Data Privacy · Module 08
The control plane over the whole programme — how data is collected, stored, processed and shared, and who is accountable for each of those.
Primary DPDP sectionsSec. 4, 7, 10, 16
How it works
Regulation is expressed as configuration over a shared control library, so the next regime is a mapping rather than another eighteen-month programme.
Each expressed as configuration, not as a separate build.
A single control can satisfy many regimes; requirements map to named owners and a posture per jurisdiction.
RoPA from live systems, lawful basis per activity, processor register, retention schedules and transfer controls.
Data catalogue, identity resolution, policy engine, AI classification and the evidence trail.
Sec. 8(1) is the structural trap: the Fiduciary carries the penalty for a processor's failure. The register is what quantifies it.
Capability
One view across GDPR, CCPA/CPRA, PDPA, NESA, LGPD and DPDP, so every requirement is visible and owned.
Automated tooling removes manual error from complex compliance tasks and cuts programme operating cost.
Meets rising consumer expectation of privacy and turns compliance posture into a commercial asset.
The next regulation arrives as a mapping onto controls that already run — not as another eighteen-month programme with its own vendor.
DPDP alignment
What the Digital Personal Data Protection Act, 2023 requires, and the control that satisfies it.
| Section | What the Act requires | How the product satisfies it |
|---|---|---|
| Sec. 4 & 7 | Personal data may be processed only for a lawful purpose — with consent, or for one of the listed legitimate uses. | Lawful basis is recorded per processing activity and re-tested when the purpose changes, so “legitimate use” is a documented determination rather than a convenient assumption. |
| Sec. 8(1)–(2) | The Data Fiduciary is responsible for processing by a processor engaged under a valid contract, including on the Principal's behalf. | A processor register ties every vendor to the activities, purposes and consents they inherit, and to the contract that permits it — so liability is mapped, not discovered. |
| Sec. 10(1) | The Central Government may notify any Data Fiduciary or class as a Significant Data Fiduciary based on volume, sensitivity and risk factors. | SDF obligations are tracked as a live posture that can be switched on by class, so notification is a configuration change rather than a programme. |
| Sec. 16 | Transfer of personal data outside India is permitted except to countries restricted by the Central Government by notification. | Transfer controls are evaluated against the current restricted list at processing time, with the data flow map showing where each attribute physically resides. |
| Sec. 17 | Exemptions apply for certain purposes, including legal claims, State instrumentalities and research, subject to prescribed standards. | Exemptions are configured as explicit, evidenced exceptions with a named basis and owner — never as an undocumented gap in enforcement. |
Sec. 8(1) is the structural trap: the Fiduciary carries the penalty for a processor's failure. Without a processor register mapped to purposes and consents, that exposure is unquantified.
Solutions by industry
The sectors carrying the most DPDP exposure for this control, each with its own threat model and regulators.
A DPDP readiness walkthrough maps your obligations to the controls that already exist, and names the gaps that do not.
