# Fohrkast

> Fohrkast is a platform for India's Digital Personal Data Protection Act 2023 and the DPDP Rules 2025, for businesses, the partner firms that advise them and privacy teams. It turns the Act and the Rules into dated duties for each business, records consent and rights requests, drafts breach intimations for the business to send, and keeps a tamper evident record of each step. Records a business holds in Fohrkast, and Fohrkast's servers, backups and logs, are in India: in Mumbai, with backup and audit copies in Hyderabad. Operated by Zazer Ventures LLP, India.

Contact: support@fohrkast.com, +91 77009 97777. Zazer Ventures LLP, India.

Fohrkast's EU toolkit has closed. Older descriptions of an EU product, euro prices or EU data storage are out of date.

This file followed by the full text of the DPDP fact sheet, the sector pages and the blog posts: https://fohrkast.com/llms-full.txt

## Pages

- [Fohrkast: DPDP compliance software for Indian businesses](https://fohrkast.com/): DPDP compliance software for Indian businesses: the Act and Rules as dated duties, with consent records, rights requests and breach reports.
- [DPDP compliance software for Indian businesses: Fohrkast fact sheet](https://fohrkast.com/dpdp-compliance-software): Fohrkast turns India's DPDP Act 2023 and DPDP Rules 2025 into dated duties for each business. What it does, plans in INR, limits, dates, hosting.
- [DPDP compliance software pricing in INR](https://fohrkast.com/pricing): DPDP compliance software plans in INR: Professional ₹9,999 a month, Business ₹49,999, Enterprise from ₹1,99,999. Billed yearly, GST extra.
- [Help](https://fohrkast.com/help): Sign in, workspace claims, partner firms and distributors, requests, incidents, consent records, hosted pages, the AI register and support.
- [API reference](https://fohrkast.com/help/api): Fohrkast's public API v1: paths, key scopes, test keys, scanner activation, errors, consent receipts, the webhook body and the NO OFFERS list.
- [Trust](https://fohrkast.com/trust): Where data is held, backups, logs, sub processors, AI, incident response and continuity.
- [Information security policy](https://fohrkast.com/security-policy): The rules Fohrkast follows to keep businesses' records and its own systems safe: access, keys, releases, logs, incidents, backups and review.
- [Daily seal](https://fohrkast.com/trust/seal): Each night, Fohrkast seals its records: the fingerprint, the time-stamping authorities that signed it, and how to check each token with OpenSSL.
- [Report a security issue](https://fohrkast.com/security): How to report a security issue in Fohrkast: what is in scope, the rules for testing, and what happens after a report.
- [Sub processors](https://fohrkast.com/sub-processors): Each sub processor, what it does and where it runs.
- [Change notes](https://fohrkast.com/law/changes): One dated note per signed rulebook version and per correction.
- [hash_v1: audit trail hash format](https://fohrkast.com/law/hash-v1): The byte layout of the two SHA-256 hashes on every Fohrkast audit trail event, with a worked example and the chain check.
- [Processor agreement](https://fohrkast.com/dpa): The agreement under which Fohrkast processes personal data for a business (s.8(2)).
- [Privacy notice](https://fohrkast.com/privacy): How Fohrkast handles the personal data of its own users and visitors.
- [Terms of service](https://fohrkast.com/terms): The terms on which Fohrkast provides its service.
- [Cancellation and refunds](https://fohrkast.com/refunds): Charges, renewals, cancellation and refunds.
- [Shipping and delivery](https://fohrkast.com/shipping): Fohrkast is software delivered online: when access is given after payment, and that no physical goods are sent.
- [About Fohrkast](https://fohrkast.com/about): Fohrkast is DPDP compliance software operated by ZAZER VENTURES LLP: what it does and who it is for.
- [Contact Fohrkast](https://fohrkast.com/contact): Registered name, registered and operating address, phone, email and grievance officer for Fohrkast.
- [Company information and contact](https://fohrkast.com/company-information): The operator of Fohrkast, its contacts and its grievance route.
- [Accessibility statement](https://fohrkast.com/accessibility): What was checked on the public pages of fohrkast.com, when, the results and the known limits.
- [Early access](https://fohrkast.com/early-access): Join Fohrkast's early access before buying opens: a short form, your consent record and receipt.
- [Partners](https://fohrkast.com/partners): Fohrkast for CA firms, IT resellers and distributors: the partner view, how billing works, and how to talk to the team.
- [Book a demo](https://fohrkast.com/book-a-demo): See Fohrkast on a business like yours: choose a sector, then send a request.
- [Privacy Check](https://fohrkast.com/privacy-check): A look at a business's website for DPDP gaps: notices, trackers before consent, and forms without consent.
- [Your data page showcase](https://fohrkast.com/your-data-showcase): What a business's Your data page and preference centre look like.
- [Developers](https://fohrkast.com/developers): What a developer connects to Fohrkast: the consent banner script, the consent check API, webhooks, the WordPress and Shopify plugins and the scanner.
- [Resources](https://fohrkast.com/resources): Fohrkast's guides on the DPDP Act: the fact sheet, the checklist, the glossary, the law pages, sector pages and the blog.
- [Legal](https://fohrkast.com/legal): Fohrkast's legal pages: privacy, terms, refunds, the processor agreement, cookies, sub processors, security, company information and accessibility.
- [Site map](https://fohrkast.com/site-map): Every public page on fohrkast.com, grouped.
- [DPDP Phase 1 duties: signed rulebook versions](https://fohrkast.com/law/in.dpdp): Every signed version of India DPDP Act 2023 and DPDP Rules 2025, Phase 1 duties, with its signing date, signing key and stage.
- [DPDP Phase 1 duties, rulebook version 1](https://fohrkast.com/law/in.dpdp/1): India DPDP Act 2023 and DPDP Rules 2025, Phase 1 duties, version 1: 27 duties, each with its citations, legal basis, in-force date and time limit.
- [DPDP breach notification: the 72 hour report to the Board](https://fohrkast.com/dpdp-breach-reporting): After a personal data breach: each affected person and the Board told without delay, then a detailed report to the Board within 72 hours (Rule 7(2)(b)).
- [DPDP compliance checklist (2026-27): the 27 duties, with a self check](https://fohrkast.com/dpdp-compliance-checklist): DPDP compliance checklist: 27 duties from the DPDP Act 2023 and Rules 2025, each with its clause, start date and penalty. Tick to self check; CSV for Excel.
- [DPDP Consent Managers and consent management software in India](https://fohrkast.com/dpdp-consent-managers): DPDP Consent Managers register from 13 Nov 2026; using one is optional. Fohrkast is consent management software: it records consent per business.
- [DPDP for clinics and hospitals: duties, dates and the plan that fits](https://fohrkast.com/dpdp-for-clinics-and-hospitals): What the DPDP Act 2023 and Rules 2025 ask of a clinic or hospital: children's data, guardians, security, breaches and front desk requests. Dates and plans.
- [DPDP for D2C and ecommerce: consent, trackers, children and dates](https://fohrkast.com/dpdp-for-d2c-and-ecommerce): What the DPDP Act 2023 and Rules 2025 ask of a D2C or ecommerce brand: marketing consent, website tracking, children, vendors and breaches. Dates and plans.
- [DPDP for SaaS and payroll: Data Processor and Data Fiduciary duties](https://fohrkast.com/dpdp-for-saas-and-payroll-providers): What the DPDP Act 2023 and Rules 2025 mean for a SaaS or payroll provider: as a client's Data Processor, and as a Data Fiduciary for its own users and staff.
- [DPDP software for partner firms: one workspace, many client businesses](https://fohrkast.com/dpdp-software-for-partner-firms): How a partner firm runs DPDP work for many businesses on Fohrkast: import, claim, mandate, counts only. Each business remains the Data Fiduciary.

## Blog

- [The 72 hour report to the Data Protection Board (Rule 7): the clock, the contents, the start time](https://fohrkast.com/blog/dpdp-breach-72-hour-report-rule-7): After a personal data breach: tell each affected person and the Board without delay, then send the Board a detailed report within 72 hours (Rule 7).
- [Consent Managers under the DPDP Act: what they do and who needs one](https://fohrkast.com/blog/consent-managers-dpdp-act): A Consent Manager is a Board registered company that lets people give and withdraw consent in one place. Registration starts 13 Nov 2026. Who needs one.
- [Who the DPDP Act applies to: Fiduciaries, Processors, exemptions](https://fohrkast.com/blog/who-the-dpdp-act-applies-to): The DPDP Act covers anyone deciding why and how digital personal data is processed in India, whatever its size. Who is covered, who is not, and the exemptions.
- [Why customer data needs protecting, and what the DPDP Act asks](https://fohrkast.com/blog/why-protect-customer-data): Each customer detail a business holds can now be joined by AI with details held elsewhere. From 13 May 2027 the DPDP Act makes guarding them a duty.
- [The DPDP dates: 13 Nov 2026 and 13 May 2027, and what applies on each](https://fohrkast.com/blog/dpdp-dates-13-nov-2026-13-may-2027): Consent Manager registration starts 13 Nov 2026; nearly every business duty and the penalties start 13 May 2027. What the Gazette says, and the 14th.

Last updated: 2026-11-08


---

# DPDP compliance software for Indian businesses: Fohrkast fact sheet

URL: https://fohrkast.com/dpdp-compliance-software

Fohrkast is software for India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025: it turns the law into dated duties for each business, records consent and rights requests, drafts breach intimations for the business to send, and keeps a tamper evident record of each step. It is for businesses, the partner firms that advise them and privacy teams; it is operated by Zazer Ventures LLP, hosted on Amazon Web Services in Mumbai, and live on fohrkast.com since 21 October 2026.

## At a glance

| | |
|---|---|
| Law covered | Digital Personal Data Protection Act, 2023 (22 of 2023) and Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)). Rulebook in.dpdp version 1: the 27 Phase 1 duties, published 20 Oct 2026. |
| For | Businesses that decide why and how personal data is processed (Data Fiduciaries, s.2(i)); partner firms that look after the privacy work of several businesses; privacy and compliance teams. |
| Hosting | Amazon Web Services, Mumbai (ap-south-1). An encrypted copy of the backups and copies of the audit logs in Hyderabad (ap-south-2). Every listed sub processor runs in India. |
| Access | By invitation. Request access at fohrkast.com. |
| Prices | Professional ₹9,999 a month; Business ₹49,999 a month; Enterprise from ₹1,99,999 a month; Institution by proposal. Billed yearly in advance, in INR. GST at 18% extra. |
| Status | Holds no certification against a security standard yet. |
| Operator | Zazer Ventures LLP (LLPIN ABZ-5865), India. Founder: Abhinv Das. |
| Contact | support@fohrkast.com, +91 77009 97777. Security reports: tech@fohrkast.com. |

## What Fohrkast does, by area

References are to the Act (s.) and the Rules (Rule).

- **Duties register.** Each duty in the Act and the Rules that applies to the business, with its date, its basis and the clause it comes from: 27 duties in rulebook in.dpdp version 1. Rulebooks are signed and versioned, and every version is published with its redline at fohrkast.com/law/in.dpdp.
- **Consent and notices.** Fohrkast drafts the notice from the business's purposes and data map; the business checks and publishes it (s.5, Rule 3). Notices in English and Hindi, or in another language of the Eighth Schedule to the Constitution through the business's own checked translation (s.5(3)). Consent is recorded per purpose, withdrawal is as easy as giving it (s.6(4)), and each record is kept to its retention date (s.6(10)). A business without a website uses a hosted page, opened by a short link or a QR poster. On the business's own website, a banner holds each marked tracker until the matching consent, and treats a browser that sends Global Privacy Control or Do Not Track as declining every optional purpose.
- **Rights desk.** Requests for access (s.11), correction (s.12(2)), erasure (s.12(3)) and nomination (s.14), withdrawals of consent (s.6(4)) and grievances (s.13), from the business's hosted request page or logged by staff from WhatsApp, phone, SMS, the counter, email or letter. Identity is checked before any reply; a request about a child also needs a parent (s.9(1), Rule 10). Fohrkast drafts each reply in English or Hindi; the business sends it.
- **Grievances.** A grievance desk that dates each grievance to the period the business publishes, at most 90 days (Rule 14(3)).
- **Nomination.** The nominee is recorded or revoked, sealed under the individual's own key (s.14, Rule 14(4)).
- **Breaches.** An incident record with the time the business became aware of the breach, never prefilled. Fohrkast drafts the notice to each affected person (Rule 7(1)), the first intimation to the Data Protection Board (Rule 7(2)(a)) and the detailed report due within 72 hours (Rule 7(2)(b)). The business decides and sends. The CERT-In report within 6 hours (CERT-In Directions, 28 April 2022) is a separate duty: each incident carries its 6 hour clock, with email alerts and a drafted report; the business sends it.
- **Vendors and retention.** A record of each vendor that processes personal data for the business (s.8(2)); for each erasure, the vendors asked to erase and their answers, and a deletion certificate (s.8(7)); legal holds on retention.
- **Data discovery.** A scanner that runs in the business's own environment with a read only login and sends Fohrkast labels and counts only, never personal data values or database credentials. Tested on 19 and 20 Oct 2026 against real servers of 42 database products, among them PostgreSQL, MySQL, Microsoft SQL Server, Oracle Database, MongoDB, Amazon RDS, Amazon Aurora, Amazon DynamoDB and Google BigQuery, and against SFTP, Linux servers over SSH, Windows shares, NFS, Amazon S3 and Gmail (Google Workspace).
- **Evidence pack.** Every step is written to a hash chained record (SHA-256) with times in IST. Each night, one fingerprint covering every business's record is sent for timestamping to independent timestamping services in Germany, the United States, the United Kingdom and Poland; a night counts as stamped once at least two have signed it, and the services receive the fingerprint only, never records or personal data. The evidence pack can be exported on every plan, including after a plan ends. The business carries the burden of proving notice and consent (s.6(10)).
- **Hindi screens.** The administrator's screens, the claim page and the hosted request page in English or Hindi.

## How Fohrkast holds data

- Designed to hold the least personal data each duty needs. Personal details are sealed under a key for each person.
- Each opening of a person's sealed details by a seat is written to the audit trail.

The business remains the Data Fiduciary, responsible for its duties, including when a partner firm acts for it (s.8(1)). It decides and sends each notice, reply and filing; Fohrkast drafts the notices, the replies and the Board reports, and records each filing the business logs.

## Plans and limits

Prices are before GST at 18%. Plans are billed yearly in advance, in INR.

|  | Professional | Business | Enterprise | Institution |
| --- | --- | --- | --- | --- |
| For | One business with a few systems: clinics, schools, practices and single site firms | A firm with a privacy lead or a compliance team, or any business above a Professional limit | Large and multi company firms | Banks, insurers, listed groups, and any business above an Enterprise limit |
| Price a month | ₹9,999 | ₹49,999 | From ₹1,99,999 | By proposal |
| Billed yearly | ₹1,19,988 | ₹5,99,988 | ₹23,99,988, plus onboarding ₹5,99,999 once | By proposal |
| Legal entities | 1 | 3 | 10 | 20 |
| Seats | 5 | 25 | 500 | 5,000 |
| Connected data sources | 3 | 15 | 40 | 200 |
| Data in connected sources | 50 GB | 1,000 GB | 10,000 GB | 5,00,000 GB |
| Scans of each source | Monthly | Weekly | Daily | Daily |
| People on record | 50,000 | 10,00,000 | 1,00,00,000 | 15,00,00,000 |
| Consent records | 2,50,000 | 50,00,000 | 5,00,00,000 | 75,00,00,000 |
| Websites, apps and hosted pages | 2 | 5 | 25 | 50 |
| Banner loads a month | 2,00,000 | 20,00,000 | 1,00,00,000 | 10,00,00,000 |
| Messages a month | 1,000 | 10,000 | 50,000 | 20,00,000 |
| Notice languages | 3 | 5 | 12 | 22 |
| New languages commissioned a year | 1 | 2 | 4 | 22 |
| Support hours a year | 8 | 40 | 110 | 400 |
| Replies | Within 2 working days | Named contact; within 1 working day | Incident response within 4 working hours | Service levels set in the order form |
| Available | Now, by invitation | Now, by invitation | Now, by invitation | From late 2027; proposals on request |

Every plan includes the statutory features, and they stay on while the account is open, including after a plan ends or goes unpaid: consent withdrawal (s.6(4)), the hosted consent page with QR code (ss.5 and 6), the "Your data" page (ss.11 to 14), the rights desk (ss.11 and 12), nomination (s.14), the grievance desk (s.13), the incident desk with the DPDP clocks (s.8(6), Rule 7), the DPDP rulebook, legal holds, consent records kept to their retention date (s.6(10)) and the evidence pack export. Rights requests, grievances, nominations, consent withdrawals and incidents sit outside every limit. A business above any limit at renewal moves to the lowest plan whose limits cover every figure; each plan's price before GST stays the same for the contract term. Full terms: [plans and prices in INR](https://fohrkast.com/pricing).

