They expertly mapped the overlapping controls between SOC 2 and ISO 27001, which saved us from duplicating work.
Jasreet Kaur B.Silicon Physical Design Engineer · Small-BusinessSOC 2 + ISO 27001 · August 2026
DPDP ACT 2023 · 5 ADVANCED COMPLIANCE AREAS
DPDP countdown
Most DPDP duties apply from 13 May 2027.
Eighteen months after G.S.R. 843(E) and the DPDP Rules (G.S.R. 846(E)) were published in the Gazette dated 13 November 2025.
Countdown to 13 May 2027
Consent-manager registration rules take effect 13 November 2026
See every DPDP deadlineDeep dive into complex DPDP compliance scenarios: consent management, cross-border transfers, children's data protection, legitimate uses, and regulatory conflicts.
Expert guidance for organizations across Mumbai, Bangalore, Delhi, Hyderabad, Gurgaon, and Pune.
5Hard compliance areas
Under 18Child-data threshold
1,000+Audits delivered
DPDP Act 2023 · Sections 6, 7, 9 & 16 · Last reviewed June 2026
Direct Answer
What are the hardest parts of DPDP Act compliance?
The DPDP Act 2023 is short on text but deep in edge cases, and five areas account for most of the difficulty: granular consent and withdrawal (Section 6), cross-border transfers (Section 16), children’s data (Section 9), Section 7 legitimate uses, and conflicts with sector regulators. The recurring theme is that the Act states a principle simply, but engineering it correctly — unbundled consents, verifiable parental consent, a defensible legitimate-use claim — is where programs succeed or fail.
Two rules of thumb resolve most hard calls. First, where the DPDP Act — administered by MeitY — overlaps a sector regulator (RBI, SEBI, IRDAI, TRAI), follow the stricter requirement and document the basis. Second, treat consent as the default and legitimate uses as narrow exceptions, not a convenient bypass. The deep-dives below work through each scenario with concrete right/wrong examples, and the DPDP Act knowledge hub covers the baseline obligations these build on.
Key Takeaways
- The DPDP Act 2023 requires consent to be specific and unbundled, with withdrawal as easy as giving it (Section 6) — the hardest part of compliance is engineering granular consent, not stating it.
- Cross-border transfers are permitted by default, but Section 16 lets the Central Government restrict transfers to notified countries, so organisations should keep a live transfer inventory and contingency plan.
- Children’s data carries the strictest regime: an 18-year threshold, verifiable parental consent, and a ban on tracking, behavioural monitoring, and targeted advertising of children (Section 9).
- Section 7 legitimate uses let processing proceed without consent in defined cases (employment, legal obligation, medical emergency), but they are narrow — over-relying on them is a common and risky mistake.
Expert Deep Dives
Five Advanced Compliance Areas
Consent Management Deep Dive
Granular vs Bundled Consent
DPDP Act requires consent to be "specific" - meaning consent for one purpose cannot be bundled with consent for another unrelated purpose. Organizations must provide separate consent options for distinct purposes.
E-commerce Platform
WRONG:
Single checkbox: "I agree to receive order updates and marketing communications"
RIGHT:
Separate checkboxes: (1) "I agree to receive order updates" (required), (2) "I agree to receive marketing communications" (optional)
Banking App
WRONG:
Bundled consent for account opening, credit assessment, and third-party offers
RIGHT:
Separate consent for: (1) Account opening (required), (2) Credit assessment (required for loans), (3) Marketing offers (optional)
Best Practices:
- Unbundle consent for different purposes
- Make optional consents clearly optional
- Do not make service conditional on optional consents
- Provide granular control in user preferences
Consent Withdrawal Mechanisms
Section 6(4) requires that withdrawal of consent must be as easy as giving consent. This means the withdrawal mechanism must be equally accessible and straightforward.
Mobile App
WRONG:
Consent given via one-click button, withdrawal requires emailing support
RIGHT:
Consent given via button, withdrawal via same button or in-app settings with one click
Website
WRONG:
Consent via popup, withdrawal buried in privacy policy with complex form
RIGHT:
Consent via popup, withdrawal via account settings or footer link with simple toggle
Best Practices:
- Provide withdrawal mechanism in same location as consent
- No additional steps or friction for withdrawal
- Immediate effect upon withdrawal
- Confirmation message after withdrawal
- No penalties or service degradation for withdrawal
Consent Refresh Strategies
While DPDP Act does not mandate consent expiry, best practice is to periodically refresh consent, especially for marketing and profiling purposes.
