Six Asian countries brought in data laws before India. Here's what happened next.
Eight lessons from Sri Lanka, Vietnam, Indonesia, Malaysia, Thailand and Singapore, for businesses, solution providers, legal teams and regulators.
READ THE REPORT →What the DPDP Act actually requires, and what we found when we checked our own product against it first.
Eight lessons from Sri Lanka, Vietnam, Indonesia, Malaysia, Thailand and Singapore, for businesses, solution providers, legal teams and regulators.
READ THE REPORT →Section 8(6) names two separate notification audiences, not one — the Data Protection Board and affected Data Principals. And the decision that something is a reportable breach shouldn't rest on the one person with the most pressure for the answer to be no.
READ THE POST →If your privacy programme was built against GDPR first, unlearn this: Section 4 allows exactly two lawful grounds, and Section 7's list of "legitimate uses" is closed — not a general-purpose balancing test you can argue your way into.
READ THE POST →The DPDP Act doesn't give an unconditional right to deletion. Section 8(7)(a) puts a specific, lawful brake on it — and shredding an encryption key is the wrong way to resolve the collision with a statutory retention duty.
READ THE POST →An acknowledgment email is not the same as a closed request. What Sections 11–14 actually require, and why a rights request has to be tracked against every system it touches, not just the one the support team happens to look at.
READ THE POST →Privacy consultants hand out Data Protection Impact Assessments like a universal prescription. Under DPDP, that advice is sometimes just wrong — knowing whether you're a notified Significant Data Fiduciary matters more than filling in the template.
READ THE POST →The Act never says "artificial intelligence." There is one AI-adjacent obligation across the Act and its Rules, it binds Significant Data Fiduciaries only — quoted here verbatim with its digest. And the obligations that will actually reach your models are somewhere else entirely.
READ THE POST →Almost every DPDP explainer leads with "penalties of up to ₹250 crore" as if it's a flat ceiling for any violation. It isn't — it's one line in a seven-tier schedule, tied to one specific failure. The actual breakdown, with sections.
READ THE POST →Most "DPDP compliance checklists" are a lead-gen form wearing a listicle's clothes. This one names the actual section for every item — notice, consent, breach response, and data-principal rights — so you can go read the text instead of taking our word for it.
READ THE POST →"We log everything" is not the same claim as "our logs can't be quietly edited after the fact." How the hash-chained, Ed25519-signed audit trail actually works, why it's not an audit opinion, and a live verifier you can check it against yourself.
READ THE POST →"Consent Manager," "Significant Data Fiduciary," and "Data Protection Board" get used loosely in a lot of DPDP explainers. The Act defines all three precisely — what each one actually means, with the section numbers, and where Consent Tree itself stands against each.
READ THE POST →Most consent banners take one click to accept and a support ticket to undo. That's not a UX nitpick — it's a compliance gap you can point at with a section number. Where the Act draws the line, why almost everyone gets it backwards, and where we found the same gap in our own product first.
READ THE POST →