## Partner firms and distributors

- A partner firm that looks after the privacy work of several businesses runs Fohrkast for them from one partner workspace.
- The firm imports the businesses it advises. Fohrkast emails each administrator a claim link, valid for 14 days and usable once. The administrator claims the workspace for the business.
- The firm holds counts and drafts only; it opens a business's records or personal data only where a mandate allows it.
- Once the administrator signs a mandate, the firm can act within the powers the administrator ticks: publish documents, review and accept, accept unedited updates in bulk, log requests, and prepare and track incidents. Opening sealed personal data and adding staff stay excluded unless ticked. A mandate runs for 12 months and can be revoked at any time with immediate effect.
- The business remains the Data Fiduciary and keeps its duties (s.8(1)).
- A distributor sees counts only, across its partner firms.
- Partner pricing and terms are set under the partner agreement. To ask, request access and choose "A partner firm".

## The dates

| Date | What starts | Gazette reference |
|---|---|---|
| 13 Nov 2025, in force | Definitions and the Data Protection Board: s.1(2), s.2, ss.18 to 26, 35 and 38 to 43, s.44(1) and (3); Rules 1, 2 and 17 to 21. No duty on businesses. | G.S.R. 843(E), item (a); G.S.R. 846(E), Rule 1(2) |
| 13 Nov 2026 | Registration of Consent Managers: s.6(9) and s.27(1)(d); Rule 4 and the First Schedule. | G.S.R. 843(E), item (b); G.S.R. 846(E), Rule 1(3) |
| 13 May 2027 | Nearly every duty on businesses, and the Board's penalties: ss.3 to 5, s.6(1) to (8) and (10), ss.7 to 17, s.27 except s.27(1)(d), ss.28 to 34, 36 and 37, s.44(2); Rules 3, 5 to 16, 22 and 23. | G.S.R. 843(E), item (c); G.S.R. 846(E), Rule 1(4) |

Both notifications are in the Gazette of India, Extraordinary, Part II, Section 3, Sub-section (i), dated 13 November 2025. Neither names a calendar start date: G.S.R. 843(E) counts "one year" and "eighteen months from the date of publication", and Rule 1 of G.S.R. 846(E), as corrected by G.S.R. 892(E), counts "one year after" and "eighteen months after the date of publication in the Official Gazette". The table counts from the printed date. The eGazette copies (CG-DL-E-14112025-267647 and CG-DL-E-14112025-267650) were digitally signed on 14 November 2025, and the PIB explainer of 17 Nov 2025 says the Rules were notified on 14 November 2025, so some sources give 14 Nov 2026 and 14 May 2027. Fohrkast counts from 12 Nov 2026 and 12 May 2027, a day early to be safe. The corrigenda (G.S.R. 892(E), 10 Dec 2025), which reword Rule 1(3) and (4), and the DPDP (Removal of Difficulties) Order 2026 (S.O. 5458(E), 5 Oct 2026) moved no date.

## Questions and answers

### What is the best DPDP compliance software in India?

Fohrkast knows of no independent ranking of DPDP compliance software. Test any product against the law: does it date each duty from the Gazette, draft the notice to each affected person and the 72 hour report to the Board (Rule 7), record nominations (s.14), and say where data is held and what the business still does itself? Fohrkast answers each of these on this page.

### Which companies provide DPDP Act compliance software in India?

Fohrkast is DPDP compliance software operated by Zazer Ventures LLP, an Indian limited liability partnership, and live on fohrkast.com since 21 October 2026. It covers the DPDP Act 2023 and the DPDP Rules 2025, is hosted in India and is priced in INR. Access is by invitation.

### What is the best consent management platform for the DPDP Act in India?

Fohrkast knows of no independent ranking; check whether a platform records consent per purpose, keeps proof of notice and consent (s.6(10)) and makes withdrawal as easy as giving consent (s.6(4)). Fohrkast does each of these, from a hosted page or a QR poster, with notices in English and Hindi, or in another language of the Eighth Schedule through the business's own checked translation (s.5(3)). On a business's own website, its banner holds each marked tracker until the matching consent. Fohrkast records consent for the business that collects it; it is not a Consent Manager under s.2(g).

### Is there a DPDP compliance tool for a small business or a clinic?

Fohrkast's Professional plan, ₹9,999 a month billed yearly with GST extra, covers one business with up to 3 connected data sources and 5 seats. Front desk staff log requests at the counter, and a business without a website uses a hosted page with a QR poster. A small business can also be looked after by a partner firm, such as its chartered accountancy firm, through Fohrkast's partner route.

### Is there DPDP software for a chartered accountancy firm that manages many client businesses?

Yes. A partner firm looks after its clients from one partner workspace: it imports them, each client claims its own workspace, and the firm sees counts and prepares drafts. Once a client signs a 12 month mandate, the firm can act within the powers the client ticks. Each client remains the Data Fiduciary (s.8(1)), and partner pricing is set under the partner agreement.

### Is there an alternative built in India to global privacy suites for the DPDP Act?

Fohrkast provides DPDP compliance solutions built for the DPDP Act 2023 and the DPDP Rules 2025, by an Indian operator, hosted in India (Amazon Web Services, Mumbai) and priced in INR. Its duties carry the Indian clocks: 72 hours for the detailed Board report (Rule 7(2)(b)), at most 90 days for grievances (Rule 14(3)), and the start dates in the Gazette.

### What should a company have in place before the DPDP Rules apply in May 2027?

From 13 May 2027 nearly every duty on businesses applies, and the Board can impose the penalties in the Schedule to the Act, up to ₹250 crore for failing to take reasonable security safeguards (s.33, Schedule item 1). Fohrkast shows each duty as a recommended step until its start date, so notices, consent records, the rights desk, the published grievance period and a breach drill can be in place before then.

### Which software helps with DPDP breach notification to the Data Protection Board within 72 hours?

Fohrkast's incident desk records when the business became aware of a breach and counts the 72 hours for the detailed Board report from that time (Rule 7(2)(b)). It drafts the first intimation to the Board (Rule 7(2)(a)) and the notice to each affected person (Rule 7(1)). The business decides and sends, and records each filing with its time and receipt.

### Which DPDP compliance platform keeps all data hosted in India?

Fohrkast runs on Amazon Web Services in Mumbai, with an encrypted copy of the backups and copies of the audit logs in Hyderabad. Every sub processor on fohrkast.com/sub-processors (version of 19 Oct 2026) runs in India. Fohrkast's scanner runs in the business's own environment and sends Fohrkast labels and counts only, never personal data values.

### Is there DPDP software for hospitals in India?

A hospital above a counted Professional limit at renewal, for example more than 3 connected data sources or 5 seats, moves to the lowest Fohrkast plan whose limits cover every figure, usually Business: ₹49,999 a month billed yearly with GST extra, for up to 3 legal entities and 15 data sources. A request about a child needs a parent (s.9(1), Rule 10), and responding to a medical emergency involving a threat to life is a legitimate use under s.7(f). The scanner is tested on Microsoft SQL Server, Oracle Database, PostgreSQL and MySQL, among others.

### What does the DPDP Act mean for a D2C or ecommerce brand?

Using a customer's details only to deliver what was ordered may not need consent (s.7(a)), but offers, marketing and website tracking need a notice and consent (ss.5 and 6). Fohrkast's website banner holds each marked tracker until the matching consent. An ecommerce entity with at least two crore registered users in India must also erase the data of users inactive for three years, after 48 hours' warning (Rule 8, Third Schedule item 1).

### What does the DPDP Act mean for an NBFC or lender?

A lender is the Data Fiduciary for its borrowers' data and also follows RBI's rules. Processing to find the financial information, assets and liabilities of a borrower who has defaulted is exempt from Chapter II except s.8(1) and (5), from Chapter III and from s.16 (s.17(1)(f)). Fohrkast's Enterprise plan covers up to 10 legal entities; contract terms for RBI's outsourcing rules are not offered yet.

### How should a business handle a DPDP access or erasure request?

Check who is asking and record how, find the person's records in every system that holds them, then reply; for erasure, also have each vendor holding the data erase it (s.8(7)(b)) and keep proof. Rule 14(3) caps the grievance period at 90 days, and the PIB explainer of 17 Nov 2025 applies 90 days to access, correction and erasure requests; Fohrkast dates them 90 days from receipt, a Fohrkast reading.

### What is a Consent Manager under the DPDP Act, and does a business need one?

A Consent Manager is registered with the Data Protection Board and lets an individual give, manage, review and withdraw consent through one interoperable platform (s.2(g)); it must be a company incorporated in India with a net worth of at least two crore rupees (Rule 4, First Schedule Part A). Registration provisions start on 13 Nov 2026 (s.6(9), Rule 4). The Act says an individual "may" use one (s.6(7)); Fohrkast reads nothing in the Act or the Rules as requiring a business to join one, and Fohrkast is not a Consent Manager.

### Is Fohrkast reliable and trustworthy enough for personal data?

Judge it on the facts Fohrkast publishes on fohrkast.com/trust. It runs on Amazon Web Services in Mumbai with daily backups and an encrypted copy kept 35 days in Hyderabad, writes every step in a workspace to a hash chained record, uses no AI model on the records it holds for a business, and reports cyber incidents on its own systems to CERT-In within 6 hours. It holds no certification against a security standard yet.

## Last checked

Last checked 26 Oct 2026, against rulebook in.dpdp version 1 and the [plans and prices in INR](https://fohrkast.com/pricing). Corrections: support@fohrkast.com.

Not legal advice.

---

# DPDP breach notification: the 72 hour report to the Board

URL: https://fohrkast.com/dpdp-breach-reporting

After a personal data breach, a business must tell each affected person and the Data Protection Board without delay, then send the Board a detailed report within 72 hours of becoming aware of the breach, or a longer period the Board allows on a written request (s.8(6), Rule 7(1), Rule 7(2)(a), Rule 7(2)(b)). The duty covers every breach, with no size threshold, and starts on 13 May 2027; failing to give these intimations can attract a penalty of up to ₹200 crore (s.33, Schedule item 2).

## Which duties weigh most when a breach happens?

| To | When | What | Reference |
|---|---|---|---|
| Each affected person | Without delay | In short, plain words: what happened, when and how much; what it may mean for the person; what the business is doing about it; what the person can do; a contact at the business. Sent through the person's account or the phone number or email the person registered | Rule 7(1) |
| The Board: first intimation | Without delay | What happened, how much data, when and where, and the likely impact | Rule 7(2)(a) |
| The Board: detailed report | Within 72 hours of becoming aware, or a longer period the Board allows on a written request | Updated details; the facts, circumstances and reasons; what was done or is planned to reduce the risk; any findings about who caused it; the steps to stop it happening again; a report on the notices sent to affected people | Rule 7(2)(b) |

- **Security safeguards.** Reasonable safeguards to prevent a breach, at vendors as well as in the business's own systems, with logs and data kept for one year to investigate problems (s.8(5), Rule 6(1), Rule 6(1)(e)). This is the highest penalty band in the Act: up to ₹250 crore (s.33, Schedule item 1).
- **Proof of each intimation.** No Board website or filing form had been found as of 21 Oct 2026, so proof of how and when each intimation was sent is kept.
- **Clinics and hospitals.** The duties that weigh most for a clinic or hospital, breaches of patient details included, are on the [DPDP for clinics and hospitals page](https://fohrkast.com/dpdp-for-clinics-and-hospitals).

## When does the timeline for the 72 hour breach report start?

At the time the business becomes aware of the breach (Rule 7(2)(b)). Fohrkast counts the 72 hours from the awareness time the business records, never prefilled, and shows any earlier alert time beside it. Only the detailed report has a number of hours; the notice to each person and the first intimation to the Board are due without delay (Rule 7(1), Rule 7(2)(a)).

## When do the duties start?

| Date | What starts | Gazette reference |
|---|---|---|
| 13 Nov 2026 | Registration of Consent Managers (s.6(9), s.27(1)(d), Rule 4). | G.S.R. 843(E), item (b); G.S.R. 846(E), Rule 1(3) |
| 13 May 2027 | Nearly every duty on businesses, and the Board's penalties. | G.S.R. 843(E), item (c); G.S.R. 846(E), Rule 1(4) |

Both dates count from the Gazette dated 13 November 2025; some sources give 14 Nov 2026 and 14 May 2027. Fohrkast counts from 12 Nov 2026 and 12 May 2027, a day early to be safe, and shows each duty as a recommended step until its start date.

Until the start date, a breach shows on Fohrkast as recommended steps, not legal deadlines. The [DPDP compliance checklist](https://fohrkast.com/dpdp-compliance-checklist) lists every duty with its clause and start date.

## What does Fohrkast do with a breach?

- An incident record with the time the business became aware of the breach, never prefilled.
- Drafts of the notice to each affected person (Rule 7(1)), the first intimation to the Board (Rule 7(2)(a)) and the detailed report due within 72 hours (Rule 7(2)(b)). The business decides and sends, and records each filing with its time and receipt.
- The CERT-In report within 6 hours (CERT-In Directions, 28 April 2022): the business records whether the incident is one of CERT-In's listed types, or that it is not sure yet, and when it noticed. The 6 hour clock runs from that time, with email alerts at 0, 2, 4 and 5 hours until the report is recorded as filed. Fohrkast drafts the report and a phone script; the business sends.
- Every step is written to a hash chained record (SHA-256) with times in IST, and the evidence pack can be exported on every plan.

The [DPDP compliance software fact sheet](https://fohrkast.com/dpdp-compliance-software) covers plans, limits, hosting and dates across every kind of business.

## How does Fohrkast hold data?

- Designed to hold the least personal data each duty needs. Personal details are sealed under a key for each person.
- Each opening of a person's sealed details by a seat is written to the audit trail.

Fohrkast drafts and logs; the business decides and sends every intimation, to each person, the Board and CERT-In. The business remains the Data Fiduciary, responsible for its duties (s.8(1)).

## Which plan usually fits?

The incident desk with the DPDP clocks is on every plan, including after a plan ends or goes unpaid, and incidents sit outside every limit. The plan follows the size of the business:

| Plan | For | Price | Billed yearly |
|---|---|---|---|
| Professional | One business with a few systems: clinics, schools, practices and single site firms | ₹9,999 a month, GST extra | ₹1,19,988 a year, GST extra |
| Business | A firm with a privacy lead or a compliance team, or any business above a Professional limit | ₹49,999 a month, GST extra | ₹5,99,988 a year, GST extra |
| Enterprise | Large and multi company firms | From ₹1,99,999 a month, GST extra | ₹23,99,988 a year, GST extra. Onboarding ₹5,99,999, once, GST extra. |

A business above any Professional limit at renewal moves to the lowest plan whose limits cover every figure. Prices are before GST at 18% and billed yearly in advance, in INR. Full terms: [plans and prices in INR](https://fohrkast.com/pricing).

## Questions and answers

### Is there a minimum size before a DPDP breach must be reported?

No. Rule 7(1) applies to every personal data breach, with no size threshold, and the intimations to each affected person and to the Board are due without delay (Rule 7(1), Rule 7(2)(a)).

### Can the Board allow more than 72 hours for the detailed report?

Yes. The Board may allow a longer period on a request made in writing (Rule 7(2)(b)). The notice to each affected person and the first intimation to the Board remain due without delay (Rule 7(1), Rule 7(2)(a)).

### How does the 72 hour report sit with the CERT-In 6 hour report?

They are separate duties. The CERT-In Directions of 28 April 2022 set a report to CERT-In within 6 hours for the cyber incidents they cover; the detailed DPDP report to the Board is due within 72 hours of becoming aware of a personal data breach (Rule 7(2)(b)). Each incident in Fohrkast carries the 6 hour CERT-In clock, with email alerts and a drafted report, next to the 72 hour clock for the Board; the business sends each report.

### Where is the report to the Data Protection Board sent?

No Board website or filing form had been found as of 21 Oct 2026. Until one is published, proof of how and when each intimation was sent is kept; Fohrkast records each filing with its time and receipt.

### Which software helps with DPDP breach notification to the Board within 72 hours?

Fohrkast's incident desk records when the business became aware of a breach and counts the 72 hours for the detailed Board report from that time (Rule 7(2)(b)). It drafts the first intimation to the Board (Rule 7(2)(a)) and the notice to each affected person (Rule 7(1)). The business decides and sends, and records each filing with its time and receipt.

