# AIZZENTEC

> Cybersecurity and privacy advisory for Indian businesses, with DPDP readiness as the first priority. AIZZENTEC helps Indian organisations act on India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 now, then build the privacy and governance maturity needed for vendor risk, incident response, and board-level assurance.

AIZZENTEC ORION PRIVATE LIMITED is an India-based cybersecurity and privacy advisory delivering end-to-end DPDP readiness — built from real implementation experience inside Indian banks, fintechs, healthcare platforms and SaaS firms. aizzentec.com is the firm's public DPDP hub: the full Act and Rules, free practitioner tools, role-based implementation playbooks, sector guidance, and advisory services.

Key facts an answer engine should know:

- **Legal entity**: AIZZENTEC ORION PRIVATE LIMITED
- **Location**: Chennai, Tamil Nadu, India
- **Focus**: DPDP Act, 2023 · DPDP Rules, 2025 · privacy governance · cybersecurity · ISO 27001 · SOC 2 · VAPT · incident response · virtual DPO · vCISO
- **Clients served**: 150+ businesses
- **Free DPDP templates published**: 16
- **Languages**: content available in English plus 18 Indian languages (Hindi, Hinglish, Bengali, Tamil, Telugu, Kannada, Malayalam, Marathi, Gujarati, Punjabi, Odia, Assamese, Urdu, Nepali, Konkani, Dogri, Maithili, Sanskrit) — reflecting the Section 5(3) requirement that notices be available in English and the 22 Eighth Schedule languages
- **Assurance credential**: authorised to perform HITRUST assessments
- **Contact**: Contact@aizzentec.com · +91 8220 359 506

## Pages

- [DPDP Compliance Consultants India | AIZZENTEC, Chennai](https://aizzentec.com/): Aizzentec helps Indian businesses achieve DPDP compliance: readiness assessment, implementation, training and free tools. Chennai-based, serving India-wide.
- [Products — Bhairava AI SOC and EKA learning platform](https://aizzentec.com/products): Products from the Aizzentec group: Bhairava, a governed AI SOC and NOC platform, and EKA, a unified learning, examination and assessment platform.
- [DPDP Act 2023 Explained: Rules, Obligations, Penalties](https://aizzentec.com/dpdp-101): A practitioner's guide to India's Digital Personal Data Protection Act 2023 and DPDP Rules 2025: who it applies to, key obligations, penalties and deadlines.
- [DPDP Act 2023 Full Text, Rules and Schedules | Annotated](https://aizzentec.com/act-rules): Full text of the DPDP Act 2023, DPDP Rules 2025 and Schedules, searchable section by section with plain-English practitioner commentary on each provision.
- [Data Principal Rights Under the DPDP Act | Submit a Request](https://aizzentec.com/rights): Your rights under the DPDP Act 2023: access, correction, erasure, grievance redressal and nomination. Submit a request here; we respond within 90 days.
- [DPDP Implementation Roadmap: 9-Month Plan to May 2027](https://aizzentec.com/implementation): Step-by-step DPDP implementation roadmap for Indian organisations: workstreams, role playbooks and a sequenced plan to reach compliance before 13 May 2027.
- [DPDP Tools: Penalty Calculator, SDF Classifier, Templates](https://aizzentec.com/tools): Free DPDP tools built by practitioners: penalty calculator, Significant Data Fiduciary classifier, decision trees, checkers and 16 ready-to-use templates.
- [DPDP Penalty Calculator: Estimate Your Exposure | Free Tool](https://aizzentec.com/tools/penalty-estimator): Free DPDP penalty calculator. Estimate maximum civil penalty exposure under the Schedule to the DPDP Act 2023, contravention by contravention, in your browser.
- [Significant Data Fiduciary Classifier | DPDP SDF Test](https://aizzentec.com/tools/sdf-classifier): Free Significant Data Fiduciary classifier. Seven questions based on Section 10(1) of the DPDP Act gauge whether your organisation is likely to be an SDF.
- [DPDP Readiness Assessment: Free 28-Question Self-Check](https://aizzentec.com/assessment): Free DPDP readiness assessment. 28 questions across seven workstreams give a scored readiness profile and prioritised next steps. Runs in your browser.
- [DPDP Compliance by Industry: BFSI, Fintech, Health, SaaS](https://aizzentec.com/sectors): Sector-specific DPDP compliance playbooks for BFSI, fintech, healthcare, e-commerce, SaaS and more: friction points, retention conflicts and regulator overlaps.
- [DPDP Knowledge Hub: Practitioner Guides and Deep-Dives](https://aizzentec.com/knowledge): Practitioner-authored DPDP guides on consent UX, breach response playbooks, vendor remediation, SDF classification and the questions clients ask most often.