Best Practices:
- Refresh marketing consent annually
- Re-confirm consent after significant privacy policy changes
- Periodic consent review for inactive users
- Clear communication about why consent is being refreshed
Consent Manager Integration
Rule 4 establishes Consent Managers as intermediaries for managing consent. Organizations can integrate with registered Consent Managers for standardized consent management.
Technical Considerations:
- API integration with Consent Manager platforms
- Real-time consent status synchronization
- Consent artifact storage and verification
- Fallback mechanisms if Consent Manager is unavailable
- Audit trail of consent requests and responses
Cross-Border Transfer Complexities
Restricted Countries Framework
Section 16 allows Central Government to restrict data transfers to specific countries. Organizations must monitor notifications and ensure compliance.
As of January 2025, no restricted countries list has been notified. However, organizations should prepare for potential restrictions.
Preparation Steps:
- Maintain data transfer inventory (which data, to which countries)
- Identify critical third-party processors and their locations
- Develop contingency plans for potential restrictions
- Implement data localization capabilities if needed
- Monitor Data Protection Board notifications
Cloud Infrastructure Considerations
Most organizations use cloud providers with global infrastructure. Cross-border transfer compliance requires careful architecture.
Multi-Region Cloud Deployment
CHALLENGE:
Data may be replicated across regions for redundancy
SOLUTION:
Configure cloud services to restrict data to specific regions, disable automatic cross-region replication, use region-specific encryption keys
Global SaaS Platform
CHALLENGE:
Customer data from India mixed with global customer data
SOLUTION:
Implement data residency options, separate Indian customer data, use dedicated India region infrastructure
Adequacy Decisions (Future)
Similar to GDPR, DPDP Act may allow adequacy decisions for countries with equivalent data protection. Monitor for future developments.
Children's Data Protection
Age Threshold: Under 18
Unlike GDPR (16 years) or COPPA (13 years), DPDP Act sets the age threshold at 18 years. This is significantly higher and requires robust age verification.
Implications:
- Larger user base requires parental consent
- Age verification becomes critical
- Parental consent verification mechanisms needed
- Separate privacy notices for children and parents
Verifiable Parental Consent
Section 9 requires "verifiable" parental consent - meaning organizations must have reasonable assurance that consent is from actual parent/guardian.
Verification Methods:
OTP to Parent Mobile
Pros: Simple, fast, low friction
Cons: Child may have access to parent phone
Best for: Low-risk applications
Document Verification
Pros: Higher assurance, verifiable identity
Cons: High friction, privacy concerns
Best for: High-risk or sensitive data processing
Credit Card Verification
Pros: Reasonable assurance (minors typically don't have cards)
Cons: Excludes users without cards, payment friction
Best for: Paid services
Video KYC
Pros: High assurance, identity verification
Cons: Very high friction, expensive
Best for: Very high-risk scenarios
Prohibited Processing
Section 9(3) prohibits tracking, behavioral monitoring, and targeted advertising of children.
Prohibited:
- No behavioral profiling or tracking
- No targeted advertising based on child's data
- No location tracking (except for safety)
- No sharing child data for marketing
Allowed Processing:
- Service delivery and functionality
- Safety and security
- Parental controls and monitoring
- Age-appropriate content curation (not behavioral)
Legitimate Uses Analysis (Section 7)
When Consent is NOT Required
Section 7 lists specific purposes where consent is not required. Understanding these exemptions is critical for compliance.
Voluntary provision by Data Principal
Example: User voluntarily provides email in contact form for specific purpose
Conditions: Purpose must be clear, data used only for stated purpose
Performance of function under law
Example: Government agency collecting data for statutory function
Conditions: Must be authorized by law, limited to necessary data
Compliance with court order or legal obligation
Example: Responding to court summons, tax compliance
Conditions: Must be actual legal requirement, not voluntary
Medical emergency
Example: Hospital accessing patient records in emergency
Conditions: Genuine emergency, proportionate access
Employment-related processing
Example: HR processing employee data for payroll, benefits
Conditions: Limited to employment relationship, reasonable necessity
Safeguarding life or health
Example: Contact tracing during epidemic, emergency services
Conditions: Genuine threat to life/health, proportionate response
Common Mistakes:
- Over-relying on legitimate use when consent is more appropriate
- Using "voluntary provision" for data collected via mandatory forms
- Claiming employment exemption for optional employee programs
- Stretching "legal obligation" to include voluntary compliance
State Processing Standards
Section 7(b) allows State to process data for specific purposes. This creates a separate framework for government data processing.