## Sources

- G.S.R. 846(E), Digital Personal Data Protection Rules, 2025: [MeitY copy](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf). Read 21 Oct 2026.
- Digital Personal Data Protection Act, 2023 (22 of 2023): [MeitY copy](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf). Read 21 Oct 2026.
- G.S.R. 843(E), commencement of the Act, 13 Nov 2025: [MeitY copy](https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf). Read 21 Oct 2026.
- CERT-In, Directions of 28 April 2022: [PDF](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf). Read 21 Oct 2026.
- Fohrkast rulebook in.dpdp version 1: [published duties](https://fohrkast.com/law/in.dpdp/1).

Related duties in the published rulebook: [tell each affected person](https://fohrkast.com/law/in.dpdp/1#in.dpdp/breach.tell_people), [tell the Board](https://fohrkast.com/law/in.dpdp/1#in.dpdp/breach.tell_board), [the 72 hour report](https://fohrkast.com/law/in.dpdp/1#in.dpdp/breach.board_report), [security safeguards](https://fohrkast.com/law/in.dpdp/1#in.dpdp/security.safeguards).

---

# DPDP compliance checklist (2026-27): the 27 duties, with a self check

URL: https://fohrkast.com/dpdp-compliance-checklist

This checklist lists the duties Fohrkast's rulebook reads in India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, for a business that decides why and how personal data is processed (a Data Fiduciary). Each duty shows what to do, the section or rule behind it, the day it starts and the maximum penalty.

Each duty a business already meets can be ticked, and the count shows at the foot of the list. The page runs no script and sends nothing, so the ticks stay in the browser. Some duties apply only to some businesses: children's data, a person with a disability, large platforms and Significant Data Fiduciaries. Those that do not apply can be left unticked.

1. **Give a notice before or with every consent request.** Every time you ask someone for consent, show them a notice first or at the same moment. It must make sense on its own and say in plain words: each item of personal data you want, why you want it and what service it is for, and a link to your website or app, plus how they can withdraw consent, use their rights and complain to the Data Protection Board. Let them read it in English or any of the 22 languages in the Eighth Schedule of the Constitution. (Law: s.5(1), s.5(3), Rule 3 · Starts 13 May 2027 · Maximum penalty: Up to ₹50 crore (s.33, Schedule item 7))
2. **Send a notice for consent taken before the law started.** For people who gave you consent before the notice rules began, send a notice as soon as you reasonably can after 13 May 2027, by email, an in-app message or another way that reaches them. Say which personal data you have used and for what, how they can withdraw consent, how to complain to you, and how to complain to the Data Protection Board. You may keep using their data unless they withdraw. (Law: s.5(2), s.5(3), Rule 3 · Starts 13 May 2027 · Maximum penalty: Up to ₹50 crore (s.33, Schedule item 7))
3. **Ask for consent properly and make withdrawal just as easy.** Ask for consent with a clear action, such as a box the person ticks themselves, separately for each purpose, and only for the data that purpose needs. Do not bundle it into your terms. Put your contact person's details in the request. Let people withdraw as easily as they agreed, for example with one tap in the same place. After a withdrawal, stop using their data, and make your vendors stop, within a reasonable time, unless a law requires you to continue. (Law: s.6(1), s.6(2), s.6(3), s.6(4), s.6(6), Rule 3 · Starts 13 May 2027 · Maximum penalty: Up to ₹50 crore (s.33, Schedule item 7))
4. **Keep proof of each notice and consent.** Keep a record you can show later for each consent: who agreed, which notice version and language they saw, which data and purposes they agreed to, and when and how (website, counter, WhatsApp). Keep every version of your notice with its date. Record withdrawals the same way. (Law: s.6(10) · Starts 13 May 2027)
5. **Use only a Consent Manager registered with the Board.** If you accept customer permissions through a Consent Manager, check that the Data Protection Board has registered it before you rely on it, and note when you checked. The Board publishes the details of each Consent Manager it registers on its website. Check again if the Board suspends or cancels a registration. (Law: s.6(9), Rule 4 · Starts 13 Nov 2026)
6. **Use vendors only under a valid contract.** Before any outside company handles personal data for you, have a valid contract with it that includes reasonable security safeguards. Keep a list of these vendors and their contracts. You stay responsible for what they do with the data, whatever the contract says. (Law: s.8(1), s.8(2), Rule 6(1)(f) · Starts 13 May 2027 · Maximum penalty: Up to ₹50 crore (s.33, Schedule item 7))
7. **Keep data accurate when it drives a decision or is shared.** Where you use someone's data to make a decision about them, or pass it to another business, make sure it is complete, accurate and consistent. Check it before you use or share it, and fix errors when you find them or are told about them. (Law: s.8(3) · Starts 13 May 2027 · Maximum penalty: Up to ₹50 crore (s.33, Schedule item 7))
8. **Protect personal data with reasonable security.** Protect the personal data you hold, including what your vendors hold for you. At the minimum: encrypt, mask or tokenise it; control who can open the computers, phones and apps that hold it; keep logs of who accessed it and review them; keep backups so you can carry on after a loss; keep those logs and the data for one year to investigate problems, unless another law says otherwise; and check that these measures keep working. (Law: s.8(5), Rule 6(1), Rule 6(1)(e) · Starts 13 May 2027 · Maximum penalty: Up to ₹250 crore (s.33, Schedule item 1))
9. **Tell each affected person about a breach.** As soon as you know personal data was breached, tell each affected person without delay, through their account with you or the phone number or email they registered. In short, plain words say: what happened, when and how much; what it may mean for them; what you are doing about it; what they can do to protect themselves; and who at your business they can contact. (Law: s.8(6), Rule 7(1) · Starts 13 May 2027 · Maximum penalty: Up to ₹200 crore (s.33, Schedule item 2))
10. **Tell the Data Protection Board about a breach.** Without delay after you know of a personal data breach, send the Data Protection Board a first description: what happened, how much data, when and where it happened, and the likely impact. (Law: s.8(6), Rule 7(2)(a) · Starts 13 May 2027 · Maximum penalty: Up to ₹200 crore (s.33, Schedule item 2))
11. **Send the Board the detailed breach report within 72 hours.** Within 72 hours of becoming aware of the breach, send the Board the detailed report: updated details of what happened; the facts, circumstances and reasons behind it; what you have done or plan to do to reduce the risk; any findings about who caused it; the steps to stop it happening again; and a report on the notices you sent to affected people. The Board may allow longer if you ask in writing. (Law: s.8(6), Rule 7(2)(b) · Starts 13 May 2027 · Maximum penalty: Up to ₹200 crore (s.33, Schedule item 2))
12. **Erase data when consent is withdrawn or the purpose is over.** When a person withdraws consent, or once it is reasonable to assume the purpose is over (for example the order is delivered and paid for and nothing more is needed), erase their personal data and make your vendors erase what you gave them. Keep only what a law requires you to keep, such as the one-year copy under Rule 8(3). (Law: s.8(7) · Starts 13 May 2027 · Maximum penalty: Up to ₹50 crore (s.33, Schedule item 7))
13. **Large platforms: erase inactive users after 3 years, with a 48-hour warning.** If a user has not used your service for its purpose, contacted you or used a data right for 3 years, erase their personal data, except what lets them reach their account or any stored value they can spend. At least 48 hours before, tell them their data will be erased unless they log in, contact you or use a right. (Law: s.8(8), Rule 8(1), Rule 8(2), Third Schedule · Starts 13 May 2027 · Maximum penalty: Up to ₹50 crore (s.33, Schedule item 7))
14. **Keep data, traffic data and logs for at least one year.** For every use of personal data, by you or by a vendor for you, keep the data, its traffic data and the logs of that processing for at least one year from the date of the processing, even if the customer closes their account. Keep this copy only for the purposes in the Seventh Schedule (lawful calls by the government). Then erase it, unless another law needs it kept longer. (Law: Rule 8(3), Seventh Schedule · Starts 13 May 2027 · Maximum penalty: Up to ₹50 crore (s.33, Schedule item 7))
15. **Publish who answers privacy questions and how to make a request.** Show clearly on your website or app the business contact (email or phone) of your Data Protection Officer, or of a person who can answer questions about how you use personal data. Repeat that contact in every reply to a rights request. Also publish how people can make a request and which details you need to find them, such as a customer ID, mobile number or email. (Law: s.8(9), Rule 9, Rule 14(1) · Starts 13 May 2027 · Maximum penalty: Up to ₹50 crore (s.33, Schedule item 7))
16. **Set up a complaints route and publish your response time.** Give people an easy way to complain about how you handle their personal data, for example a form, an email address or a phone number. Publish on your website or app how long you take to answer: a reasonable period of no more than 90 days. Name someone to answer and make sure they can meet that time. (Law: s.8(10), s.13, Rule 14(3) · Starts 13 May 2027 · Maximum penalty: Up to ₹50 crore (s.33, Schedule item 7))
17. **Answer each complaint within your published time.** Answer each complaint within the period you published, and never later than 90 days after you received it. Put your contact person in the reply. Fohrkast counts the 90-day limit; if you published a shorter period, work to that. (Law: s.13, Rule 14(3), Rule 9 · Starts 13 May 2027 · Maximum penalty: Up to ₹50 crore (s.33, Schedule item 7))
18. **Answer a request to see personal data.** When a person who gave you their data asks what you hold, give them a summary of their personal data and what you do with it, and the names of every other business and vendor you shared it with and what you shared. Reply within 90 days of receiving the request and put your contact person in the reply. (Law: s.11, Rule 9, Rule 14(3), PIB 17 Nov 2025 · Starts 13 May 2027 · Maximum penalty: Up to ₹50 crore (s.33, Schedule item 7))
19. **Correct, complete or update data on request.** When a person asks you to correct wrong or misleading data, fill in missing data or bring it up to date, do it and tell them it is done. Reply within 90 days of receiving the request and put your contact person in the reply. (Law: s.12(2), Rule 9, Rule 14(3), PIB 17 Nov 2025 · Starts 13 May 2027 · Maximum penalty: Up to ₹50 crore (s.33, Schedule item 7))
20. **Erase data on request.** When a person asks you to erase their personal data, erase it and make your vendors erase what you gave them, unless you still need it for the purpose they agreed to or a law makes you keep it. Reply within 90 days of receiving the request and put your contact person in the reply. (Law: s.12(3), s.8(7), Rule 9, Rule 14(3), PIB 17 Nov 2025 · Starts 13 May 2027 · Maximum penalty: Up to ₹50 crore (s.33, Schedule item 7))
21. **Record a person's nominee.** Let a person name one or more people who can use their data rights if they die or can no longer act because of illness of mind or body. Record the nominee in the way your terms of service set out, and confirm it to the person with your contact person in the reply. (Law: s.14, Rule 14(4), Rule 9 · Starts 13 May 2027 · Maximum penalty: Up to ₹50 crore (s.33, Schedule item 7))
22. **Get a parent's verified consent before using a child's data.** Before you use any personal data of a child (anyone under 18), get consent from the child's parent and check that the parent is an identifiable adult: against reliable identity and age details you already hold, or details the parent gives you, or a token from an authorised provider such as a Digital Locker service. A few uses are exempt, for example a clinic giving health care to the child (Fourth Schedule); rely on an exemption only for that use. (Law: s.9(1), Rule 10, Rule 12, Fourth Schedule · Starts 13 May 2027 · Maximum penalty: Up to ₹200 crore (s.33, Schedule item 3))
23. **Do not track, profile or target ads at children.** Never use a child's data in a way likely to harm their well-being. Do not track children, monitor their behaviour or show them targeted ads, so switch off ad and tracking tools for child users. A school, creche or school transport may track only as the Fourth Schedule allows, for example a child's location during travel for safety. (Law: s.9(2), s.9(3), Rule 12, Fourth Schedule · Starts 13 May 2027 · Maximum penalty: Up to ₹200 crore (s.33, Schedule item 3))
24. **Get a lawful guardian's verified consent for a person with disability.** When an adult with a disability acts through a lawful guardian, get the guardian's consent before using the person's data, and check that the guardian was appointed by a court, by a designated authority under the Rights of Persons with Disabilities Act 2016, or by a local level committee under the National Trust Act 1999. (Law: s.9(1), S.O. 5458(E), Rule 11 · Starts 13 May 2027)
25. **Significant Data Fiduciary: DPO in India, auditor, DPIA and audit every year.** Only if the government has named you a Significant Data Fiduciary. Appoint a Data Protection Officer based in India who answers to your board of directors and is the contact for complaints. Appoint an independent data auditor. Once in every 12 months from the date you were named, carry out a Data Protection Impact Assessment and an audit, and have whoever did them send the Board a report of the main findings. Check that your software and algorithms are not likely to put people's rights at risk. (Law: s.10(2), S.O. 5458(E), Rule 13 · Starts 13 May 2027 · Maximum penalty: Up to ₹150 crore (s.33, Schedule item 4))
26. **Give the government information it lawfully calls for.** If an authorised government officer asks you for information for a purpose listed in the Seventh Schedule, provide it within the period stated in the request. If the request says not to tell anyone, including the person the data is about, do not tell them unless the officer allows it in writing. (Law: s.36, Rule 23, Seventh Schedule · Starts 13 May 2027 · Maximum penalty: Up to ₹50 crore (s.33, Schedule item 7))
27. **Comply with a Data Protection Board direction.** If the Data Protection Board sends you a direction, do what it says within any time it sets, and keep proof that you did. If you disagree, you can ask the Board to change it, or appeal to the Appellate Tribunal (TDSAT) within 60 days of receiving it. (Law: s.27(2), s.29(2) · Starts 13 May 2027 · Maximum penalty: Up to ₹50 crore (s.33, Schedule item 7))

## When do the duties start?

| Date | What starts | Gazette reference |
|---|---|---|
| 13 Nov 2026 | Registration of Consent Managers (s.6(9), s.27(1)(d), Rule 4). | G.S.R. 843(E), item (b); G.S.R. 846(E), Rule 1(3) |
| 13 May 2027 | Nearly every duty on businesses, and the Board's penalties. | G.S.R. 843(E), item (c); G.S.R. 846(E), Rule 1(4) |

Both dates count from the Gazette dated 13 November 2025; some sources give 14 Nov 2026 and 14 May 2027. Fohrkast counts from 12 Nov 2026 and 12 May 2027, a day early to be safe, and shows each duty as a recommended step until its start date.

## What does Fohrkast do after the checklist?

A checklist shows which duties are open. Fohrkast turns the same duties into dated tasks for each business: it drafts the notice from the business's purposes and data map, records each consent and withdrawal, dates each rights request and complaint, drafts the breach intimations for the business to send (see [DPDP breach reporting](https://fohrkast.com/dpdp-breach-reporting)), and writes every step to a hash chained record (SHA-256) with times in IST. The evidence pack can be exported on every plan. Plans, limits and hosting are on the [DPDP compliance software fact sheet](https://fohrkast.com/dpdp-compliance-software).

## How does Fohrkast hold data?

- Designed to hold the least personal data each duty needs. Personal details are sealed under a key for each person.
- Each opening of a person's sealed details by a seat is written to the audit trail.

The business decides and sends every notice and reply, and remains the Data Fiduciary, responsible for its duties (s.8(1)).

## Which plan usually fits?

| Plan | For | Price | Billed yearly |
|---|---|---|---|
| Professional | One business with a few systems: clinics, schools, practices and single site firms | ₹9,999 a month, GST extra | ₹1,19,988 a year, GST extra |
| Business | A firm with a privacy lead or a compliance team, or any business above a Professional limit | ₹49,999 a month, GST extra | ₹5,99,988 a year, GST extra |

One business with a few systems usually fits Professional: up to 50,000 people on record, 3 connected data sources and 5 seats. A firm with a privacy lead or a compliance team, or any business above a Professional limit, usually fits Business. Prices are before GST at 18% and billed yearly in advance, in INR. The rights desk, the grievance desk and the incident desk are on every plan, including after a plan ends or goes unpaid. Full terms: [plans and prices in INR](https://fohrkast.com/pricing).

## Questions and answers

### Is there a DPDP compliance checklist in Excel?

Yes. The duties on this page download as a CSV file at fohrkast.com/dpdp-compliance-checklist.csv, which opens in Excel or Google Sheets, with a column to mark each duty done. For a PDF, the page prints to PDF from the browser.

### How is this checklist different from a DPDP gap assessment?

A gap assessment, also called a gap analysis, compares what a business does with what the law asks, system by system. This checklist is its first pass: each duty, its clause and its start date. Fohrkast carries the rest as dated tasks, with the evidence for each step.

### How many duties does the DPDP Act put on a business?

Fohrkast's rulebook, version 1, reads 27 duties for a Data Fiduciary in the Act and the Rules; some apply only to some businesses. Every duty, with its citations, is published at fohrkast.com/law/in.dpdp/1.