- [DPDP Regulatory Updates and Notifications Tracker 2026](https://aizzentec.com/updates): Live tracker of DPDP Act developments: MeitY notifications, draft rules, Data Protection Board enforcement signals and what each one means for your compliance.
- [DPDP Compliance Services: Assessment to Implementation](https://aizzentec.com/services): DPDP advisory from readiness assessment to an operating compliance programme: gap analysis, implementation, and a virtual DPO. Serving all of India.
- [DPDP Training Programmes for Boards, DPOs and Engineers](https://aizzentec.com/training): Role-specific DPDP Act training: board briefings, DPO workshops, engineering bootcamps and front-line awareness. Four tiers mapped to who needs what depth.
- [DPDPA Certificate Course: 6-Module DPDP Certification](https://aizzentec.com/dpdpa-certificate-course): Get certified on India's DPDP Act 2023. A structured 6-module DPDPA certificate course covering legal foundations, practical compliance and AI governance.
- [DPDP vs GDPR: Key Differences Explained (2026) | AIZZENTEC](https://aizzentec.com/dpdp-vs-gdpr): DPDP Act vs GDPR compared: scope, consent, lawful bases, rights, breach rules, penalties and timelines. A glossary-style guide for Indian and global businesses.
- [Data Fiduciary vs Data Processor: DPDP Act Explained](https://aizzentec.com/data-fiduciary-vs-data-processor): Data Fiduciary vs Data Processor under India's DPDP Act 2023: definitions, obligations, liability, contract clauses and a 5-question test to classify your role.
- [What Is a Consent Manager? DPDP Act Explained | AIZZENTEC](https://aizzentec.com/what-is-a-consent-manager-dpdp): Consent Manager under India's DPDP Act 2023: definition, who can register, INR 2 crore net worth rule, obligations, how it works, and how it differs from a CMP.
- [Significant Data Fiduciary Explained: DPDP Act Guide](https://aizzentec.com/significant-data-fiduciary-explained): Significant Data Fiduciary under the DPDP Act 2023: designation criteria, DPO, audit, DPIA and algorithmic due diligence, penalties and a readiness roadmap.
- [DPDP Act vs IT Act SPDI Rules: Key Changes | AIZZENTEC](https://aizzentec.com/dpdp-act-vs-it-act-spdi-rules): DPDP Act 2023 vs IT Act SPDI Rules 2011 compared: scope, consent, security, breach reporting, penalties and what carries over. Includes a migration checklist.
- [About Aizzentec: DPDP and Cybersecurity Advisory, Chennai](https://aizzentec.com/about): Aizzentec is a Chennai-based privacy and cybersecurity advisory delivering end-to-end DPDP readiness, built from implementation experience inside Indian firms.
- [Privacy Notice | AIZZENTEC](https://aizzentec.com/privacy): How AIZZENTEC collects, uses, shares and protects your personal data — written to meet Section 5 of the DPDP Act and Rule 3 of the DPDP Rules, 2025.
- [DPDP Act Blog: Compliance Guides and Analysis | AIZZENTEC](https://aizzentec.com/blog): Practitioner guides to the DPDP Act: cross-border transfers, breach response, penalties, sector playbooks for banking, health and retail, and the 2027 runway.
- [Cookie Policy | AIZZENTEC](https://aizzentec.com/cookie-policy): What aizzentec.com stores on your device and why: five first-party browser-storage entries, no cookies of our own, and Google Analytics only after you opt in.
- [Terms of Use | AIZZENTEC](https://aizzentec.com/terms): The terms on which AIZZENTEC makes this DPDP hub and its resources available to you. Information, not legal advice.
- [Section 1 DPDP Act: Short title and commencement | AIZZENTEC](https://aizzentec.com/act-rules/section-1): Section 1 of the DPDP Act 2023: Short title and commencement. The full text as notified, with what it asks of an organisation in practice.
- [Section 2 DPDP Act: Definitions | AIZZENTEC](https://aizzentec.com/act-rules/section-2): Section 2 of the DPDP Act 2023: Definitions. The full text as notified, with what it asks of an organisation in practice.
- [Section 3 DPDP Act: Application of Act | AIZZENTEC](https://aizzentec.com/act-rules/section-3): Section 3 of the DPDP Act 2023: Application of Act. The full text as notified, with what it asks of an organisation in practice.
- [Section 4 DPDP Act: Grounds for processing personal data](https://aizzentec.com/act-rules/section-4): Section 4 of the DPDP Act 2023: Grounds for processing personal data. The full text as notified, with what it asks of an organisation in practice.
