DPDP Act
Advanced Topics

No. The DPDP Act requires consent to be specific, so consent for one purpose cannot be bundled with consent for an unrelated purpose. In practice you must present separate, individually selectable consents — for example, order updates as one (required) consent and marketing as another (optional) consent — rather than a single "I agree to everything" checkbox. Service cannot be made conditional on an optional consent, and a withdrawal mechanism must be as easy to use as the original opt-in (Section 6(4)).

Yes, by default. The DPDP Act takes a "blacklist" approach: cross-border transfers are generally permitted, but Section 16 empowers the Central Government to restrict transfers of personal data to specific countries or territories by notification. Sector rules can be stricter — RBI, for instance, requires certain payment data to be stored in India. Organisations should maintain a transfer inventory (what data goes where, via which processors) and a contingency plan in case a destination is later restricted.

Under the DPDP Act, a child is anyone under 18 years of age — higher than GDPR (16, or lower by member state) or the US COPPA (13). Processing a child’s personal data requires verifiable parental consent, and Section 9 prohibits tracking, behavioural monitoring, and targeted advertising directed at children, as well as any processing likely to cause harm. This higher threshold means many mainstream services must build robust age-assurance and parental-consent mechanisms.

Section 7 defines "legitimate uses" where consent is not required. These include data a data principal voluntarily provides for a specified purpose, performance of a function under law, compliance with a legal obligation or court order, medical emergencies, safeguarding life or health during an epidemic or disaster, and certain employment-related processing. Each is narrow and conditional — for example, the employment exemption is limited to what is reasonably necessary for the employment relationship. Stretching a legitimate use to avoid obtaining consent is a frequent compliance error.

Where the DPDP Act and a sector regulation both apply, the prudent default is to follow the stricter requirement and document the legal basis for it. For example, RBI data-localisation overrides DPDP’s permissive cross-border stance for payment data; SEBI and IRDAI record-retention mandates justify holding data that DPDP minimisation might otherwise delete, so you retain per the sector rule and delete afterwards; and TRAI commercial-communication consent operates alongside DPDP consent. Tranquility Cybersecurity (TCSA) helps regulated organisations reconcile these overlapping regimes without creating gaps in either.