### When must a business comply with the DPDP Act?

Registration of [Consent Managers](https://fohrkast.com/dpdp-consent-managers) starts on 13 Nov 2026 (Rule 1(3)). Nearly every duty on businesses, and the Board's penalties, start on 13 May 2027 (Rule 1(4)).

### What is the maximum penalty under the DPDP Act?

Up to ₹250 crore (s.33, Schedule item 1) for failing to take reasonable security safeguards to prevent a personal data breach. Up to ₹200 crore (s.33, Schedule item 2) for not telling the Board and each affected person of a breach, and up to ₹200 crore (s.33, Schedule item 3) for breaching the duties on children's data. Up to ₹50 crore (s.33, Schedule item 7) for most other duties.

## Sources

- Digital Personal Data Protection Act, 2023 (22 of 2023): [MeitY copy](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf). Read 21 Oct 2026.
- G.S.R. 846(E), Digital Personal Data Protection Rules, 2025: [MeitY copy](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf). Read 21 Oct 2026.
- G.S.R. 843(E), commencement of the Act, 13 Nov 2025: [MeitY copy](https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf). Read 21 Oct 2026.
- S.O. 5458(E), DPDP (Removal of Difficulties) Order 2026: [eGazette copy](https://egazette.gov.in/WriteReadData/2026/276885.pdf). Read 21 Oct 2026.
- Fohrkast rulebook in.dpdp version 1: [published duties](https://fohrkast.com/law/in.dpdp/1).

Related duties in the published rulebook: [a notice before consent](https://fohrkast.com/law/in.dpdp/1#in.dpdp/notice.before_consent), [proof of each consent](https://fohrkast.com/law/in.dpdp/1#in.dpdp/consent.proof), [security safeguards](https://fohrkast.com/law/in.dpdp/1#in.dpdp/security.safeguards), [the 72 hour report](https://fohrkast.com/law/in.dpdp/1#in.dpdp/breach.board_report), [access requests](https://fohrkast.com/law/in.dpdp/1#in.dpdp/rights.access), [a complaints route](https://fohrkast.com/law/in.dpdp/1#in.dpdp/grievance.mechanism).

---

# DPDP Consent Managers and consent management software in India

URL: https://fohrkast.com/dpdp-consent-managers

A Consent Manager is a company registered with the Data Protection Board that lets a person give, manage, review and withdraw consent across many businesses through one platform; it must be a company incorporated in India with a net worth of at least two crore rupees (s.6(9), Rule 4). Registration starts on 13 Nov 2026. Using one is optional: Fohrkast reads nothing in the Act or the Rules as requiring a business to join one, and Fohrkast is not a Consent Manager.

## Which duties weigh most for a business that uses a Consent Manager?

- **Use only a registered Consent Manager.** From 13 Nov 2026 every Consent Manager must be registered with the Board (s.6(9), Rule 4). The Board publishes the details of each Consent Manager it registers on its website. A business that accepts consent through one checks that the Board has registered it before relying on it, notes when it checked, and checks again if the Board suspends or cancels a registration. The law puts registration on the Consent Manager; asking the business to check is Fohrkast's reading, shown as Recommended.
- **The business's own consent duties.** Fohrkast's rulebook applies the same consent duties whether or not a business uses a Consent Manager: a notice before or with every consent request (s.5(1), s.5(3), Rule 3), consent per purpose with withdrawal as easy as giving it (s.6(1), s.6(4)), and proof of each notice and consent, whose burden is on the business (s.6(10)). Penalty up to ₹50 crore (s.33, Schedule item 7). Marketing consent, website tracking and children's data for an online brand are covered on the [DPDP for D2C and ecommerce page](https://fohrkast.com/dpdp-for-d2c-and-ecommerce).
- **Responsibility.** The business remains responsible for its own processing and its vendors' (s.8(1)).

## When do the duties start?

| Date | What starts | Gazette reference |
|---|---|---|
| 13 Nov 2026 | Registration of Consent Managers (s.6(9), s.27(1)(d), Rule 4). | G.S.R. 843(E), item (b); G.S.R. 846(E), Rule 1(3) |
| 13 May 2027 | Nearly every duty on businesses, and the Board's penalties. | G.S.R. 843(E), item (c); G.S.R. 846(E), Rule 1(4) |

Both dates count from the Gazette dated 13 November 2025; some sources give 14 Nov 2026 and 14 May 2027. Fohrkast counts from 12 Nov 2026 and 12 May 2027, a day early to be safe, and shows each duty as a recommended step until its start date.

The [DPDP compliance checklist](https://fohrkast.com/dpdp-compliance-checklist) lists every duty with its clause and start date.

## Why is Fohrkast not a Consent Manager?

A Consent Manager serves the person, across many businesses, and must be registered with the Board (s.6(9), Rule 4). Fohrkast serves one business at a time: it records the consent that business collects, as its processor under the processor agreement at fohrkast.com/dpa (s.8(2)), and holds no registration as a Consent Manager. Fohrkast is consent management software, not a Consent Manager.

## What does Fohrkast do with consent?

- Fohrkast drafts the notice from the business's purposes and data map; the business checks and publishes it (s.5(1), Rule 3), in English and Hindi, or in another language of the Eighth Schedule through the business's own checked translation (s.5(3)).
- Consent is recorded per purpose, withdrawal is as easy as giving it (s.6(4)), and each record is kept to its retention date (s.6(10)).
- A business without a website uses a hosted page, opened by a short link or a QR poster.
- On the business's own website, a banner holds each marked tracker until the matching consent, and treats a browser that sends Global Privacy Control or Do Not Track as declining every optional purpose.
- For a business that says it uses a Consent Manager, the duty to check its registration shows from 12 Nov 2026, a day before the Gazette date, to be safe.
- Every step is written to a hash chained record (SHA-256) with times in IST, and the evidence pack can be exported on every plan.

The [DPDP compliance software fact sheet](https://fohrkast.com/dpdp-compliance-software) covers plans, limits, hosting and dates across every kind of business.

## How does Fohrkast hold data?

- Designed to hold the least personal data each duty needs. Personal details are sealed under a key for each person.
- Each opening of a person's sealed details by a seat is written to the audit trail.

The business decides and sends every notice and reply, and remains the Data Fiduciary, responsible for its duties (s.8(1)).

## Which plan usually fits?

| Plan | For | Price | Billed yearly |
|---|---|---|---|
| Professional | One business with a few systems: clinics, schools, practices and single site firms | ₹9,999 a month, GST extra | ₹1,19,988 a year, GST extra |
| Business | A firm with a privacy lead or a compliance team, or any business above a Professional limit | ₹49,999 a month, GST extra | ₹5,99,988 a year, GST extra |

Consent withdrawal, the hosted consent page with its QR code and consent records kept to their retention date are on every plan, including after a plan ends or goes unpaid. The plan follows the number of consent records held, among its other limits: up to 2,50,000 on Professional and 50,00,000 on Business. Prices are before GST at 18% and billed yearly in advance, in INR. Full terms: [plans and prices in INR](https://fohrkast.com/pricing).

## Questions and answers

### What is a Consent Manager under the DPDP Act?

A Consent Manager is registered with the Data Protection Board and lets a person give, manage, review and withdraw consent across many businesses through one platform; it must be a company incorporated in India with a net worth of at least two crore rupees (s.6(9), Rule 4).

### Does a business need a Consent Manager?

On Fohrkast's reading, no: using one is optional, and nothing in the Act or the Rules requires a business to join one. A business that accepts consent through a Consent Manager checks first that the Board has registered it (s.6(9), Rule 4).

### When does Consent Manager registration start?

On 13 Nov 2026, one year after the Gazette dated 13 November 2025 (s.6(9), s.27(1)(d), Rule 4; G.S.R. 846(E), Rule 1(3)). Some sources give 14 Nov 2026; Fohrkast counts from 12 Nov 2026 to be safe.

### Is consent management software a Consent Manager?

No. A consent management tool, which is software a business uses to record its own customers' consent, serves that business. A Consent Manager serves the person across many businesses and must be registered with the Board (s.6(9), Rule 4). Fohrkast is consent management software, not a Consent Manager.

### What should a consent management platform for the DPDP Act do?

Record consent per purpose, keep proof of each notice and consent (s.6(10)) and make withdrawal as easy as giving consent (s.6(4)), with notices in English or a language of the Eighth Schedule (s.5(3)). Fohrkast does each of these, from a hosted page or a QR poster, with notices in English and Hindi built in and other languages through the business's own checked translation. On a business's own website, its banner holds each marked tracker until the matching consent.

## Sources

- Digital Personal Data Protection Act, 2023 (22 of 2023): [MeitY copy](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf). Read 21 Oct 2026.
- G.S.R. 846(E), Digital Personal Data Protection Rules, 2025: [MeitY copy](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf). Read 21 Oct 2026.
- G.S.R. 843(E), commencement of the Act, 13 Nov 2025: [MeitY copy](https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf). Read 21 Oct 2026.
- Fohrkast rulebook in.dpdp version 1: [published duties](https://fohrkast.com/law/in.dpdp/1).

Related duties in the published rulebook: [a registered Consent Manager](https://fohrkast.com/law/in.dpdp/1#in.dpdp/consent.manager_registered), [notice before consent](https://fohrkast.com/law/in.dpdp/1#in.dpdp/notice.before_consent), [valid and withdrawable consent](https://fohrkast.com/law/in.dpdp/1#in.dpdp/consent.valid_and_withdrawable), [proof of notice and consent](https://fohrkast.com/law/in.dpdp/1#in.dpdp/consent.proof).

---

# DPDP for clinics and hospitals: duties, dates and the plan that fits

URL: https://fohrkast.com/dpdp-for-clinics-and-hospitals

A clinic or hospital that keeps patient details in digital form, including paper records later typed into a computer or phone, is covered by the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (s.3), and nearly every duty applies to it from 13 May 2027. The duties that weigh most are a parent's verified consent for a child's data (s.9(1), Rule 10), reasonable security safeguards (s.8(5), Rule 6(1)), breach intimations with the detailed report to the Data Protection Board within 72 hours (s.8(6), Rule 7(2)(b)), and requests to see, correct or erase data, received at the front desk (s.11, s.12(2), s.12(3)).

## Which duties weigh most for a clinic or hospital?

- **Children's data.** A child is anyone under 18 (s.2(f)). Before using a child's personal data, the clinic or hospital needs the consent of a parent who is checked to be an identifiable adult (s.9(1), Rule 10). Some uses are exempt, for example a clinic giving health care to the child, and an exemption covers that use only (Rule 12, Fourth Schedule). Penalty up to ₹200 crore (s.33, Schedule item 3).
- **Patients who act through a guardian.** For an adult with a disability who acts through a lawful guardian, the guardian's consent comes first, after checking that the guardian was appointed by a court, by a designated authority under the Rights of Persons with Disabilities Act 2016, or by a local level committee under the National Trust Act 1999 (s.9(1), Rule 11).
- **Security safeguards.** Encryption, masking or tokenisation; control over who can open the computers, phones and apps that hold patient data; access logs, reviewed; backups; and logs and data kept for one year to investigate problems, unless another law says otherwise (s.8(5), Rule 6(1), Rule 6(1)(e)). This is the highest penalty band in the Act: up to ₹250 crore (s.33, Schedule item 1).
- **Breaches.** Every personal data breach, with no size threshold: each affected person and the Board told without delay (Rule 7(1), Rule 7(2)(a)), and the detailed report to the Board within 72 hours of becoming aware of the breach (Rule 7(2)(b)). Penalty up to ₹200 crore (s.33, Schedule item 2). The [DPDP breach reporting page](https://fohrkast.com/dpdp-breach-reporting) sets out each notice and the 72 hour report.
- **Requests at the front desk.** A patient can ask to see a summary of the data held (s.11), have it corrected (s.12(2)) or erased (s.12(3)), or name a nominee (s.14). Erasure leaves data a law requires the clinic or hospital to keep. Grievances are answered within the period the clinic or hospital publishes, at most 90 days (Rule 14(3)).
- **Vendors.** Billing software, cloud storage, a payment gateway or a WhatsApp Business provider that handles patient details is a vendor: the clinic or hospital stays responsible for it and needs a valid contract with reasonable security safeguards (s.8(1), s.8(2), Rule 6(1)(f)).

## When do the duties start?

| Date | What starts | Gazette reference |
|---|---|---|
| 13 Nov 2026 | Registration of Consent Managers (s.6(9), s.27(1)(d), Rule 4). | G.S.R. 843(E), item (b); G.S.R. 846(E), Rule 1(3) |
| 13 May 2027 | Nearly every duty on businesses, and the Board's penalties. | G.S.R. 843(E), item (c); G.S.R. 846(E), Rule 1(4) |

Both dates count from the Gazette dated 13 November 2025; some sources give 14 Nov 2026 and 14 May 2027. Fohrkast counts from 12 Nov 2026 and 12 May 2027, a day early to be safe, and shows each duty as a recommended step until its start date.

The [DPDP compliance checklist](https://fohrkast.com/dpdp-compliance-checklist) lists every duty with its clause and start date.

## What does Fohrkast do for a clinic or hospital?

- Front desk staff log requests made at the counter, by phone, WhatsApp, SMS, email or letter. Identity is checked before any reply, and a request about a child also needs a parent (s.9(1), Rule 10). Fohrkast drafts each reply in English or Hindi; the clinic or hospital sends it.
- A clinic without a website uses a hosted consent and request page, opened by a short link or a QR poster.
- Fohrkast drafts the notice from the purposes and the data map; the clinic or hospital checks and publishes it, in English and Hindi, or in another language of the Eighth Schedule through its own checked translation (s.5(1), s.5(3), Rule 3). Consent is recorded per purpose, and withdrawal is as easy as giving it (s.6(4)).
- The incident desk records the time the business became aware of a breach, never prefilled, and drafts the notice to each affected person (Rule 7(1)), the first intimation to the Board (Rule 7(2)(a)) and the detailed report due within 72 hours (Rule 7(2)(b)).
- A record of each vendor that processes personal data for the business (s.8(2)); for each erasure, the vendors asked to erase and their answers, and a deletion certificate (s.8(7)).
- A scanner that runs in the clinic's or hospital's own environment with a read only login and sends Fohrkast labels and counts only, never personal data values or database credentials. It is tested on Microsoft SQL Server, Oracle Database, PostgreSQL and MySQL, among others.
- Every step is written to a hash chained record (SHA-256) with times in IST, and the evidence pack can be exported on every plan.

The [DPDP compliance software fact sheet](https://fohrkast.com/dpdp-compliance-software) covers plans, limits, hosting and dates across every kind of business.

## How does Fohrkast hold data?

- Designed to hold the least personal data each duty needs. Personal details are sealed under a key for each person.
- Each opening of a person's sealed details by a seat is written to the audit trail.

The clinic or hospital decides and sends every notice and report, and remains the Data Fiduciary, responsible for its duties (s.8(1)).

## Which plan usually fits?

| Plan | For | Price | Billed yearly |
|---|---|---|---|
| Professional | One business with a few systems: clinics, schools, practices and single site firms | ₹9,999 a month, GST extra | ₹1,19,988 a year, GST extra |
| Business | A firm with a privacy lead or a compliance team, or any business above a Professional limit | ₹49,999 a month, GST extra | ₹5,99,988 a year, GST extra |

A clinic with one site and a few systems usually fits Professional: up to 3 connected data sources and 5 seats, sized for about 50,000 people on record. A hospital above a counted Professional limit at renewal (connected data sources, seats, consent records or websites) moves to the lowest plan whose limits cover each of them, usually Business: up to 3 legal entities, 15 connected data sources and 25 seats. Prices are before GST at 18% and billed yearly in advance, in INR. The rights desk, the grievance desk and the incident desk are on every plan, including after a plan ends or goes unpaid. Full terms: [plans and prices in INR](https://fohrkast.com/pricing).

## Questions and answers

### Does the DPDP Act apply to a small clinic?

Yes, where the clinic keeps or uses patient details in digital form, including paper records later typed into a computer or phone (s.3). Nearly every duty applies from 13 May 2027, and the penalties start the same day.

### Does a clinic need a parent's consent to use a child's data?

Yes, before using a child's personal data, a parent's verified consent is needed (s.9(1), Rule 10); a child is anyone under 18 (s.2(f)). Some uses are exempt, for example a clinic giving health care to the child, and the exemption covers that use only (Rule 12, Fourth Schedule).

### What must a hospital do after a data breach?

Tell each affected person and the Data Protection Board without delay (Rule 7(1), Rule 7(2)(a)), then send the Board a detailed report within 72 hours of becoming aware of the breach, or a longer period the Board allows on a written request (Rule 7(2)(b)). The duty covers every breach, with no size threshold. The CERT-In report within 6 hours (CERT-In Directions, 28 April 2022) is a separate duty: each incident in Fohrkast carries its 6 hour clock, with email alerts and a drafted report; the hospital sends it.