State Processing Exemptions:
- Provision of benefits or services
- Issuance of certificates, licenses, permits
- Prevention and detection of fraud
- Verification of attendance and prevention of absenteeism
Conflict Resolution
DPDP vs Sector-Specific Regulations
Organizations in regulated sectors must comply with both DPDP Act and sector-specific regulations. Understanding how these interact is critical.
Banking & Finance (RBI)
Conflict:
RBI mandates data localization, but DPDP allows cross-border transfer (subject to restrictions)
Resolution:
Follow stricter requirement (RBI data localization)
Guidance:
Maintain data in India as per RBI, ensure DPDP compliance for Indian data
Securities (SEBI)
Conflict:
SEBI requires retention of records for specific periods, but DPDP requires data minimization
Resolution:
Retain data as per SEBI requirements, delete after retention period
Guidance:
Document legal basis for retention, implement automated deletion post-retention
Insurance (IRDAI)
Conflict:
IRDAI requires extensive data collection, but DPDP requires purpose limitation
Resolution:
Collect data as per IRDAI requirements with clear purpose specification
Guidance:
Separate consent for regulatory vs marketing purposes
Telecom (TRAI)
Conflict:
TRAI has specific consent requirements for commercial communication
Resolution:
Comply with both TRAI (DND) and DPDP consent requirements
Guidance:
Implement dual consent tracking, respect both frameworks
DPDP vs Contractual Obligations
Contracts may require data sharing or processing that conflicts with DPDP requirements.
B2B Contract Requiring Data Sharing
CONFLICT:
Contract requires sharing customer data with partner, but DPDP requires consent
RESOLUTION:
Obtain consent for data sharing, or renegotiate contract
BEST PRACTICE:
Include DPDP compliance clauses in all new contracts
Data Retention in Service Agreement
CONFLICT:
Contract requires indefinite data retention, but DPDP requires data minimization
RESOLUTION:
Renegotiate retention period, or obtain ongoing consent
BEST PRACTICE:
Define reasonable retention periods in contracts
DPDP vs Other Privacy Laws (GDPR, CCPA)
Organizations operating globally must comply with multiple privacy frameworks.
For what California’s law requires, see our CCPA and CPRA page.
Recommended Approach:
- Identify overlapping requirements (consent, rights, breach notification)
- Implement highest common standard where possible
- Maintain separate compliance for jurisdiction-specific requirements
- Use privacy management platforms for multi-jurisdiction compliance
Key Differences:
Territorial Scope
DPDP:
Processing of digital personal data in India
GDPR:
Processing in EU or offering goods/services to EU residents
Approach:
Determine which law applies based on data subject location and processing location
Age Threshold
DPDP:
18 years
GDPR:
16 years (or lower as per member state)
Approach:
Apply stricter threshold (18) for users who may be in both jurisdictions
Penalties
DPDP:
Up to ₹250 Crores
GDPR:
Up to €20M or 4% of global turnover
Approach:
Ensure compliance with both to avoid penalties under either framework
Proof
In their words.
Quotes verbatim from G2. Company names added where the client confirmed them.
Instead of simply providing generic templates or checklists, their team took the time to understand our environment and requirements.
Anand .Market Risk Analyst · Mid-MarketCompliance readiness · September 2026
The team’s willingness to work with us and ease of communication.
sam v.CEO · Small-BusinessSOC 2 Type I + ISO 27001 · August 2026
They delivered the project with speed, accuracy, and cost-effectiveness.
Maneet P.Mid-MarketSOC 2 · August 2026
My only regret is that we didn’t engage them sooner in our compliance journey, which would have saved us even more time.
Mahesh Raju C. · XonarSmall-BusinessSOC 2 · GRC · August 2026
They were always responsive and willing to go the extra mile whenever we had questions or needed guidance.
Chandan J. · DsiderSmall-BusinessSOC 2 Type I · August 2026
Managing the auditor relationship on our behalf was especially valuable — it took a lot of pressure off our internal team.