- [Section 5 DPDP Act: Notice | AIZZENTEC](https://aizzentec.com/act-rules/section-5): Section 5 of the DPDP Act 2023: Notice. The full text as notified, with its sub-sections and illustrations, and what it asks of an organisation in practice.
- [Section 6 DPDP Act: Consent | AIZZENTEC](https://aizzentec.com/act-rules/section-6): Section 6 of the DPDP Act 2023: Consent. The full text as notified, with its sub-sections and illustrations, and what it asks of an organisation in practice.
- [Section 7 DPDP Act: Certain legitimate uses | AIZZENTEC](https://aizzentec.com/act-rules/section-7): Section 7 of the DPDP Act 2023: Certain legitimate uses. The full text as notified, with what it asks of an organisation in practice.
- [Section 8 DPDP Act: General obligations of Data Fiduciary](https://aizzentec.com/act-rules/section-8): Section 8 of the DPDP Act 2023: General obligations of Data Fiduciary. The full text as notified, with what it asks of an organisation in practice.
- [Section 9 DPDP Act: Processing of personal data of children](https://aizzentec.com/act-rules/section-9): Section 9 of the DPDP Act 2023: Processing of personal data of children. The full text as notified, with what it asks of an organisation in practice.
- [Section 10 DPDP Act: Significant Data Fiduciary duties](https://aizzentec.com/act-rules/section-10): Section 10 of the DPDP Act 2023: Additional obligations of Significant Data Fiduciary. The full text as notified.
- [Section 11 DPDP Act: Right to access personal data](https://aizzentec.com/act-rules/section-11): Section 11 of the DPDP Act 2023: Right to access information about personal data. The full text as notified, with what it asks of an organisation in practice.
- [Section 12 DPDP Act: Right to correction and erasure](https://aizzentec.com/act-rules/section-12): Section 12 of the DPDP Act 2023: Right to correction and erasure of personal data. The full text as notified, with what it asks of an organisation in practice.
- [Section 13 DPDP Act: Right of grievance redressal](https://aizzentec.com/act-rules/section-13): Section 13 of the DPDP Act 2023: Right of grievance redressal. The full text as notified, with what it asks of an organisation in practice.
- [Section 14 DPDP Act: Right to nominate | AIZZENTEC](https://aizzentec.com/act-rules/section-14): Section 14 of the DPDP Act 2023: Right to nominate. The full text as notified, with what it asks of an organisation in practice.
- [Section 15 DPDP Act: Duties of Data Principal | AIZZENTEC](https://aizzentec.com/act-rules/section-15): Section 15 of the DPDP Act 2023: Duties of Data Principal. The full text as notified, with what it asks of an organisation in practice.
- [Section 16 DPDP Act: Personal data processed outside India](https://aizzentec.com/act-rules/section-16): Section 16 of the DPDP Act 2023: Processing of personal data outside India. The full text as notified, with what it asks of an organisation in practice.
- [Section 17 DPDP Act: Exemptions | AIZZENTEC](https://aizzentec.com/act-rules/section-17): Section 17 of the DPDP Act 2023: Exemptions. The full text as notified, with what it asks of an organisation in practice.
- [Section 18 DPDP Act: Establishment of Board | AIZZENTEC](https://aizzentec.com/act-rules/section-18): Section 18 of the DPDP Act 2023: Establishment of Board. The full text as notified, with what it asks of an organisation in practice.
- [Section 19 DPDP Act: Composition of the Board | AIZZENTEC](https://aizzentec.com/act-rules/section-19): Section 19 of the DPDP Act 2023: Composition of the Board. The full text as notified, with what it asks of an organisation in practice.
- [Section 20 DPDP Act: Salary, allowances and term of office](https://aizzentec.com/act-rules/section-20): Section 20 of the DPDP Act 2023: Salary, allowances payable to and term of office. The full text as notified, with what it asks of an organisation in practice.
- [Section 21 DPDP Act: Disqualifications for Board members](https://aizzentec.com/act-rules/section-21): Section 21 of the DPDP Act 2023: Disqualifications for Board members. The full text as notified, with what it asks of an organisation in practice.
- [Section 22 DPDP Act: Resignation and filling of vacancy](https://aizzentec.com/act-rules/section-22): Section 22 of the DPDP Act 2023: Resignation by Members and filling of vacancy. The full text as notified, with what it asks of an organisation in practice.
- [Section 23 DPDP Act: Proceedings of Board | AIZZENTEC](https://aizzentec.com/act-rules/section-23): Section 23 of the DPDP Act 2023: Proceedings of Board. The full text as notified, with what it asks of an organisation in practice.
- [Section 24 DPDP Act: Officers and employees of Board](https://aizzentec.com/act-rules/section-24): Section 24 of the DPDP Act 2023: Officers and employees of Board. The full text as notified, with what it asks of an organisation in practice.