### How long does a hospital have to answer an access or erasure request?

Rule 14(3) caps the grievance period at 90 days, and the PIB explainer of 17 Nov 2025 applies 90 days to access, correction and erasure requests; Fohrkast dates them 90 days from receipt, a Fohrkast reading. For an erasure, each vendor holding the data is also asked to erase it (s.8(7)).

### Which Fohrkast plan fits a clinic, and which a hospital?

Professional, ₹9,999 a month billed yearly with GST extra, fits one business with a few systems: up to 3 connected data sources and 5 seats. A hospital above any Professional limit usually needs Business, ₹49,999 a month billed yearly with GST extra, for up to 3 legal entities and 15 data sources.

## Sources

- Digital Personal Data Protection Act, 2023 (22 of 2023): [MeitY copy](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf). Read 21 Oct 2026.
- G.S.R. 846(E), Digital Personal Data Protection Rules, 2025: [MeitY copy](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf). Read 21 Oct 2026.
- G.S.R. 843(E), commencement of the Act, 13 Nov 2025: [MeitY copy](https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf). Read 21 Oct 2026.
- S.O. 5458(E), DPDP (Removal of Difficulties) Order 2026: [eGazette copy](https://egazette.gov.in/WriteReadData/2026/276885.pdf). Read 21 Oct 2026.
- PIB explainer, DPDP Rules 2025 Notified, 17 Nov 2025: [PDF](https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf). Read 21 Oct 2026.
- Fohrkast rulebook in.dpdp version 1: [published duties](https://fohrkast.com/law/in.dpdp/1).

Related duties in the published rulebook: [a parent's verified consent](https://fohrkast.com/law/in.dpdp/1#in.dpdp/children.parent_consent), [a lawful guardian's consent](https://fohrkast.com/law/in.dpdp/1#in.dpdp/children.guardian_disability), [security safeguards](https://fohrkast.com/law/in.dpdp/1#in.dpdp/security.safeguards), [the 72 hour report](https://fohrkast.com/law/in.dpdp/1#in.dpdp/breach.board_report), [access requests](https://fohrkast.com/law/in.dpdp/1#in.dpdp/rights.access), [vendor contracts](https://fohrkast.com/law/in.dpdp/1#in.dpdp/processors.contract).

---

# DPDP for D2C and ecommerce: consent, trackers, children and dates

URL: https://fohrkast.com/dpdp-for-d2c-and-ecommerce

Using a customer's details only to deliver what was ordered may not need consent (s.7(a)), but offers, marketing and website tracking need a notice and consent (s.5(1), s.6(1)), with withdrawal as easy as giving it (s.6(4)). Nearly every duty under the DPDP Act 2023 and the DPDP Rules 2025 applies from 13 May 2027, including, for the largest online shopping sites and apps, the erasure of users inactive for 3 years (s.8(8), Rule 8(1), Third Schedule).

## Which duties weigh most for a D2C or ecommerce brand?

- **Notice and consent for offers, marketing and tracking.** A notice before or with every consent request, stating each item of personal data, the purpose, how to withdraw consent, how to use the rights and how to complain to the Data Protection Board, readable in English or a language of the Eighth Schedule (s.5(1), s.5(3), Rule 3). Consent is asked per purpose, by a clear action, and not bundled into the terms (s.6(1), s.6(2)). Penalty up to ₹50 crore (s.33, Schedule item 7). A person can also give consent through a Consent Manager, whose registration starts on 13 Nov 2026; see the [DPDP Consent Managers page](https://fohrkast.com/dpdp-consent-managers).
- **Withdrawal.** As easy as giving consent; after a withdrawal, processing stops, at the brand's vendors too, within a reasonable time, unless a law requires it to continue (s.6(4), s.6(6)).
- **Proof.** If a question arises, the brand carries the burden of proving that the notice was given and consent obtained (s.6(10)): who agreed, which notice version and language, which purposes, and when and how.
- **Children.** Nothing likely to harm a child's wellbeing, and no tracking, behavioural monitoring or targeted advertising directed at children (s.9(2), s.9(3)); a parent's verified consent before using a child's data (s.9(1), Rule 10). A child is anyone under 18 (s.2(f)). Penalty up to ₹200 crore (s.33, Schedule item 3).
- **Vendors.** A payment gateway, a delivery partner, a WhatsApp Business provider or cloud storage that handles customer details works under a valid contract with reasonable security safeguards, and the brand stays responsible for it (s.8(1), s.8(2), Rule 6(1)(f)).
- **Security and breaches.** Reasonable security safeguards, at vendors as well as in the brand's own systems (s.8(5), Rule 6(1)), up to ₹250 crore (s.33, Schedule item 1). Every breach is told to each affected person and the Board without delay, with the detailed report to the Board within 72 hours of becoming aware (Rule 7(1), Rule 7(2)(a), Rule 7(2)(b)).
- **Large platforms.** The 3 year inactivity erasure applies only to an online shopping site or app the business owns or runs, not to a seller on another business's marketplace, with at least 2 crore registered users in India (s.8(8), Rule 8(1), Rule 8(2), Third Schedule). The 3 years run from 13 May 2027 at the earliest, a Fohrkast reading.

## When do the duties start?

| Date | What starts | Gazette reference |
|---|---|---|
| 13 Nov 2026 | Registration of Consent Managers (s.6(9), s.27(1)(d), Rule 4). | G.S.R. 843(E), item (b); G.S.R. 846(E), Rule 1(3) |
| 13 May 2027 | Nearly every duty on businesses, and the Board's penalties. | G.S.R. 843(E), item (c); G.S.R. 846(E), Rule 1(4) |

Both dates count from the Gazette dated 13 November 2025; some sources give 14 Nov 2026 and 14 May 2027. Fohrkast counts from 12 Nov 2026 and 12 May 2027, a day early to be safe, and shows each duty as a recommended step until its start date.

The [DPDP compliance checklist](https://fohrkast.com/dpdp-compliance-checklist) lists every duty with its clause and start date.

## What does Fohrkast do for a D2C or ecommerce brand?

- Fohrkast drafts the notice from the brand's purposes and data map; the brand checks and publishes it (s.5(1), Rule 3), in English and Hindi, or in another language of the Eighth Schedule through the brand's own checked translation (s.5(3)).
- Consent is recorded per purpose, withdrawal is as easy as giving it (s.6(4)), and each record is kept to its retention date (s.6(10)).
- On the brand's own website, a banner holds each marked tracker until the matching consent, and treats a browser that sends Global Privacy Control or Do Not Track as declining every optional purpose.
- A rights desk for access (s.11), correction (s.12(2)), erasure (s.12(3)), nomination (s.14), withdrawals of consent (s.6(4)) and grievances (s.13), from the brand's hosted request page or logged by staff from WhatsApp, phone, SMS, email or letter.
- A record of each vendor that processes personal data for the brand (s.8(2)); for each erasure, the vendors asked to erase and their answers, and a deletion certificate (s.8(7)).
- The incident desk drafts the notice to each affected person (Rule 7(1)), the first intimation to the Board (Rule 7(2)(a)) and the detailed report, counting the 72 hours from the awareness time the brand records (Rule 7(2)(b)).
- Every step is written to a hash chained record (SHA-256) with times in IST, and the evidence pack can be exported on every plan.

The [DPDP compliance software fact sheet](https://fohrkast.com/dpdp-compliance-software) covers plans, limits, hosting and dates across every kind of business.

## How does Fohrkast hold data?

- Designed to hold the least personal data each duty needs. Personal details are sealed under a key for each person.
- Each opening of a person's sealed details by a seat is written to the audit trail.

The brand decides and sends every notice and report, and remains the Data Fiduciary, responsible for its duties (s.8(1)).

## Which plan usually fits?

| Plan | For | Price | Billed yearly |
|---|---|---|---|
| Professional | One business with a few systems: clinics, schools, practices and single site firms | ₹9,999 a month, GST extra | ₹1,19,988 a year, GST extra |
| Business | A firm with a privacy lead or a compliance team, or any business above a Professional limit | ₹49,999 a month, GST extra | ₹5,99,988 a year, GST extra |

A brand within every Professional limit fits Professional: up to 2,50,000 consent records, 2 websites, apps and hosted pages and 5 seats, sized for about 50,000 people on record and 2,00,000 banner loads a month. A brand above a counted limit at renewal (consent records, websites, apps and hosted pages, connected data sources or seats) moves to the lowest plan whose limits cover each of them, usually Business: up to 50,00,000 consent records and 5 websites, apps and hosted pages. Prices are before GST at 18% and billed yearly in advance, in INR. Rights requests, grievances, consent withdrawals and incidents sit outside every limit. Full terms: [plans and prices in INR](https://fohrkast.com/pricing).

## Questions and answers

### Does a D2C brand need consent to send order updates?

Using a customer's details only to deliver what was ordered may not need consent (s.7(a)). Offers, a newsletter, loyalty points and website tracking need a notice and consent (s.5(1), s.6(1)), with withdrawal as easy as giving it (s.6(4)).

### Does website tracking need consent under the DPDP Act?

Website tracking needs a notice and consent, as offers and marketing do (s.5(1), s.6(1)), and tracking, behavioural monitoring or targeted advertising directed at children is not allowed outside the narrow Fourth Schedule cases (s.9(3), Rule 12). On a brand's own website, Fohrkast's banner holds each marked tracker until the matching consent.

### Which ecommerce platforms must erase the data of inactive users?

Only an online shopping site or app the business owns or runs, not a seller on another business's marketplace, with at least 2 crore registered users in India; the rule also covers social media platforms of that size and online gaming platforms with at least 50 lakh. A user inactive for 3 years is warned at least 48 hours before the erasure, and what the user needs to reach the account or spend stored value is kept (s.8(8), Rule 8(1), Rule 8(2), Third Schedule).

### Can a D2C brand show targeted ads to children?

No. The Act bars tracking, behavioural monitoring and targeted advertising directed at children, outside the narrow Fourth Schedule cases (s.9(3), Rule 12), and any processing likely to harm a child's wellbeing (s.9(2)). A child is anyone under 18 (s.2(f)), and the penalty reaches ₹200 crore (s.33, Schedule item 3).

### Which Fohrkast plan fits a D2C brand?

Professional, ₹9,999 a month billed yearly with GST extra, while the brand stays within every counted Professional limit, for example 2,50,000 consent records and 2 websites, apps and hosted pages. Above a counted limit at renewal, the lowest plan whose limits cover every figure, usually Business at ₹49,999 a month billed yearly with GST extra.

## Sources

- Digital Personal Data Protection Act, 2023 (22 of 2023): [MeitY copy](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf). Read 21 Oct 2026.
- G.S.R. 846(E), Digital Personal Data Protection Rules, 2025: [MeitY copy](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf). Read 21 Oct 2026.
- G.S.R. 843(E), commencement of the Act, 13 Nov 2025: [MeitY copy](https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf). Read 21 Oct 2026.
- Fohrkast rulebook in.dpdp version 1: [published duties](https://fohrkast.com/law/in.dpdp/1).

Related duties in the published rulebook: [notice before consent](https://fohrkast.com/law/in.dpdp/1#in.dpdp/notice.before_consent), [valid and withdrawable consent](https://fohrkast.com/law/in.dpdp/1#in.dpdp/consent.valid_and_withdrawable), [proof of notice and consent](https://fohrkast.com/law/in.dpdp/1#in.dpdp/consent.proof), [no tracking of children](https://fohrkast.com/law/in.dpdp/1#in.dpdp/children.no_tracking), [vendor contracts](https://fohrkast.com/law/in.dpdp/1#in.dpdp/processors.contract), [3 year erasure on large platforms](https://fohrkast.com/law/in.dpdp/1#in.dpdp/retention.third_schedule).

---

# DPDP for SaaS and payroll: Data Processor and Data Fiduciary duties

URL: https://fohrkast.com/dpdp-for-saas-and-payroll-providers

A SaaS or payroll provider that handles personal data for a client business is that business's Data Processor: the client stays responsible for the processing (s.8(1)) and may use the provider only under a valid contract with reasonable security safeguards (s.8(2), Rule 6(1)(f)). For its own users, customers and staff, the provider decides why and how their data is used and is a Data Fiduciary, with the same duties as any other business from 13 May 2027.

## Which duties weigh most for a SaaS or payroll provider?

The client's duties that reach into the provider's systems:

- **Security safeguards at the vendor.** A business protects the personal data its vendors hold for it as well as its own: encryption, masking or tokenisation, access control, access logs that are reviewed, backups, and logs and data kept for one year to investigate problems (s.8(5), Rule 6(1), Rule 6(1)(e)). This is the highest penalty band in the Act: up to ₹250 crore (s.33, Schedule item 1).
- **Stopping after a withdrawal.** After a person withdraws consent, the client must make its vendors stop processing within a reasonable time, unless a law requires it to continue (s.6(6)).
- **Erasure.** When consent is withdrawn or the purpose is over, the client must make its vendors erase what it gave them (s.8(7)).
- **One year copy.** For every use of personal data, by the client or by a vendor for it, the data, its traffic data and the logs of that processing are kept for at least one year, for the purposes in the Seventh Schedule only, then erased unless another law needs them kept longer (Rule 8(3), Seventh Schedule).
- **Access replies.** A reply to an access request names every other business and vendor the data was shared with (s.11).

The provider's own duties as a Data Fiduciary for its users, customers and staff:

- A notice and valid consent wherever it asks for consent (s.5(1), s.6(1)), with withdrawal as easy as giving it (s.6(4)).
- Requests to see, correct or erase data and to name a nominee (s.11, s.12(2), s.12(3), s.14); a published contact and request route (s.8(9), Rule 9, Rule 14(1)); a grievance period of at most 90 days (Rule 14(3)).
- Breach intimations to each affected person and the Board without delay, and the detailed report to the Board within 72 hours of becoming aware (s.8(6), Rule 7(1), Rule 7(2)(a), Rule 7(2)(b)). Penalty up to ₹200 crore (s.33, Schedule item 2).
- Its own vendors, such as cloud hosting, email and payment providers, under a valid contract with reasonable security safeguards (s.8(2), Rule 6(1)(f)).

A firm that advises several businesses on their DPDP work, rather than processing their data, is covered on the [DPDP software for partner firms page](https://fohrkast.com/dpdp-software-for-partner-firms).

## When do the duties start?

| Date | What starts | Gazette reference |
|---|---|---|
| 13 Nov 2026 | Registration of Consent Managers (s.6(9), s.27(1)(d), Rule 4). | G.S.R. 843(E), item (b); G.S.R. 846(E), Rule 1(3) |
| 13 May 2027 | Nearly every duty on businesses, and the Board's penalties. | G.S.R. 843(E), item (c); G.S.R. 846(E), Rule 1(4) |

Both dates count from the Gazette dated 13 November 2025; some sources give 14 Nov 2026 and 14 May 2027. Fohrkast counts from 12 Nov 2026 and 12 May 2027, a day early to be safe, and shows each duty as a recommended step until its start date.

The [DPDP compliance checklist](https://fohrkast.com/dpdp-compliance-checklist) lists every duty with its clause and start date.

## What does Fohrkast do for a SaaS or payroll provider?

- Each duty in the Act and the Rules that applies to the provider as a business, with its date, its basis and the clause it comes from, in a rulebook that is signed, versioned and published with its redline at fohrkast.com/law/in.dpdp.
- A record of each vendor that processes personal data for the provider (s.8(2)); for each erasure, the vendors asked to erase and their answers, and a deletion certificate (s.8(7)).
- A rights desk and a grievance desk for the provider's own users, customers and staff, with each reply drafted in English or Hindi for the provider to send.
- The incident desk records the awareness time, never prefilled, and drafts the notice to each affected person (Rule 7(1)), the first intimation to the Board (Rule 7(2)(a)) and the detailed report due within 72 hours (Rule 7(2)(b)).
- On the provider's own website, a banner holds each marked tracker until the matching consent.
- A scanner that runs in the provider's own environment with a read only login and sends Fohrkast labels and counts only, never personal data values or database credentials. Tested on 19 and 20 Oct 2026 against real servers of 42 database products, among them PostgreSQL, MySQL, Microsoft SQL Server, Oracle Database, MongoDB, Amazon RDS, Amazon Aurora, Amazon DynamoDB and Google BigQuery, and against SFTP, Linux servers over SSH, Windows shares, NFS and Amazon S3.
- Every step is written to a hash chained record (SHA-256) with times in IST, and the evidence pack can be exported on every plan.

The [DPDP compliance software fact sheet](https://fohrkast.com/dpdp-compliance-software) covers plans, limits, hosting and dates across every kind of business.

