The Future of Data Protection in India

Most discussion of DPDP Act penalties stops at the headline number -up to ₹250 crore for the most serious violations. What actually determines whether a company ends up anywhere near that ceiling is a process most businesses have never walked through: how the Data Protection Board of India investigates, what it weighs, and what options exist before a penalty is finalised. Here’s what that process actually looks like, step by step. Step One: Something Triggers the Board’s Attention An inquiry doesn’t start in a vacuum. It begins one of four ways: a Data Principal’s complaint (after they’ve first raised it with your organisation directly and gone through your internal grievance process), a data breach notification your organisation itself reports, a reference from the Central Government or a court, or a suo motu inquiry the Board opens on its own initiative -often prompted by public reporting of an incident. That first route matters more than most companies realise. Individuals are requi...

If you've been researching DPDP compliance and come across the term "Consent Manager," there's a good chance you've also seen it used two completely different ways in the same search results — once as a strict legal term for a registered regulatory entity, and once as a generic product name for consent software. That overlap causes real confusion, and it's worth clearing up before it costs you time or money on the wrong thing. The Legal Definition Under Section 2(g) of the Digital Personal Data Protection Act, 2023, a Consent Manager is a company registered with the Data Protection Board of India that gives individuals a single, interoperable interface to give, manage, review, and withdraw consent across multiple organisations. This is a narrow, regulated role, governed by Rule 4 of the DPDP Rules, 2025 and the First Schedule's eligibility conditions — India incorporation, a minimum ₹2 crore net worth, governance requirements, and a bar on the entity als...