India DPDPA compliance advisor for legal, privacy, and compliance teams. It covers the full text of the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, with emphasis on timelines, terminology, and structured guidance for compliance tasks.

How it works

The guidance is organized around foundational rules and specific sections. It prescribes:

• Using DPDPA terminology (Data Fiduciary, Data Principal, Data Processor, Significant Data Fiduciary) and citing obligations by Section X or Rule Y, e.g., Rule 3 of the DPDP Rules 2025.
• Phase-aware timelines (Board operational from 13 November 2025; full compliance by 13 May 2027).
• Two lawful bases for processing: Consent (Section 6) and Certain Legitimate Uses (Section 7) with an exhaustive eight-category list; outside these, processing requires consent.
• Notice requirements (Section 5 implementing Rule 3) with explicit elements to be disclosed to Data Principals.
• Strict criteria for valid consent (free, specific, informed, unconditional, unambiguous) and withdrawal procedures (Section 6(4)).
• Section 7’s eight legitimate uses, including employment and disaster/medical emergency provisions, noting the list is exhaustive.
• General obligations (Section 8) including engaging processors under contract (Rule 16), data quality, security safeguards (Rule 7), and breach notification (Rule 6).
• Special rules for children (Section 9) with parental consent, age verification (Rule 10/12), and penalties (₹200 crore).
• Obligations for SDFs (Section 10) like DPO appointment, DPIA, independent data audit, and localization, noting that as of April 2026 no SDFs are publicly designated yet.

When to use it

Trigger conditions include questions about: Data Fiduciary obligations, Data Principal rights, cross-border transfers, breach notification timelines, children’s data, DPIA requirements, and GDPR vs DPDPA comparisons. Specific triggers listed in the skill include references to Section 6 consent, Section 7 legitimate uses, Section 9 children’s data, Section 10 SDF, Rule 6 breach notification, Rule 13 SDF obligations, Data Protection Board complaints, verifiable parental consent, DPIA roadmap, and global privacy law discussions.

What it can touch

The skill references tools and sections for drafting notices, policy reviews, consent mechanism checks, breach workflows, and SDF assessments. Explicitly, it discusses engaging processors under contract (Rule 16), breach notification timelines (Rule 6), and DPIA/Audit activities (Section 10 + Rule 13).

Caveats

Key limitations include: only digital personal data is covered; the Rules define operational specifics; the Board becomes operational from 13 November 2025, with full substantive compliance by 13 May 2027. Some items depend on future Central Government notifications (e.g., SDF designations, cross-border transfer restrictions) and are flagged as contingent.