## How does Fohrkast hold data?

- Designed to hold the least personal data each duty needs. Personal details are sealed under a key for each person.
- Each opening of a person's sealed details by a seat is written to the audit trail.

The provider decides and sends every notice and report. Each client remains the Data Fiduciary for the data it gives the provider, and the provider for its own users, customers and staff (s.8(1)).

## Which plan usually fits?

| Plan | For | Price | Billed yearly |
|---|---|---|---|
| Business | A firm with a privacy lead or a compliance team, or any business above a Professional limit | ₹49,999 a month, GST extra | ₹5,99,988 a year, GST extra |
| Enterprise | Large and multi company firms | From ₹1,99,999 a month, GST extra | ₹23,99,988 a year, GST extra. Onboarding ₹5,99,999, once, GST extra. |

A provider with a privacy lead or a compliance team usually fits Business: up to 3 legal entities, 25 seats and 15 connected data sources. A large or multi company provider fits Enterprise: up to 10 legal entities and 40 connected data sources. A provider within every Professional limit can start on Professional. Prices are before GST at 18% and billed yearly in advance, in INR. Full terms: [plans and prices in INR](https://fohrkast.com/pricing).

## Questions and answers

### Is a SaaS company a Data Fiduciary or a Data Processor under the DPDP Act?

Both, for different data. For personal data it handles on behalf of a client business, it is that client's Data Processor, used only under a valid contract (s.8(2)), and the client stays responsible for the processing (s.8(1)). For its own users, customers and staff, it decides why and how the data is used and is a Data Fiduciary.

### Does the DPDP Act cover employee data held by a payroll provider?

Yes. The Act covers personal data in digital form (s.3), staff records included. For staff data a payroll provider handles for an employer, the employer is the Data Fiduciary and stays responsible (s.8(1)), and the provider works under a valid contract with reasonable security safeguards (s.8(2), Rule 6(1)(f)).

### What do a client's DPDP duties ask of its SaaS vendor?

The Rules ask for reasonable security safeguards in the contract between a business and its vendor (s.8(2), Rule 6(1)(f)). After a withdrawal the client must make its vendors stop processing within a reasonable time (s.6(6)), and when consent is withdrawn or the purpose is over it must make them erase what it gave them (s.8(7)). The one year copy of data, traffic data and logs covers processing by a vendor too (Rule 8(3)).

### Who reports a personal data breach at a SaaS or payroll provider?

The Data Fiduciary whose data was breached tells each affected person and the Board without delay and sends the detailed report within 72 hours of becoming aware (s.8(6), Rule 7(1), Rule 7(2)(a), Rule 7(2)(b)). For a client's data, that is the client, which stays responsible for its vendor's processing (s.8(1)); for the provider's own users, customers and staff, it is the provider.

### Which Fohrkast plan fits a SaaS or payroll provider?

Business, ₹49,999 a month billed yearly with GST extra, for a firm with a privacy lead or a compliance team: up to 3 legal entities and 15 data sources. A large or multi company provider fits Enterprise, from ₹1,99,999 a month billed yearly with GST extra, plus a one time onboarding fee.

## Sources

- Digital Personal Data Protection Act, 2023 (22 of 2023): [MeitY copy](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf). Read 21 Oct 2026.
- G.S.R. 846(E), Digital Personal Data Protection Rules, 2025: [MeitY copy](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf). Read 21 Oct 2026.
- G.S.R. 843(E), commencement of the Act, 13 Nov 2025: [MeitY copy](https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf). Read 21 Oct 2026.
- Fohrkast rulebook in.dpdp version 1: [published duties](https://fohrkast.com/law/in.dpdp/1).

Related duties in the published rulebook: [vendor contracts](https://fohrkast.com/law/in.dpdp/1#in.dpdp/processors.contract), [security safeguards](https://fohrkast.com/law/in.dpdp/1#in.dpdp/security.safeguards), [valid and withdrawable consent](https://fohrkast.com/law/in.dpdp/1#in.dpdp/consent.valid_and_withdrawable), [erasure when the purpose is over](https://fohrkast.com/law/in.dpdp/1#in.dpdp/erasure.purpose_over), [the one year copy](https://fohrkast.com/law/in.dpdp/1#in.dpdp/retention.one_year), [the 72 hour report](https://fohrkast.com/law/in.dpdp/1#in.dpdp/breach.board_report).

---

# DPDP software for partner firms: one workspace, many client businesses

URL: https://fohrkast.com/dpdp-software-for-partner-firms

A partner firm that looks after the privacy work of several businesses runs Fohrkast for them from one partner workspace: it imports the businesses it advises, each administrator claims the workspace for its business, and the firm sees counts and prepares drafts; it opens a business's records or personal data only where a mandate allows it. No legal duty moves to the firm: each business remains the Data Fiduciary (s.8(1)), and partner pricing is set under the partner agreement.

## How does the partner route work?

- The firm imports the businesses it advises. Fohrkast emails each administrator a claim link, valid for 14 days and usable once. The administrator claims the workspace for the business.
- The firm holds counts and drafts only; it opens a business's records or personal data only where a mandate allows it.
- Once the administrator signs a mandate, the firm can act within the powers the administrator ticks: publish documents, review and accept, accept unedited updates in bulk, log requests, and prepare and track incidents. Opening sealed personal data and adding staff stay excluded unless ticked. A mandate runs for 12 months and can be revoked at any time with immediate effect.
- A distributor sees counts only, across its partner firms.

## Which duties weigh most for the businesses a partner firm looks after?

- **A published contact and request route.** The business contact of the Data Protection Officer or of a person who answers questions, shown on the website or app and repeated in every reply to a rights request, and how people make a request (s.8(9), Rule 9, Rule 14(1)).
- **Grievances.** An easy route to complain and a published response period of at most 90 days (s.8(10), s.13, Rule 14(3)).
- **Notice and consent.** A notice before or with every consent request (s.5(1), Rule 3), withdrawal as easy as giving consent (s.6(4)), and proof of each notice and consent (s.6(10)).
- **Rights requests.** Access (s.11), correction (s.12(2)), erasure (s.12(3)) and nomination (s.14). Rule 14(3) caps the grievance period at 90 days, and the PIB explainer of 17 Nov 2025 applies 90 days to access, correction and erasure requests; Fohrkast dates them 90 days from receipt, a Fohrkast reading.
- **Breaches.** Each affected person and the Board told without delay, and the detailed report to the Board within 72 hours of becoming aware (Rule 7(1), Rule 7(2)(a), Rule 7(2)(b)). Penalty up to ₹200 crore (s.33, Schedule item 2).
- **Vendors, the firm included.** A firm that handles personal data for a business, as an accounting firm may, is one of its vendors: the business stays responsible for that processing (s.8(1)) and needs a valid contract with the firm that includes reasonable security safeguards (s.8(2), Rule 6(1)(f)). A SaaS or payroll provider that processes data for a business is also one of its vendors; see the [DPDP for SaaS and payroll providers page](https://fohrkast.com/dpdp-for-saas-and-payroll-providers).

## When do the duties start?

| Date | What starts | Gazette reference |
|---|---|---|
| 13 Nov 2026 | Registration of Consent Managers (s.6(9), s.27(1)(d), Rule 4). | G.S.R. 843(E), item (b); G.S.R. 846(E), Rule 1(3) |
| 13 May 2027 | Nearly every duty on businesses, and the Board's penalties. | G.S.R. 843(E), item (c); G.S.R. 846(E), Rule 1(4) |

Both dates count from the Gazette dated 13 November 2025; some sources give 14 Nov 2026 and 14 May 2027. Fohrkast counts from 12 Nov 2026 and 12 May 2027, a day early to be safe, and shows each duty as a recommended step until its start date.

The [DPDP compliance checklist](https://fohrkast.com/dpdp-compliance-checklist) lists every duty with its clause and start date.

## What does Fohrkast do for a partner firm?

- One partner workspace for the businesses the firm advises, each with the duties in the Act and the Rules that apply to it, with its date, its basis and the clause it comes from.
- Counts across the firm's businesses, and the drafts the firm prepares.
- The administrator's screens, the claim page and the hosted request page in English or Hindi.
- For each business, every step written to a hash chained record (SHA-256) with times in IST, and an evidence pack the business can export on every plan, including after a plan ends.

The [DPDP compliance software fact sheet](https://fohrkast.com/dpdp-compliance-software) covers plans, limits, hosting and dates across every kind of business.

## How does Fohrkast hold data?

- Designed to hold the least personal data each duty needs. Personal details are sealed under a key for each person.
- Each opening of a person's sealed details by a seat is written to the audit trail.

Each business decides and sends every notice and filing, and remains the Data Fiduciary, responsible for its duties, including when a partner firm acts for it (s.8(1)).

## Which plan usually fits?

Partner pricing and terms are set under the partner agreement and are not published. To ask, request access at fohrkast.com and choose "A partner firm". The plans a business holds on its own, and their prices, are listed as [plans and prices in INR](https://fohrkast.com/pricing).

## Questions and answers

### Is there DPDP software for a firm that manages many client businesses?

Yes. A partner firm looks after its clients from one Fohrkast partner workspace: it imports them, each client claims its own workspace, and the firm sees counts and prepares drafts. Once a client signs a 12 month mandate, the firm can act within the powers the client ticks. Each client remains the Data Fiduciary (s.8(1)), and partner pricing is set under the partner agreement.

### Does a partner firm become responsible for its clients' DPDP duties?

No. Each business remains the Data Fiduciary, responsible for its duties, including when a partner firm acts for it (s.8(1)). A firm that handles a client's personal data does so as one of that client's vendors, under a valid contract with reasonable security safeguards (s.8(2), Rule 6(1)(f)).

### What can a partner firm see in Fohrkast?

Counts and drafts only; a client's records or personal data only where its mandate allows it. Once a client signs a mandate, the firm can act within the powers the client ticks; opening sealed personal data and adding staff stay excluded unless ticked. A distributor sees counts across its partner firms, never records.

### How does a client business join through its partner firm?

The firm imports the business. Fohrkast emails the administrator a claim link, valid for 14 days and usable once, and the administrator claims the workspace for the business.

### How is Fohrkast priced for partner firms?

Partner pricing and terms are set under the partner agreement and are not published. To ask, request access at fohrkast.com and choose "A partner firm".

## Sources

- Digital Personal Data Protection Act, 2023 (22 of 2023): [MeitY copy](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf). Read 21 Oct 2026.
- G.S.R. 846(E), Digital Personal Data Protection Rules, 2025: [MeitY copy](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf). Read 21 Oct 2026.
- G.S.R. 843(E), commencement of the Act, 13 Nov 2025: [MeitY copy](https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf). Read 21 Oct 2026.
- PIB explainer, DPDP Rules 2025 Notified, 17 Nov 2025: [PDF](https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf). Read 21 Oct 2026.
- Fohrkast rulebook in.dpdp version 1: [published duties](https://fohrkast.com/law/in.dpdp/1).

Related duties in the published rulebook: [vendor contracts](https://fohrkast.com/law/in.dpdp/1#in.dpdp/processors.contract), [a published contact](https://fohrkast.com/law/in.dpdp/1#in.dpdp/contact.publish), [the grievance route](https://fohrkast.com/law/in.dpdp/1#in.dpdp/grievance.mechanism), [access requests](https://fohrkast.com/law/in.dpdp/1#in.dpdp/rights.access), [the 72 hour report](https://fohrkast.com/law/in.dpdp/1#in.dpdp/breach.board_report).

---

# The 72 hour report to the Data Protection Board (Rule 7): the clock, the contents, the start time

URL: https://fohrkast.com/blog/dpdp-breach-72-hour-report-rule-7

Published 5 Nov 2026 · Updated 5 Nov 2026 · By Fohrkast Editorial

# The 72 hour report to the Data Protection Board (Rule 7): the clock, the contents, the start time

On becoming aware of a personal data breach, a business must tell each affected person and the Data Protection Board without delay, and then send the Board a detailed report within 72 hours of becoming aware, or within a longer period the Board allows on a written request (s.8(6); Rule 7(1), 7(2)(a) and 7(2)(b)). The duty covers every personal data breach, with no size threshold, and starts on 13 May 2027. Failing to give these intimations can attract a penalty of up to ₹200 crore (s.33, Schedule item 2).

## What counts as a personal data breach?

The Act defines it as "any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data" (s.2(u)).

The definition reaches beyond theft. An email sent to the wrong list, a lost phone holding customer numbers, a former employee who still has access, and ransomware that locks patient records (loss of access) can each be a personal data breach. Rule 7 sets no minimum number of people or level of harm before the duty applies.

## What must be sent, to whom and when?

| To | When | What | Reference |
|---|---|---|---|
| Each affected person | Without delay | What happened, how much and when; the likely consequences for her; what the business has done and is doing to reduce the risk; what she can do to protect herself; a contact who can answer her questions | Rule 7(1) |
| The Board: first intimation | Without delay | A description of the breach: its nature, extent, timing and location, and the likely impact | Rule 7(2)(a) |
| The Board: detailed report | Within 72 hours of becoming aware, or a longer period the Board allows on a written request | Updated and detailed information on the description; the facts, circumstances and reasons that led to the breach; measures taken or proposed to reduce the risk; any findings about who caused it; the remedial measures to prevent it happening again; a report on the intimations given to affected people | Rule 7(2)(b) |

The notice to each person must be "concise, clear and plain", given "to the best of its knowledge", and sent "through her user account or any mode of communication registered by her" with the business (Rule 7(1)).

Only the detailed report has a number of hours. The notice to people and the first intimation to the Board are due "without delay", which can be well before 72 hours.

## When does the 72 hour clock start?

At the moment the business becomes aware of the breach: the report is due "within seventy-two hours of becoming aware of the breach" (Rule 7(2)(b)). Neither the Act nor the Rules defines "aware".

In practice three times can differ: when a tool, a customer or a third party first raised an alert; when the business first noticed something was wrong; and when it became aware that personal data was affected. Recording all three, as they happen, lets the business show how it fixed the start of the clock. Fohrkast counts the 72 hours from the awareness time the business records, never prefilled, and shows any earlier alert time beside it. That count is Fohrkast's reading.

## Can the Board allow more time?

Yes. Rule 7(2)(b) allows "such longer period as the Board may allow on a request made in writing in this behalf". The text does not say when the request must be made. A request made, and kept on record, before the 72 hours run out leaves the least room for dispute.

## Where is the report sent?

On 21 October 2026 Fohrkast could not find a Data Protection Board website or a filing form. The Rules make the Board a digital office (Rule 20), so an online route is expected. Until one is published, keep proof of how and when each intimation was sent.

## How does this sit with the CERT-In six hours?

They are two separate duties. The CERT-In Directions of 28 April 2022, issued under s.70B(6) of the Information Technology Act, 2000, require service providers, intermediaries, data centres, body corporates and government organisations to report the cyber incidents listed in their Annexure I to CERT-In "within 6 hours of noticing such incidents or being brought to notice about such incidents" (direction (ii)). That duty applies today, whether or not personal data is involved.

One incident can trigger both: a report to CERT-In within 6 hours, and the DPDP intimations to people and the Board, with the detailed Board report within 72 hours. Each has its own recipient, trigger and contents.

## When does Rule 7 start?

Rule 7 starts with the main tranche of the Rules, eighteen months after publication in the Official Gazette (Rule 1(4)), and s.8(6) and the penalties in s.33 start the same day (G.S.R. 843(E), item (c)). Counted from the printed Gazette date, that is 13 May 2027; some sources count from 14 November 2025 and give 14 May 2027. The [DPDP dates post](/blog/dpdp-dates-13-nov-2026-13-may-2027) explains the difference.

Until then, Fohrkast shows the Rule 7 steps on an incident as recommended steps, not legal deadlines.

## What does Fohrkast do with a breach?

- Any seat from front desk upward can report an incident, with its type, when it was first noticed, any earlier alert, and the awareness time.
- Fohrkast counts the deadlines from the awareness time and alerts the people holding each contact role by email and in the app; an alert not acknowledged in time goes to the administrators.
- It drafts the notice to affected people (Rule 7(1)) and the report pack for the Board. The business edits each text and releases it only with a recent authenticator code.
- The list of affected people is generated by the scanner inside the business's own environment; Fohrkast holds counts only.
- For each recipient, the administrator or privacy lead records the filing: stage, channel, time sent in IST, an optional reference number and an optional receipt.
- A drill runs the same deadlines with no filing made.

The business decides and sends each intimation, and files with the Board and CERT-In; Fohrkast drafts each intimation and records each filing the business logs. Each incident carries the CERT-In 6 hour clock, with email alerts and a drafted report for the business to send.

