Give a clear and plain-language notice and obtain the Data Principal’s consent
Severity Criticalss. 5–6
Processing digital personal data must rest on the Data Principal’s consent (or fall within a statutory legitimate use), with a notice given at or before the request for consent describing the personal data to be processed, the purpose, how to exercise rights and how to complain to the Board. Consent must be free, specific, informed, unconditional and unambiguous, signified by a clear affirmative action, and limited to the personal data necessary for the specified purpose. It may be withdrawn at any time with comparable ease.
- Applies when
- Data Fiduciaries offering goods or services to users in India and processing their digital personal data, including Chinese companies with no Indian establishment.
- Evidence to retain
- · Consent notice text, including the option of the languages listed in the Act alongside English
- · Consent and withdrawal records
- · Mapping of purposes to the data items necessary for them
- · Records showing downstream processing stopped after withdrawal
Estimated first-time effort: 8–20 person-days (estimate, not a commitment)
Take reasonable security safeguards to prevent a personal data breach
Severity Criticals. 8(5); Schedule item 1
A Data Fiduciary must take reasonable security safeguards to prevent a personal data breach, including in respect of data held by its Data Processors. This carries the highest penalty in the Schedule, up to ₹250 crore. In practice it must cover access control, encryption, logging, vendor management and incident exercises, with implementation evidence that can be shown to the Board.
- Applies when
- All Data Fiduciaries; outsourcing processing to an entity in China does not displace responsibility for data held by that processor.
- Evidence to retain
- · Inventory of security safeguards with implementation evidence
- · Data Processor contracts with the security requirements annex
- · Access control and log audit records
- · Incident exercise records
Estimated first-time effort: 12–30 person-days (estimate, not a commitment)
Notify the Board and affected Data Principals of a personal data breach
Severity Criticals. 8(6); Schedule item 2
On a personal data breach, the Data Fiduciary must give notice to the Data Protection Board and to each affected Data Principal in the prescribed form and manner. A personal data breach is defined as any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access, that compromises the confidentiality, integrity or availability of personal data. Failure to notify attracts up to ₹200 crore.
- Applies when
- All Data Fiduciaries; Chinese vendors acting as Data Processors should contractually commit to immediate notification to the Fiduciary.
- Deadline: In the form and manner prescribed by rules; the specific deadline in the rules was not verified in this pass
- Evidence to retain
- · Incident response plan including the Indian notification path
- · Record of the notice filed with the Board
- · Notice text to affected Data Principals and proof of dispatch
- · Assessment record characterising the incident as a breach
Estimated first-time effort: 6–15 person-days (estimate, not a commitment)
Additional obligations relating to children’s personal data
Severity Criticals. 9; Schedule item 3
Processing the personal data of a child, or of a person with disability whose lawful guardian acts on their behalf, is subject to the additional obligations in s.9. Breach attracts up to ₹200 crore, the same tier as the breach-notification duty, reflecting India’s emphasis on minors’ data. AI products for education, gaming, social or companionship use targeting India need age assurance and guardian-consent mechanisms.
- Applies when
- Providers of AI applications for Indian users whose user base may include children.
- Evidence to retain
- · Description of the age-assurance mechanism with accuracy evaluation
- · Guardian consent records
- · Description of feature restrictions and default settings for children
- · Item-by-item compliance checklist for s.9
Estimated first-time effort: 8–20 person-days (estimate, not a commitment)
Heightened obligations once notified as a Significant Data Fiduciary
Severity Highs. 10; Schedule item 4
The Central Government may notify a Data Fiduciary or class of Fiduciaries as a Significant Data Fiduciary based on factors including the volume and sensitivity of personal data processed, risk to Data Principals’ rights, potential impact on the sovereignty and integrity of India, risk to electoral democracy, security of the State and public order. A Significant Data Fiduciary must: appoint a Data Protection Officer who is based in India, is responsible to the board of directors or similar governing body, represents the Fiduciary under the Act and is the point of contact for the grievance redressal mechanism; appoint an independent data auditor to evaluate compliance; and undertake other measures including periodic Data Protection Impact Assessments. Breach of s.10 attracts up to ₹150 crore.
- Applies when
- Chinese AI platforms with large Indian user bases or sensitive data processing. Once notified, the requirement that the DPO be based in India means local staffing and governance structures are mandatory.
- Evidence to retain
- · DPO appointment documents evidencing India-based status and reporting line
- · Independent data auditor engagement letter and audit report
- · Periodic Data Protection Impact Assessment reports
- · Records of the grievance redressal mechanism in operation
Estimated first-time effort: 15–40 person-days (estimate, not a commitment)
Monitor s.16 transfer restriction notifications and keep the data architecture switchable
Severity Highs. 16
Section 16(1) empowers the Central Government to restrict, by notification, the transfer of personal data by a Data Fiduciary for processing to a country or territory outside India that it notifies. Section 16(2) preserves any Indian law providing a higher degree of protection or a stricter restriction on transfer — so sector rules such as financial and payments data-localisation requirements continue to prevail. Companies should monitor such notifications and keep the data architecture capable of switching the processing location away from a restricted country.
- Applies when
- Chinese AI companies processing Indian user data in China. For Chinese-owned businesses this is a high-uncertainty risk and the ability to switch should be designed in from the start.
- Evidence to retain
- · Cross-border data flow inventory and processing-location register
- · Monitoring mechanism and review records for s.16 notifications
- · Applicability analysis of sectoral localisation rules in finance, payments and health
- · Processing-location switchover plan and rehearsal records
Estimated first-time effort: 8–20 person-days (estimate, not a commitment)
Establish a grievance redressal mechanism and ensure data accuracy and completeness
Severity Mediumss. 8(4), 8(10)
A Data Fiduciary must establish an effective grievance redressal mechanism and publish the means of contacting it so that Data Principals can complain about performance of the Act’s obligations, and must ensure that personal data is accurate, complete and consistent where it is used to make a decision affecting the Data Principal or is disclosed to another Data Fiduciary. In AI contexts, automated decisions based on inaccurate profiles are the paradigm risk under this duty.
- Applies when
- All Data Fiduciaries serving Data Principals in India.
- Evidence to retain
- · Published grievance channel and internal response-time rules
- · Grievance register with closure records
- · Data accuracy validation rules and execution logs
- · Inventory of data fields used in decisions and their refresh mechanism
Estimated first-time effort: 5–12 person-days (estimate, not a commitment)