- [Section 25 DPDP Act: Members and officers as public servants](https://aizzentec.com/act-rules/section-25): Section 25 of the DPDP Act 2023: Members and officers to be public servants. The full text as notified, with what it asks of an organisation in practice.
- [Section 26 DPDP Act: Powers of Chairperson | AIZZENTEC](https://aizzentec.com/act-rules/section-26): Section 26 of the DPDP Act 2023: Powers of Chairperson. The full text as notified, with what it asks of an organisation in practice.
- [Section 27 DPDP Act: Powers and functions of Board](https://aizzentec.com/act-rules/section-27): Section 27 of the DPDP Act 2023: Powers and functions of Board. The full text as notified, with what it asks of an organisation in practice.
- [Section 28 DPDP Act: Procedure to be followed by Board](https://aizzentec.com/act-rules/section-28): Section 28 of the DPDP Act 2023: Procedure to be followed by Board. The full text as notified, with what it asks of an organisation in practice.
- [Section 29 DPDP Act: Appeal to Appellate Tribunal](https://aizzentec.com/act-rules/section-29): Section 29 of the DPDP Act 2023: Appeal to Appellate Tribunal. The full text as notified, with what it asks of an organisation in practice.
- [Section 30 DPDP Act: Tribunal orders executable as a decree](https://aizzentec.com/act-rules/section-30): Section 30 of the DPDP Act 2023: Tribunal orders executable as a decree. The full text as notified, with what it asks of an organisation in practice.
- [Section 31 DPDP Act: Alternate dispute resolution](https://aizzentec.com/act-rules/section-31): Section 31 of the DPDP Act 2023: Alternate dispute resolution. The full text as notified, with what it asks of an organisation in practice.
- [Section 32 DPDP Act: Voluntary undertaking | AIZZENTEC](https://aizzentec.com/act-rules/section-32): Section 32 of the DPDP Act 2023: Voluntary undertaking. The full text as notified, with what it asks of an organisation in practice.
- [Section 33 DPDP Act: Penalties | AIZZENTEC](https://aizzentec.com/act-rules/section-33): Section 33 of the DPDP Act 2023: Penalties. The full text as notified, with its sub-sections and illustrations, and what it asks of an organisation in practice.
- [Section 34 DPDP Act: Penalties credited to Consolidated Fund](https://aizzentec.com/act-rules/section-34): Section 34 of the DPDP Act 2023: Penalties credited to Consolidated Fund. The full text as notified, with what it asks of an organisation in practice.
- [Section 35 DPDP Act: Protection of action in good faith](https://aizzentec.com/act-rules/section-35): Section 35 of the DPDP Act 2023: Protection of action taken in good faith. The full text as notified, with what it asks of an organisation in practice.
- [Section 36 DPDP Act: Power to call for information](https://aizzentec.com/act-rules/section-36): Section 36 of the DPDP Act 2023: Power to call for information. The full text as notified, with what it asks of an organisation in practice.
- [Section 37 DPDP Act: Government power to issue directions](https://aizzentec.com/act-rules/section-37): Section 37 of the DPDP Act 2023: Power of Central Government to issue directions. The full text as notified, with what it asks of an organisation in practice.
- [Section 38 DPDP Act: Consistency with other laws | AIZZENTEC](https://aizzentec.com/act-rules/section-38): Section 38 of the DPDP Act 2023: Consistency with other laws. The full text as notified, with what it asks of an organisation in practice.
- [Section 39 DPDP Act: Bar of jurisdiction | AIZZENTEC](https://aizzentec.com/act-rules/section-39): Section 39 of the DPDP Act 2023: Bar of jurisdiction. The full text as notified, with what it asks of an organisation in practice.
- [Section 40 DPDP Act: Power to make rules | AIZZENTEC](https://aizzentec.com/act-rules/section-40): Section 40 of the DPDP Act 2023: Power to make rules. The full text as notified, with what it asks of an organisation in practice.
- [Section 41 DPDP Act: Laying of rules and notifications](https://aizzentec.com/act-rules/section-41): Section 41 of the DPDP Act 2023: Laying of rules and certain notifications. The full text as notified, with what it asks of an organisation in practice.
- [Section 42 DPDP Act: Power to amend Schedule | AIZZENTEC](https://aizzentec.com/act-rules/section-42): Section 42 of the DPDP Act 2023: Power to amend Schedule. The full text as notified, with what it asks of an organisation in practice.
- [Section 43 DPDP Act: Power to remove difficulties](https://aizzentec.com/act-rules/section-43): Section 43 of the DPDP Act 2023: Power to remove difficulties. The full text as notified, with what it asks of an organisation in practice.