## Sources

- G.S.R. 846(E), Digital Personal Data Protection Rules, 2025, Rules 1, 7 and 20: [MeitY copy](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf). Read 21 October 2026.
- Digital Personal Data Protection Act, 2023 (22 of 2023), ss.2(u), 8(6) and 33, and the Schedule: [MeitY copy](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf). Read 21 October 2026.
- G.S.R. 843(E), dates of commencement of the DPDP Act, 13 November 2025: [MeitY copy](https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf). Read 21 October 2026.
- CERT-In, Directions under s.70B(6) of the Information Technology Act, 2000, No. 20(3)/2022-CERT-In, 28 April 2022: [PDF](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf). Read 21 October 2026.

Last checked 21 October 2026. Related duties in the published rulebook: [tell each affected person](https://fohrkast.com/law/in.dpdp/1#in.dpdp/breach.tell_people), [tell the Board](https://fohrkast.com/law/in.dpdp/1#in.dpdp/breach.tell_board), [the 72 hour report](https://fohrkast.com/law/in.dpdp/1#in.dpdp/breach.board_report), [security safeguards](https://fohrkast.com/law/in.dpdp/1#in.dpdp/security.safeguards).

*Not legal advice.*

---

# Consent Managers under the DPDP Act: what they do and who needs one

URL: https://fohrkast.com/blog/consent-managers-dpdp-act

Published 3 Nov 2026 · Updated 3 Nov 2026 · By Fohrkast Editorial

# Consent Managers under the DPDP Act: what they do and who needs one

A Consent Manager is a company registered with the Data Protection Board that runs a platform through which a person can give, manage, review and withdraw consent to businesses from one place (s.2(g); Rule 4 and the First Schedule to the DPDP Rules). The registration provisions start on 13 November 2026 (s.6(9), Rule 4), and the provisions that let a person act through a Consent Manager start on 13 May 2027 (s.6(7) and (8)). The Act says a person "may" use one, and Fohrkast reads nothing in the Act or the Rules as requiring a business to join one; a business that does accept consent through a Consent Manager should first check that the Board has registered it.

## What is a Consent Manager?

The Act defines it as "a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform" (s.2(g)).

Three features set it apart:

- **It works for the person, not the business.** It is "accountable to the Data Principal" and acts on her behalf (s.6(8)), and must "act in a fiduciary capacity in relation to the Data Principal" (First Schedule, Part B, item 8).
- **It routes consent, and can route data, without reading it.** A person can give consent to a business on the platform directly, or through another business on the platform that holds her data (Part B, item 1), and the platform must make the data available in a way whose contents "are not readable by it" (Part B, item 2). The Rules illustrate this with a person sending her bank statement from one bank to another through the platform.
- **It must be registered.** Under the Act, only a person registered with the Board is a Consent Manager (s.2(g), s.6(9)).

## Who can become one?

Part A of the First Schedule sets the conditions for registration. Among them:

- the applicant is a company incorporated in India (item 1);
- its net worth is not less than two crore rupees (item 4);
- it has the technical, operational and financial capacity for the role, and its finances and management are sound (items 2 and 3);
- its directors, key managerial personnel and senior management have a record of fairness and integrity (item 6);
- its memorandum and articles require it to avoid conflicts of interest with businesses, and can be amended on that point only with the Board's approval (item 7);
- it is "independently certified" that its interoperable platform meets the data protection standards and assurance framework the Board publishes (item 9).

The PIB explainer of 17 November 2025 puts it plainly: Consent Managers "must be companies based in India".

## What must a registered Consent Manager do?

Part B of the First Schedule lists its obligations. It must:

- keep a record of the consents given, denied or withdrawn, the notices that came with each request, and each sharing of data with another business (item 3);
- give the person access to that record, a machine readable copy on request, and keep it for at least seven years (item 4);
- run a website or app as the main way people use it (item 5), and not subcontract its obligations (item 6);
- take reasonable security safeguards (item 7);
- avoid conflicts of interest with businesses, including through its directors and managers (items 9 and 10), and publish its promoters, directors, senior managers and every shareholder above two per cent (item 11);
- report audits to the Board (item 12), and not change control without the Board's prior approval (item 13).

Like a business, a Consent Manager must publish how people can make requests and a grievance period of at most 90 days (Rule 14(1) and (3)).

## How does registration work?

An applicant that meets Part A applies to the Board with the particulars and documents the Board publishes on its website (Rule 4(1)). The Board may inquire, and then either registers the applicant and publishes its particulars on its website, or rejects the application with reasons (Rule 4(2)). The Board can direct a Consent Manager that falls short to put things right, and can suspend or cancel its registration after a hearing (Rule 4(4) and (5)). The Act lets the Board inquire into a breach of a condition of registration (s.27(1)(d)), and into a person's complaint against a Consent Manager (s.27(1)(c)).

On 21 October 2026 Fohrkast could not find a Data Protection Board website or any list of Consent Managers. The Board can register Consent Managers only once Rule 4 is in force.

## When does this start?

| Date | What starts | Reference |
|---|---|---|
| 13 November 2026 | Every Consent Manager must be registered (s.6(9)); the Board may inquire into a breach of a registration condition (s.27(1)(d)); conditions and obligations (Rule 4, First Schedule) | G.S.R. 843(E), item (b); G.S.R. 846(E), Rule 1(3) |
| 13 May 2027 | A person may act through a Consent Manager (s.6(7)); its accountability to the person (s.6(8)); complaints against a Consent Manager (s.27(1)(c)) | G.S.R. 843(E), item (c) |

Both dates count from the Gazette dated 13 November 2025; some sources count from 14 November. The [DPDP dates post](/blog/dpdp-dates-13-nov-2026-13-may-2027) explains why, and why Fohrkast plans to the day before.

## Does a business need a Consent Manager?

On Fohrkast's reading, no. Section 6(7) says a person "may" give, manage, review or withdraw consent through a Consent Manager: the choice is the person's. The Act and the Rules contain no duty for a business to join a Consent Manager's platform.

Using one does not move a business's own duties. The business still gives the notice (s.5), still carries the burden of proving notice and consent if a question arises (s.6(10)), and stays responsible for its processing (s.8(1)).

A business that does accept consent through a Consent Manager should:

1. check that the Board has registered it before relying on it, and note when it checked;
2. check again if the Board suspends or cancels a registration (Rule 4(5)).

Fohrkast lists this as a duty from 12 November 2026 for businesses that say they use a Consent Manager ([duty](https://fohrkast.com/law/in.dpdp/1#in.dpdp/consent.manager_registered)). The law puts registration on the Consent Manager, so asking the business to check is Fohrkast's reading and shows as Recommended.

## Is consent management software a Consent Manager?

No. Software a business uses to collect and record its own customers' consent works for that business. A Consent Manager works for the person, must be registered with the Board, and must avoid conflicts of interest with the businesses on its platform (s.2(g), s.6(8); First Schedule, Part B, items 8 to 10).

Fohrkast is consent management software, not a Consent Manager. It records consent for each business as that business's processor, under a processor agreement (fohrkast.com/dpa, s.8(2)).

## Sources

- Digital Personal Data Protection Act, 2023 (22 of 2023), ss.2(g), 6(7) to (10), 8(1), 27(1)(c) and (d): [MeitY copy](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf). Read 21 October 2026.
- G.S.R. 846(E), Digital Personal Data Protection Rules, 2025, Rules 1, 4 and 14, First Schedule: [MeitY copy](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf). Read 21 October 2026.
- G.S.R. 843(E), dates of commencement of the DPDP Act, 13 November 2025: [MeitY copy](https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf). Read 21 October 2026.
- PIB, "DPDP Rules, 2025 Notified", 17 November 2025: [PDF](https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf). Read 21 October 2026.

Last checked 21 October 2026. Related duties in the published rulebook: [Consent Manager registered](https://fohrkast.com/law/in.dpdp/1#in.dpdp/consent.manager_registered), [valid and withdrawable consent](https://fohrkast.com/law/in.dpdp/1#in.dpdp/consent.valid_and_withdrawable), [proof of notice and consent](https://fohrkast.com/law/in.dpdp/1#in.dpdp/consent.proof), [grievance route](https://fohrkast.com/law/in.dpdp/1#in.dpdp/grievance.mechanism).

*Not legal advice.*

---

# Who the DPDP Act applies to: Fiduciaries, Processors, exemptions

URL: https://fohrkast.com/blog/who-the-dpdp-act-applies-to

Published 29 Oct 2026 · Updated 29 Oct 2026 · By Fohrkast Editorial

# Who the DPDP Act applies to: Fiduciaries, Processors, exemptions

The DPDP Act applies to the processing of digital personal data in India, including paper records that are later digitised, and to processing outside India connected with offering goods or services to people in India (s.3(a) and (b)). Whoever decides why and how that data is processed is a Data Fiduciary and carries the duties, whatever its size (s.2(i), s.8(1)); a vendor that processes the data on its behalf is a Data Processor (s.2(k)). The Act does not apply to personal or domestic use, or to data made public by the person or under a legal duty (s.3(c)), and s.17 sets out narrower exemptions.

## What data does the Act cover?

Personal data is "any data about an individual who is identifiable by or in relation to such data" (s.2(t)), and digital personal data is personal data in digital form (s.2(n)). The Act covers that data where it is collected in digital form, or collected on paper and digitised later (s.3(a)). A paper register that is never typed, scanned or photographed into a system falls outside s.3(a).

Processing is broad: any wholly or partly automated operation on digital personal data, including collection, recording, storage, use, sharing, disclosure and erasure (s.2(x)). A customer's phone number kept in a billing app, a patient file in clinic software, an employee record in a payroll spreadsheet and a chat on WhatsApp Business are all processing of digital personal data.

## Does it apply to processing outside India?

Yes, where the processing is "in connection with any activity related to offering of goods or services to Data Principals within the territory of India" (s.3(b)). A business abroad that sells to people in India is covered for that processing.

The reverse case is largely exempt. Where a person based in India processes personal data of people outside India under a contract with a person outside India, Chapter II (except s.8(1) and (5)), Chapter III and s.16 do not apply (s.17(1)(d)). An Indian firm serving a foreign client's customers keeps the duty to be responsible for its processing and to protect the data with reasonable security safeguards.

## Who is a Data Fiduciary?

"Any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data" (s.2(i)). A person includes an individual, a Hindu undivided family, a company, a firm, an association of persons, the State and every artificial juristic person (s.2(s)).

The Act sets no turnover, headcount or customer count threshold for being a Data Fiduciary. Thresholds appear only for particular extra duties, set out below. A pharmacy, a clinic, a school, an accounting firm and a listed bank are all Data Fiduciaries for the personal data whose purpose and means they decide. The pages on [DPDP for clinics and hospitals](https://fohrkast.com/dpdp-for-clinics-and-hospitals) and [DPDP for D2C and ecommerce](https://fohrkast.com/dpdp-for-d2c-and-ecommerce) show the duties that weigh most for those businesses, and [DPDP software for partner firms](https://fohrkast.com/dpdp-software-for-partner-firms) covers an accounting or advisory firm that looks after several of them.

The Data Fiduciary is responsible for complying with the Act and the Rules "irrespective of any agreement to the contrary", including for processing done for it by a Data Processor (s.8(1)).

## Who is a Data Processor, and what does it owe?

"Any person who processes personal data on behalf of a Data Fiduciary" (s.2(k)): a cloud host, a payroll provider, a messaging service, a courier, an accounting firm handling a client's staff records.

The duties in Chapter II are addressed to the Data Fiduciary, and they reach the processor through the Data Fiduciary:

- a processor may be engaged only under a valid contract (s.8(2)), which must provide for reasonable security safeguards (Rule 6(1)(f));
- the Data Fiduciary must cause its processors to stop processing when consent is withdrawn (s.6(6)) and to erase data when the purpose ends (s.8(7)(b));
- in the illustration to Rule 8(3) (Case 2), the Data Fiduciary must ensure that the cloud provider it engages as a processor keeps the data and its logs for at least one year before erasure.

The same company can hold both roles. Fohrkast is a useful example: it processes records for each business under a processor agreement (fohrkast.com/dpa, s.8(2)), and it is the Data Fiduciary for its own users and visitors (fohrkast.com/privacy).

The [DPDP for SaaS and payroll providers page](https://fohrkast.com/dpdp-for-saas-and-payroll-providers) sets out what a provider owes in each role.

## What is outside the Act altogether?

- Personal data processed by an individual for a personal or domestic purpose (s.3(c)(i)).
- Personal data made publicly available by the individual it relates to, or by a person under a legal obligation to publish it (s.3(c)(ii)).
- Processing by a State instrumentality the Central Government notifies on grounds such as sovereignty, security of the State or public order (s.17(2)(a)).
- Processing necessary for research, archiving or statistical purposes, where the data is not used for a decision specific to a person and the standards in the Second Schedule are followed (s.17(2)(b), Rule 16).

## Which duties are lifted in particular cases?

Section 17(1) switches off most of Chapter II (except s.8(1) and (5)), all of Chapter III and s.16 where processing is necessary for:

- enforcing a legal right or claim (a);
- a court, tribunal or regulator performing its judicial, quasi judicial, regulatory or supervisory function (b);
- preventing, detecting, investigating or prosecuting an offence (c);
- the offshore contracts described above (d);
- a merger, demerger or similar scheme approved by a court, tribunal or competent authority (e);
- finding the financial information, assets and liabilities of a borrower who has defaulted on a loan from a financial institution (f).

Three further routes:

- **Notified classes, including startups.** The Central Government may notify Data Fiduciaries or classes of them, including startups, to whom s.5 (notice), s.8(3) and (7) (accuracy and erasure), s.10 (Significant Data Fiduciaries) and s.11 (access) do not apply (s.17(3)). A startup here is a private company, partnership firm or LLP recognised under the government's startup criteria. Fohrkast's rulebook (in.dpdp version 1) records no such notification as of 21 October 2026.
- **The State.** For processing by the State or its instrumentalities, s.8(7), s.12(3) and, where no decision affecting the person is made, s.12(2) do not apply (s.17(4)).
- **Time bound declarations.** Within five years of the Act's commencement, the Central Government may declare by notification that any provision does not apply to particular Data Fiduciaries or classes for a stated period (s.17(5)).

Rule 12 and the Fourth Schedule also relax the children's duties in s.9(1) and (3) for listed classes, such as clinical establishments and healthcare professionals, and for listed purposes, each subject to conditions.

## Who carries extra duties?

- **Significant Data Fiduciaries,** once notified by the Central Government under s.10(1): a Data Protection Officer based in India, an independent data auditor, and a Data Protection Impact Assessment and audit every 12 months (s.10(2), Rule 13). Fohrkast's rulebook records no notification as of 21 October 2026.
- **Large platforms in the Third Schedule:** ecommerce entities with at least two crore registered users in India, online gaming intermediaries with at least fifty lakh, and social media intermediaries with at least two crore must erase the data of users inactive for three years, after 48 hours' notice (s.8(8), Rule 8(1) and (2)).
- **Anyone processing children's data** (under 18, s.2(f)) needs verifiable parental consent and must not track, behaviourally monitor or target advertising at children (s.9, Rule 10).

## When do these provisions start?

Sections 3 and 17, with nearly every other duty, start on 13 May 2027 (G.S.R. 843(E), item (c)). The [DPDP dates post](/blog/dpdp-dates-13-nov-2026-13-may-2027) sets out the start dates and the question of 13 or 14 May.

## How does Fohrkast work this out for a business?

At setup, Fohrkast asks plain questions: does the business keep details about people on a phone, computer, app or website; does another company handle those details for it; do children use its service; has the government named it a Significant Data Fiduciary. Each answer switches the matching duties in rulebook in.dpdp version 1 on or off, and the register shows the clause behind each one. The [DPDP compliance checklist](https://fohrkast.com/dpdp-compliance-checklist) lists every duty in rulebook in.dpdp version 1 with its clause and start date.

## Sources

- Digital Personal Data Protection Act, 2023 (22 of 2023): [MeitY copy](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf). Read 21 October 2026.
- G.S.R. 846(E), Digital Personal Data Protection Rules, 2025, 13 November 2025: [MeitY copy](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf). Read 21 October 2026.
- G.S.R. 843(E), dates of commencement of the DPDP Act, 13 November 2025: [MeitY copy](https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf). Read 21 October 2026.
- Fohrkast rulebook in.dpdp version 1, published 20 October 2026: [fohrkast.com/law/in.dpdp/1](https://fohrkast.com/law/in.dpdp/1). Read 21 October 2026.