Achyut B.Senior Software Engineer · Small-BusinessSOC 2 + ISO 27001 · September 2026
Their focus on ensuring that we were genuinely audit-ready rather than simply completing documentation.
Ravi V.Founder & CEO · Mid-MarketSOC 2 Type II · August 2026
The guidance was not generic or simply based on a standard checklist — they suggested practical approaches that made sense for our business.
Verified UserInternational Trade and Development · Small-BusinessSOC 2 + ISO 27001 · September 2026
What I like best is the hands-on support and clear guidance throughout the SOC 1 and SOC 2 process.
Sai Sudha S. · ExcersSmall-BusinessSOC 1 + SOC 2 · September 2026
DPDP Advanced Topics — Frequently Asked Questions
The edge-case questions on consent, transfers, children’s data, and regulatory conflicts.
Does the DPDP Act allow consent to be bundled?
No. The DPDP Act requires consent to be specific, so consent for one purpose cannot be bundled with consent for an unrelated purpose. In practice you must present separate, individually selectable consents — for example, order updates as one (required) consent and marketing as another (optional) consent — rather than a single "I agree to everything" checkbox. Service cannot be made conditional on an optional consent, and a withdrawal mechanism must be as easy to use as the original opt-in (Section 6(4)).
Can personal data be transferred outside India under the DPDP Act?
Yes, by default. The DPDP Act takes a "blacklist" approach: cross-border transfers are generally permitted, but Section 16 empowers the Central Government to restrict transfers of personal data to specific countries or territories by notification. Sector rules can be stricter — RBI, for instance, requires certain payment data to be stored in India. Organisations should maintain a transfer inventory (what data goes where, via which processors) and a contingency plan in case a destination is later restricted.
What is the age of a child under the DPDP Act?
Under the DPDP Act, a child is anyone under 18 years of age — higher than GDPR (16, or lower by member state) or the US COPPA (13). Processing a child’s personal data requires verifiable parental consent, and Section 9 prohibits tracking, behavioural monitoring, and targeted advertising directed at children, as well as any processing likely to cause harm. This higher threshold means many mainstream services must build robust age-assurance and parental-consent mechanisms.
When can personal data be processed without consent under the DPDP Act?
Section 7 defines "legitimate uses" where consent is not required. These include data a data principal voluntarily provides for a specified purpose, performance of a function under law, compliance with a legal obligation or court order, medical emergencies, safeguarding life or health during an epidemic or disaster, and certain employment-related processing. Each is narrow and conditional — for example, the employment exemption is limited to what is reasonably necessary for the employment relationship. Stretching a legitimate use to avoid obtaining consent is a frequent compliance error.
How do you resolve a conflict between the DPDP Act and a sector regulator?
Where the DPDP Act and a sector regulation both apply, the prudent default is to follow the stricter requirement and document the legal basis for it. For example, RBI data-localisation overrides DPDP’s permissive cross-border stance for payment data. SEBI and IRDAI record-retention mandates justify holding data that DPDP minimisation might otherwise delete, so you retain per the sector rule and delete afterwards. TRAI commercial-communication consent operates alongside DPDP consent. Tranquility Cybersecurity (TCSA) helps regulated organisations reconcile these overlapping regimes without creating gaps in either.
Working through a hard scenario? Cross-check it against the DPDP Act knowledge hub, quantify the downside with the penalty calculator, and review how we have handled comparable engagements on our proof page. For specialist help, Tranquility Cybersecurity (TCSA) offers DPDP compliance consulting in India.
Keep Exploring
Related Reading
Privacy
DPDP Knowledge Hub
Rules 2025, penalties, SDF obligations and 14 deep-dive guides.
Read morePrivacy
Significant Data Fiduciary
Enhanced obligations for large-scale data processors under the DPDP Act.
Read morePrivacy
DPDP Cross-Border Transfers
Rules on transferring personal data outside India under the DPDP Act.
Read morePrivacy
DPDP vs GDPR
Side-by-side comparison for companies subject to both regimes.
Read morePrivacy
ISO 27701 (PIMS)
The privacy extension to ISO 27001 — one audit, two certificates.
Read morePrivacy
DPDP Act Overview
India's Digital Personal Data Protection Act, explained.
Read moreDPDP course · Module 5 of 8
You finished Module 5. You can now tell when part of the Act switches off, when personal data may leave India, and how to answer a government request.