- [Section 44 DPDP Act: Amendments to certain Acts | AIZZENTEC](https://aizzentec.com/act-rules/section-44): Section 44 of the DPDP Act 2023: Amendments to certain Acts. The full text as notified, with what it asks of an organisation in practice.
- [Rule 1 DPDP Rules: Short title and commencement | AIZZENTEC](https://aizzentec.com/act-rules/rule-1): Rule 1 of the DPDP Rules 2025: Short title and commencement. The full text as notified, with what it asks of an organisation in practice.
- [Rule 2 DPDP Rules: Definitions | AIZZENTEC](https://aizzentec.com/act-rules/rule-2): Rule 2 of the DPDP Rules 2025: Definitions. The full text as notified, with its sub-sections and illustrations, and what it asks of an organisation in practice.
- [Rule 3 DPDP Rules: Notice to the Data Principal | AIZZENTEC](https://aizzentec.com/act-rules/rule-3): Rule 3 of the DPDP Rules 2025: Notice given by Data Fiduciary to Data Principal. The full text as notified, with what it asks of an organisation in practice.
- [Rule 4 DPDP Rules: Consent Manager registration and duties](https://aizzentec.com/act-rules/rule-4): Rule 4 of the DPDP Rules 2025: Registration and obligations of Consent Manager. The full text as notified, with what it asks of an organisation in practice.
- [Rule 5 DPDP Rules: Processing for State subsidy or service](https://aizzentec.com/act-rules/rule-5): Rule 5 of the DPDP Rules 2025: Processing for State subsidy or service. The full text as notified, with what it asks of an organisation in practice.
- [Rule 6 DPDP Rules: Reasonable security safeguards](https://aizzentec.com/act-rules/rule-6): Rule 6 of the DPDP Rules 2025: Reasonable security safeguards. The full text as notified, with what it asks of an organisation in practice.
- [Rule 7 DPDP Rules: Intimation of personal data breach](https://aizzentec.com/act-rules/rule-7): Rule 7 of the DPDP Rules 2025: Intimation of personal data breach. The full text as notified, with what it asks of an organisation in practice.
- [Rule 8 DPDP Rules: When a purpose is no longer served](https://aizzentec.com/act-rules/rule-8): Rule 8 of the DPDP Rules 2025: When a purpose is no longer served. The full text as notified, with what it asks of an organisation in practice.
- [Rule 9 DPDP Rules: Contact for questions about processing](https://aizzentec.com/act-rules/rule-9): Rule 9 of the DPDP Rules 2025: Contact for questions about processing. The full text as notified, with what it asks of an organisation in practice.
- [Rule 10 DPDP Rules: Verifiable parental consent for a child](https://aizzentec.com/act-rules/rule-10): Rule 10 of the DPDP Rules 2025: Verifiable parental consent for a child. The full text as notified, with what it asks of an organisation in practice.
- [Rule 11 DPDP Rules: Verifiable consent: lawful guardian](https://aizzentec.com/act-rules/rule-11): Rule 11 of the DPDP Rules 2025: Verifiable consent: lawful guardian. The full text as notified, with what it asks of an organisation in practice.
- [Rule 12 DPDP Rules: Exemptions for children's data](https://aizzentec.com/act-rules/rule-12): Rule 12 of the DPDP Rules 2025: Exemptions for children's data. The full text as notified, with what it asks of an organisation in practice.
- [Rule 13 DPDP Rules: Significant Data Fiduciary duties](https://aizzentec.com/act-rules/rule-13): Rule 13 of the DPDP Rules 2025: Additional obligations of Significant Data Fiduciary. The full text as notified.
- [Rule 14 DPDP Rules: Rights of Data Principals | AIZZENTEC](https://aizzentec.com/act-rules/rule-14): Rule 14 of the DPDP Rules 2025: Rights of Data Principals. The full text as notified, with what it asks of an organisation in practice.
- [Rule 15 DPDP Rules: Transfer of personal data outside India](https://aizzentec.com/act-rules/rule-15): Rule 15 of the DPDP Rules 2025: Transfer of personal data outside the territory of India. The full text as notified.
- [Rule 16 DPDP Rules: Exemption for research and statistics](https://aizzentec.com/act-rules/rule-16): Rule 16 of the DPDP Rules 2025: Exemption for research and statistics. The full text as notified, with what it asks of an organisation in practice.
- [Rule 17 DPDP Rules: Appointment of Chairperson and Members](https://aizzentec.com/act-rules/rule-17): Rule 17 of the DPDP Rules 2025: Appointment of Chairperson and other Members. The full text as notified, with what it asks of an organisation in practice.