Last checked 21 October 2026. Related duties in the published rulebook: [vendor contracts](https://fohrkast.com/law/in.dpdp/1#in.dpdp/processors.contract), [security safeguards](https://fohrkast.com/law/in.dpdp/1#in.dpdp/security.safeguards), [erasure when the purpose ends](https://fohrkast.com/law/in.dpdp/1#in.dpdp/erasure.purpose_over), [children](https://fohrkast.com/law/in.dpdp/1#in.dpdp/children.parent_consent), [Third Schedule erasure](https://fohrkast.com/law/in.dpdp/1#in.dpdp/retention.third_schedule), [Significant Data Fiduciaries](https://fohrkast.com/law/in.dpdp/1#in.dpdp/sdf.duties).

*Not legal advice.*

---

# Why customer data needs protecting, and what the DPDP Act asks

URL: https://fohrkast.com/blog/why-protect-customer-data

Published 28 Oct 2026 · Updated 29 Oct 2026 · By Fohrkast Editorial

# Why customer data needs protecting, and what the DPDP Act asks

Every clinic, school, shop and accounts firm holds pieces of its customers' lives: a phone number, an address, a health history, a child's photo. On its own each piece says little. Joined with pieces held elsewhere, which AI can now do in seconds, it can describe a person well enough to deceive or target her. From 13 May 2027 the DPDP Act makes looking after those pieces a duty for every business that holds them: tell people why the data is collected, keep it safe, erase it when the purpose is over, and tell people and the Board when it leaks (G.S.R. 843(E); Rule 7).

## What does a business hold about its customers?

Take one ordinary day for one customer. At nine she fills a form at a clinic: name, age, phone number and the reason for the visit, and the receptionist sends a photo of the form to the doctor. At eleven her son's school app asks for his photo and class. At one a delivery app learns her address, her gate number and the hours she is at home. At four a courier leaves a label with her name and phone number at the door.

Each of those was a business. Each now holds one piece of her day. That has always been true of shops and clinics. What has changed is what can be done with the pieces.

## Why does one small detail matter now?

A phone number on its own is harmless. So is an address, a photo or a list of past orders. Matching them used to be slow work: someone had to sit with lists and join them by hand. AI tools now do that matching in seconds, from a number on one list, a name on another and a voice in a public video.

The joined picture is what makes a fraud convincing. In April 2024 the Tamil Nadu Police cyber crime wing warned of callers using AI to copy the voice of a family member and ask for money.

In June 2023, media reports said a Telegram bot returned personal details of people registered for COVID vaccination to anyone who typed in a phone number. The Ministry of Health and Family Welfare called the reports baseless and said CERT-In's first finding was that the bot did not draw directly on CoWIN's systems. Wherever the details came from, the pattern is the one that matters here: details collected for one purpose, gathered together and handed to strangers.

When a piece leaks from a business, its customer cannot tell where the picture came from. She knows only that she trusted someone with her details.

## Does it matter where a leak starts?

Not to the customer, and not under the Act. In May 2021 Air India said a cyberattack on its passenger system provider had exposed data of about 45 lakh passengers. The attack was on a vendor; the passengers were Air India's. The same month, reports said data from about 18 crore Domino's India orders had been put up for sale; Jubilant FoodWorks said no financial information was accessed.

The DPDP Act puts that responsibility in writing. A business is responsible for processing done on its behalf by a Data Processor, "irrespective of any agreement to the contrary" (s.8(1)), and may engage one only under a valid contract (s.8(2)) ([duty](https://fohrkast.com/law/in.dpdp/1#in.dpdp/processors.contract)). The data a vendor holds for a business is still its customers' data.

## What does the DPDP Act ask of a business?

From 13 May 2027, a business that decides why and how personal data is processed has five plain duties among others:

- s.5: give a notice before or with each request for consent, saying what data is collected and why ([duty](https://fohrkast.com/law/in.dpdp/1#in.dpdp/notice.before_consent)).
- s.8(5): protect personal data with reasonable security safeguards, including data processed by its vendors ([duty](https://fohrkast.com/law/in.dpdp/1#in.dpdp/security.safeguards)).
- s.8(7): erase personal data once consent is withdrawn or the purpose is over, and have its vendors erase it too ([duty](https://fohrkast.com/law/in.dpdp/1#in.dpdp/erasure.purpose_over)).
- ss.11 to 13: answer a person's requests to see, correct or erase her data, and her complaints.
- Rule 7: tell each affected person and the Board about a breach without delay ([duty](https://fohrkast.com/law/in.dpdp/1#in.dpdp/breach.tell_people)), and send the Board a detailed report within 72 hours of becoming aware of it ([duty](https://fohrkast.com/law/in.dpdp/1#in.dpdp/breach.board_report)).

The penalty for failing to take reasonable security safeguards goes up to ₹250 crore (s.33, Schedule item 1). The [DPDP compliance checklist](https://fohrkast.com/dpdp-compliance-checklist) lists every duty with its clause and start date.

## Does the Act apply to a small business?

**Fohrkast reading:** the Act sets no minimum size. A business that decides why and how digital personal data is processed in India is a Data Fiduciary (s.2(i)), whether it is a one doctor clinic or a hospital chain. The duties above apply to both; what differs is how much data each holds.

## What habits protect customer data?

Six habits cover most of the ground, and none needs a technology team:

1. **Collect only what is needed.** A form that does not need a date of birth should not ask for one.
2. **Say why.** One short notice, in a language the customer reads.
3. **Lock it, and know who holds the key.** Which staff, which apps, which phones.
4. **Erase on time.** Data a business no longer holds cannot leak from it.
5. **Know the vendors.** Who stores, prints, delivers or messages for the business, and what each one holds.
6. **Know the first call if something leaks.** Who decides, who tells customers, who tells the Board, and by when. The [DPDP breach reporting page](https://fohrkast.com/dpdp-breach-reporting) sets out each notice and the 72 hour report.

Most of these need a decision and a record of it, more than any new system.

## Why is careful handling good for business?

People choose the clinic that keeps their reports private and the school that keeps a child's photo out of open groups. Care with data is something a business can show: a clear notice, a simple way to ask for a copy, a quick answer when someone wants details erased. Where most businesses have not yet thought about it, that care is a reason to be chosen.

## Sources

- Digital Personal Data Protection Act, 2023 (22 of 2023): [MeitY copy](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf). Read 21 October 2026.
- G.S.R. 843(E), dates of commencement of the DPDP Act, 13 November 2025: [MeitY copy](https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf). Read 21 October 2026.
- G.S.R. 846(E), Digital Personal Data Protection Rules, 2025, Rule 7: [MeitY copy](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf). Read 21 October 2026.
- Ministry of Health and Family Welfare on reports of a CoWIN data breach, 12 June 2023: [PIB release](https://www.pib.gov.in/PressReleasePage.aspx?PRID=1931691). Read 28 October 2026.
- Tamil Nadu Police cyber crime wing advisory on AI voice cloning, April 2024: [MediaNama report](https://www.medianama.com/2024/04/223-tamil-nadu-police-cybercrime-advisory-ai-voice-cloning/). Read 28 October 2026.
- Air India on the breach at its passenger system provider, May 2021: [Scroll report](https://scroll.in/latest/995486/scroll_in). Read 28 October 2026.
- Domino's India orders data and Jubilant FoodWorks' statement, May 2021: [MediaNama report](https://www.medianama.com/2021/05/223-dominos-data-leak/). Read 28 October 2026.

Last checked 28 October 2026.

*Not legal advice.*

---

# The DPDP dates: 13 Nov 2026 and 13 May 2027, and what applies on each

URL: https://fohrkast.com/blog/dpdp-dates-13-nov-2026-13-may-2027

Published 27 Oct 2026 · Updated 29 Oct 2026 · By Fohrkast Editorial

# The DPDP dates: 13 Nov 2026 and 13 May 2027, and what applies on each

Under the Gazette notifications dated 13 November 2025, registration of Consent Managers starts on 13 November 2026, and nearly every duty the DPDP Act places on businesses, together with the Data Protection Board's power to impose penalties, starts on 13 May 2027 (G.S.R. 843(E); Rule 1 of the DPDP Rules, G.S.R. 846(E)). The text counts from "the date of publication" and names no calendar date, and the eGazette copies were digitally signed on 14 November 2025, so some sources give 14 November 2026 and 14 May 2027. A business ready by 12 November 2026 and 12 May 2027 is ready on either reading.

## What does the Gazette text say?

Rule 1 of the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)), as corrected, sets three starts:

> (2) Rules 1, 2 and 17 to 21 shall come into force on the date of their publication in the Official Gazette.
>
> (3) Rule 4 shall come into force one year after the date of publication in the Official Gazette.
>
> (4) Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication in the Official Gazette.
>
> Source: Rule 1, G.S.R. 846(E)

As first printed, sub-rules (3) and (4) ended "of this Gazette". The corrigenda of 10 December 2025 (G.S.R. 892(E)) replaced both with "in the Official Gazette". Neither wording names a calendar date.

For the Act itself, G.S.R. 843(E), issued under s.1(2) of the Act on the same day, appoints the same three points: (a) "the date of publication of this notification in the Official Gazette"; (b) "one year from the date of publication of this gazette" for s.6(9) and s.27(1)(d); and (c) "eighteen months from the date of publication of this gazette" for the rest of the Act's operative provisions.

## Is it 13 or 14 November?

The printed date is 13 November. Both notifications appear in the Gazette of India, Extraordinary, Part II, Section 3, Sub-section (i), whose masthead reads "Thursday, November 13, 2025", and each notification is headed "New Delhi, the 13th November, 2025". Counted from that date, the starts are 13 November 2026 and 13 May 2027.

Three things point to the 14th. The eGazette numbers end in the 14th (CG-DL-E-14112025-267647 for G.S.R. 843(E) and CG-DL-E-14112025-267650 for G.S.R. 846(E)); both copies were digitally signed on 14 November 2025, at 10:37 and 10:43 IST; and the PIB explainer of 17 November 2025 says the Rules were "notified on 14 November 2025". Counted from the 14th, the starts are 14 November 2026 and 14 May 2027.

**Fohrkast reading:** Neither the Act nor the Rules says which of these is the date of publication for this purpose, and Fohrkast has not found an official statement that settles it. Until counsel or the Board does, the prudent course is to be ready a day before the earlier reading. Fohrkast's rulebook counts from 12 November 2026 and 12 May 2027 for that reason, and marks both as Fohrkast readings.

## What has applied since 13 November 2025?

The definitions (s.2) and the provisions that set up the Data Protection Board and its procedure (ss.18 to 26), with ss.35 and 38 to 43 and s.44(1) and (3) of the Act (G.S.R. 843(E), item (a)). On the Rules side, Rules 1 and 2 and Rules 17 to 21, which deal with appointing the Board's members, their terms, the Board's meetings, its working as a digital office and its staff (Rule 1(2)).

None of these places a duty on a business.

## What starts on 13 November 2026?

Only the Consent Manager framework:

- s.6(9): every Consent Manager must be registered with the Board, on the conditions the Rules set.
- s.27(1)(d): the Board may inquire into a breach of a condition of a Consent Manager's registration.
- Rule 4 and the First Schedule: who may apply (Part A) and what a registered Consent Manager must do (Part B).

For most businesses nothing changes on this date. A business that accepts consent through a Consent Manager should check that the Board has registered it. The Act's other Consent Manager provisions, s.6(7) and s.6(8), start with the main tranche on 13 May 2027. The [Consent Managers post](/blog/consent-managers-dpdp-act) explains the role, and the [DPDP Consent Managers page](https://fohrkast.com/dpdp-consent-managers) covers registration from 13 November 2026.

## What starts on 13 May 2027?

Sections 3 to 5, s.6(1) to (8) and (10), sections 7 to 17, s.27 except s.27(1)(d), sections 28 to 34, 36 and 37, and s.44(2) of the Act (G.S.R. 843(E), item (c)); and Rules 3, 5 to 16, 22 and 23 (Rule 1(4)). In practice:

| Area | Act | Rules |
|---|---|---|
| Who the Act applies to | s.3 | |
| Grounds for processing, notice and consent | ss.4 to 7 (s.6(9) starts earlier, on 13 November 2026) | Rule 3 (notice); Rule 5 and the Second Schedule (processing by the State) |
| Security, breaches, erasure, retention, contact details, grievances | s.8 | Rules 6, 7, 8 and 9; Third and Seventh Schedules |
| Children and persons with disability | s.9 | Rules 10, 11 and 12 |
| Significant Data Fiduciaries | s.10 | Rule 13 |
| Access, correction, erasure, grievances, nomination | ss.11 to 14 | Rule 14 |
| Duties of individuals, transfers abroad, exemptions | ss.15, 16 and 17 | Rules 15 and 16 |
| The Board's powers, appeals and penalties | ss.27 to 34 | Rule 22 |
| Information the government may call for | s.36 | Rule 23 |

The penalties in the Schedule to the Act start the same day (s.33). They go up to ₹250 crore for failing to take reasonable security safeguards (item 1), ₹200 crore for failing to notify a breach to the Board or an affected person (item 2), ₹200 crore for breaching the duties on children's data (item 3), ₹150 crore for a Significant Data Fiduciary's additional duties (item 4), ₹10,000 for an individual's breach of the duties in s.15 (item 5), and ₹50 crore for any other breach of the Act or the Rules (item 7).

The same day, s.44(2) omits s.43A from the Information Technology Act, 2000. Until then, s.43A and the rules made under it continue to apply.

## Can the dates move?

The dates come from two notifications in the Gazette. Two later Gazette instruments changed the text without moving any date: corrigenda to the Rules (G.S.R. 892(E), 10 December 2025), which reword Rule 1(3) and (4) as quoted above and correct other typographical slips, and the DPDP (Removal of Difficulties) Order, 2026 (S.O. 5458(E), dated 5 October 2026), which rewords s.9(1) and s.10(2)(c)(ii) of the Act. Any change to a start date would need a new notification. Fohrkast publishes a dated note for each signed rulebook version at fohrkast.com/law/changes.

## What should be ready by each date?

By 12 November 2026: if the business uses, or plans to use, a Consent Manager, a record of checking that it is registered with the Board ([duty](https://fohrkast.com/law/in.dpdp/1#in.dpdp/consent.manager_registered)). Nothing else in the Rules starts on that date.

By 12 May 2027, the duties that start with the main tranche. Among them:

- A notice before or with every request for consent, in English or a language of the Eighth Schedule (s.5, Rule 3), and a notice to people who consented before that date (s.5(2)) ([duty](https://fohrkast.com/law/in.dpdp/1#in.dpdp/notice.before_consent), [legacy notice](https://fohrkast.com/law/in.dpdp/1#in.dpdp/notice.legacy)).
- A published way to make requests and a published grievance period of at most 90 days (Rule 14(1) and (3)) ([duty](https://fohrkast.com/law/in.dpdp/1#in.dpdp/grievance.mechanism)).
- A way to tell affected people and the Board about a breach, with the detailed report within 72 hours of becoming aware (Rule 7) ([duty](https://fohrkast.com/law/in.dpdp/1#in.dpdp/breach.board_report)). The [DPDP breach reporting page](https://fohrkast.com/dpdp-breach-reporting) sets out each notice and the 72 hour report.
- Reasonable security safeguards, with logs kept for one year (s.8(5), Rule 6(1)(e)) ([duty](https://fohrkast.com/law/in.dpdp/1#in.dpdp/security.safeguards)).

## How does Fohrkast use these dates?

Rulebook in.dpdp version 1 dates each of its 27 duties from these notifications, counting from 12 November 2026 and 12 May 2027. Until a duty's start date, Fohrkast shows it as a recommended step rather than a legal deadline. The [DPDP compliance checklist](https://fohrkast.com/dpdp-compliance-checklist) lists the 27 duties with their clauses and start dates.

## Sources

- G.S.R. 846(E), Digital Personal Data Protection Rules, 2025, Gazette of India Extraordinary, 13 November 2025: [MeitY copy](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf). Read 21 October 2026.
- G.S.R. 843(E), dates of commencement of the DPDP Act, Gazette of India Extraordinary, 13 November 2025: [MeitY copy](https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf). Read 21 October 2026.
- Digital Personal Data Protection Act, 2023 (22 of 2023): [MeitY copy](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf). Read 21 October 2026.
- G.S.R. 892(E), corrigenda to the DPDP Rules, 2025, dated 10 December 2025, Gazette of India Extraordinary, 11 December 2025: [MeitY copy](https://www.meity.gov.in/static/uploads/2025/12/3c7ebbae0e5456f493f486e6845df86b.pdf). Read 21 October 2026.
- S.O. 5458(E), DPDP (Removal of Difficulties) Order, 2026: [eGazette](https://egazette.gov.in/WriteReadData/2026/276885.pdf). Read 21 October 2026.
- PIB, "DPDP Rules, 2025 Notified", 17 November 2025: [PDF](https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf). Read 21 October 2026.

Last checked 21 October 2026. Related duties in the published rulebook: [in.dpdp version 1](https://fohrkast.com/law/in.dpdp/1).

*Not legal advice.*