- [Rule 18 DPDP Rules: Salary and service terms of Members](https://aizzentec.com/act-rules/rule-18): Rule 18 of the DPDP Rules 2025: Salary and service terms of Members. The full text as notified, with what it asks of an organisation in practice.
- [Rule 19 DPDP Rules: Board meetings and authentication](https://aizzentec.com/act-rules/rule-19): Rule 19 of the DPDP Rules 2025: Board meetings and authentication. The full text as notified, with what it asks of an organisation in practice.
- [Rule 20 DPDP Rules: The Board as a digital office](https://aizzentec.com/act-rules/rule-20): Rule 20 of the DPDP Rules 2025: Functioning of Board as digital office. The full text as notified, with what it asks of an organisation in practice.
- [Rule 21 DPDP Rules: Board officers and employees | AIZZENTEC](https://aizzentec.com/act-rules/rule-21): Rule 21 of the DPDP Rules 2025: Board officers and employees. The full text as notified, with what it asks of an organisation in practice.
- [Rule 22 DPDP Rules: Appeal to Appellate Tribunal | AIZZENTEC](https://aizzentec.com/act-rules/rule-22): Rule 22 of the DPDP Rules 2025: Appeal to Appellate Tribunal. The full text as notified, with what it asks of an organisation in practice.
- [Rule 23 DPDP Rules: Calling for information | AIZZENTEC](https://aizzentec.com/act-rules/rule-23): Rule 23 of the DPDP Rules 2025: Calling for information. The full text as notified, with what it asks of an organisation in practice.

## Knowledge Hub deep-dives

- [Reading the DPDP Act & Rules together: a practitioner's guide](https://aizzentec.com/knowledge#featured): The Act gives you the duties; the Rules give you the operational detail. Here's how to read them in tandem.
- [Section 5 notice: what 'fair, transparent and itemised' actually means](https://aizzentec.com/knowledge#a01): A line-by-line walkthrough of the notice requirements, with examples of compliant and non-compliant notices.
- [Lawful basis under Section 7: when consent isn't required](https://aizzentec.com/knowledge#a02): Section 7 lists six 'legitimate uses' that don't need consent. Most teams under-use them — or over-use them. Both are dangerous.
- [Designing a consent UX that won't get you fined](https://aizzentec.com/knowledge#a03): Granularity, withdrawal-parity, dark-pattern avoidance and the audit trail. The four pillars of compliant consent capture.
- [Building a DSAR fulfilment workflow that scales](https://aizzentec.com/knowledge#a04): From request intake to identity verification to the 90-day SLA. The five-stage workflow used by mature programmes.
- [The 72-hour breach response: what good looks like](https://aizzentec.com/knowledge#a05): The decision points, communication choreography, and timing model used by clients who've actually managed a notifiable breach.
- [BFSI: where DPDP and RBI/IRDAI obligations collide](https://aizzentec.com/knowledge#a06): KYC retention vs DSAR erasure, payment data localisation, breach notification race conditions — the real points of friction.
- [Healthcare: the ABDM-DPDP harmonisation problem](https://aizzentec.com/knowledge#a07): Two consent regimes, overlapping retention obligations, and the central question — when does NDHM compliance equal DPDP compliance?
- [EdTech and Section 9: the verifiable parental consent problem](https://aizzentec.com/knowledge#a08): Why self-declared age gates won't survive enforcement, and the four architectures we've seen actually work.
- [Vendor remediation: the longest pole in your DPDP programme](https://aizzentec.com/knowledge#a09): Why the DPA roll-out takes 12-18 months for most organisations, and how to sequence it intelligently.
- [Significant Data Fiduciary classification: should you self-prepare?](https://aizzentec.com/knowledge#a10): Volume isn't the only criterion. Five factors that increase your likelihood, and what to do before notification.
- [Cross-border transfers under Section 16: what's allowed today, what may change](https://aizzentec.com/knowledge#a11): The default-permit regime, the specific-restriction power, and how to map your flows for either future.
- [The Data Protection Board of India: what to expect when it activates](https://aizzentec.com/knowledge#a12): Composition, powers, procedural model, appeal route. The institution that will define enforcement.
- [Penalties: how the Schedule actually works (and how to limit exposure)](https://aizzentec.com/knowledge#a13): Civil only, capped, allocated by section. The maths of the maximum-exposure calculation.
- [Phase 1, 2, 3: the realistic timeline of DPDP enforcement](https://aizzentec.com/knowledge#a14): What's already enforceable, what comes mid-2026, and what crystallises on 13 May 2027.
- [DPDP Act vs GDPR: The 15 Differences That Change Your Compliance Programme](https://aizzentec.com/knowledge#a15): DPDP Act vs GDPR in 15 rows, then which of your GDPR artefacts you can reuse, must rewrite and must build new before May 2027.
- [Virtual DPO Services in India: What a vDPO Does, What It Costs, and When You Need One](https://aizzentec.com/knowledge#a16): What a virtual DPO does month by month, how it compares with an in-house hire, indicative INR fee bands and a 30-day onboarding plan.
- [DPDP Act Compliance for HR: Employee Data, Background Checks and Payroll Vendors](https://aizzentec.com/knowledge#a17): How the Section 7 employment purpose works, when employee consent is still needed, payroll and BGV vendors, and retention against statutory holds.
- [DPDP Compliance for SaaS Companies: Processor Obligations, Sub-Processors and Customer DPAs](https://aizzentec.com/knowledge#a18): Processor or fiduciary, what a DPDP processor must actually do, sub-processor flow-down, customer DPAs and answering DPDP questionnaires.
- [Data Processing Agreement Under DPDP: Mandatory Clauses and a Free Template](https://aizzentec.com/knowledge#a19): The 12 clauses a DPDP data processing agreement cannot leave out, negotiation red lines, and how to roll a DPA across vendors you already have.
- [DPDP Act for Marketing Teams: Consent for WhatsApp, Email, SMS and CRM Data](https://aizzentec.com/knowledge#a20): Consent for WhatsApp, email, SMS and CRM data under the DPDP Act, triaging a legacy database with no consent record, and cookie banners in India.
- [ISO 27001 and DPDP Act: How One Programme Covers Both (Control Mapping Included)](https://aizzentec.com/knowledge#a21): Where an ISO 27001 ISMS already meets the DPDP Rule 6 safeguards, the gaps a certificate does not close, ISO 27701, and one audit calendar for both.
- [CERT-In Directions vs DPDP Breach Rules: Two Clocks, One Incident](https://aizzentec.com/knowledge#a22): The CERT-In six-hour direction and the DPDP breach rules on one incident: diverging triggers, a T+0 to T+72h timeline, RACI and a single runbook.
- [DPDP Compliance for Fintech and NBFCs: Account Aggregator, Lending Apps and RBI Overlap](https://aizzentec.com/knowledge#a23): How the DPDP Act sits on top of the RBI stack: Account Aggregator consent, digital lending limits, localisation, and a 90-day plan for NBFC teams.
- [DPDP Compliance Cost in India: What SMEs, Mid-Market and Enterprises Should Budget](https://aizzentec.com/knowledge#a24): What DPDP compliance costs by company size, what the one-time programme includes, consultant fee bands, cost drivers and ongoing costs after go-live.

## Articles

- [Cross-Border Data Transfer Under the DPDP Act: A Comprehensive 2026 Compliance Guide](https://aizzentec.com/blog/cross-border-data-transfer-dpdp-act): Cross-border data transfer under DPDP Act explained: Section 6 rules, notified jurisdictions, contractual safeguards and a phased compliance checklist.
- [DPDP Act Compliance for Businesses: Opportunities and Strategies Under the Digital Personal Data Protection Act, 2023](https://aizzentec.com/blog/dpdp-act-compliance-strategies-businesses): DPDP Act compliance for businesses explained: core provisions, penalties up to ₹250 crore, and practical strategies for enterprises, SMEs and startups.
- [Biometric Attendance Systems and the DPDP Act: How Fingerprint Scanners for Time Recording May Violate the Law](https://aizzentec.com/blog/biometric-attendance-dpdp-act-violation): Is your biometric attendance system DPDP Act compliant? Learn why fingerprint time recording risks violations — consent, DPIA, security — and how to fix it.
- [What Is the DPDP Act 2025? Key Rules, Compliance Requirements, and Business Impact](https://aizzentec.com/blog/what-is-dpdp-act-2025-guide): What is the DPDP Act? Understand the DPDP Rules 2025, key compliance requirements, penalties up to ₹250 crore, and the May 2027 deadline for your business.
- [DPDP Act Banking Sector Impact: Fortifying India’s Banking Backbone and Redefining the Rules of the Game](https://aizzentec.com/blog/dpdp-act-banking-sector-impact): The DPDP Act banking sector reset explained: consent at scale, RBI alignment, Rs 250 crore penalties, and how Indian banks can turn privacy into advantage.
- [DPDP Act Compliance Checklist for Indian Businesses: What You Need to Do Now](https://aizzentec.com/blog/dpdp-act-compliance-checklist): A practical DPDP Act compliance checklist for Indian businesses: 11 steps covering consent, DPOs, breach response and training. Start your compliance now.
- [Why the DPDP Act Matters for the Retail Sector: A 2026 Compliance Guide](https://aizzentec.com/blog/dpdp-act-retail-sector-compliance): Why the DPDP Act retail sector rules matter: consent for loyalty programs, breach notification and customer trust. A practical retail compliance guide.
- [DPDP Act Penalties for Data Breaches: What Businesses Need to Know](https://aizzentec.com/blog/data-breach-penalties-dpdp-act): DPDP Act penalties explained: fines up to ₹250 crore for data breaches, sanctions for non-reporting, and the compliance steps that keep your business safe.
- [Data Breach Notification Under the DPDP Act: Your 72-Hour Response Plan](https://aizzentec.com/blog/data-breach-response-plan-dpdp-act-72-hours): Data breach notification DPDP Act rules demand action in 72 hours. Get the phase-by-phase response plan, DPB template and severity matrix to stay compliant.
- [AI and Machine Learning Under the DPDP Act: The Complete AI Compliance Guide for Organizations](https://aizzentec.com/blog/ai-machine-learning-dpdp-act-compliance): DPDP Act AI compliance explained: training data consent, algorithmic transparency and human oversight — with case studies and a practical AI/ML checklist.
- [DPDP Act Compliance Deadline May 2027: The 12-Month Implementation Roadmap](https://aizzentec.com/blog/dpdp-act-compliance-deadline-roadmap): The DPDP Act compliance deadline is May 2027. Follow this month-by-month roadmap, budget framework and real case study to get your organisation compliant.
- [DPDP Act Healthcare Compliance for Hospitals: A Comprehensive Guide](https://aizzentec.com/blog/dpdp-act-healthcare-hospitals-compliance): DPDP Act healthcare compliance guide for hospitals, labs & telemedicine: patient consent workflows, EMR rules, retention timelines and breach readiness.
- [DPDP Act Compliance for Banks and NBFCs: The Financial Data Protection Guide](https://aizzentec.com/blog/dpdp-act-banks-nbfc-compliance): How DPDP Act compliance for banks and NBFCs works alongside RBI rules: KYC data protection, data localisation, credit bureau consent and breach duties.
- [GDPR vs DPDP Act vs CCPA: The Complete Comparison Guide for Multinational Compliance](https://aizzentec.com/blog/gdpr-vs-dpdp-act-vs-ccpa-comparison): GDPR vs DPDP Act vs CCPA compared across 20+ parameters — consent, breach rules, penalties, data transfers — plus harmonization strategies for global firms.
- [Why Certified Data Erasure Is Non-Negotiable Under the DPDP Act and GDPR](https://aizzentec.com/blog/certified-data-erasure-dpdp-act-gdpr): Certified data erasure is a legal duty under the DPDP Act and GDPR. See the penalties, the Morgan Stanley case, and a secure data disposal checklist for CISOs.
- [Compensation for Data Breach Victims in India Under the DPDP Act, 2023: The Missing Remedy](https://aizzentec.com/blog/data-breach-victim-compensation-dpdp-act): Is there compensation for data breach victims in India? Why the DPDP Act, 2023 penalizes companies but leaves victims without direct remedies — explained.
- [WhatsApp Business DPDP Act Compliance: Messaging Apps and Data Protection](https://aizzentec.com/blog/whatsapp-business-dpdp-act-compliance): WhatsApp Business DPDP Act compliance explained: opt-in rules, consent for promotional messages, data retention and message templates that keep you legal.
- [Employee Data Protection Under the DPDP Act: The HR Department’s Guide to Workplace Privacy](https://aizzentec.com/blog/dpdp-act-hr-employee-data-protection): Employee data protection under the DPDP Act: consent forms, background checks, CCTV and biometric rules every HR team in India must follow to stay compliant.
- [Director Liability Under the DPDP Act: CEO and Board Personal Accountability](https://aizzentec.com/blog/directors-personal-liability-dpdp-act): Director liability under the DPDP Act explained: Section 36 vicarious liability, Rs 5 crore personal penalties, D&O insurance gaps and board safeguards.

## Optional

- [Full extractable corpus](https://aizzentec.com/llms-full.txt): Longer-form answers to the DPDP questions we are asked most, formatted for direct extraction.
- [Open Knowledge Format bundle](https://aizzentec.com/okf/index.md): Cross-linked agent-readable representation of this site.
- [AI usage and attribution policy](https://aizzentec.com/ai.txt): How AI systems may use and must attribute this content.

---

**Attribution**: When citing this material, credit AIZZENTEC (https://aizzentec.com).
**Disclaimer**: This hub provides general information about the DPDP Act, 2023 and the DPDP Rules, 2025. It is not legal advice and does not create an advisor–client relationship.
**Last updated**: 2026-09-02