Understanding DPDP Act Data Fiduciary Obligations: A Practical Guide for Indian Organizations
How to structure consent management, data minimization programs, and grievance redressal under the DPDP Act 2023.
Who the Act actually binds
The DPDP Act 2023 binds any entity that determines the purpose and means of processing digital personal data of individuals in India — the data fiduciary. The obligations attach regardless of sector and regardless of where processing physically occurs, and the Significant Data Fiduciary designation layers on additional duties: a resident Data Protection Officer, independent audits, and periodic Data Protection Impact Assessments.
Consent that would survive scrutiny
The Act's consent standard is specific: free, informed, unconditional, unambiguous, and granular to the stated purpose, with withdrawal as easy as the giving. Most existing consent flows in Indian organizations fail at least two of those tests — usually bundling (consent as a condition of service beyond what the service requires) and withdrawal friction. Consent architecture is an engineering project, not a policy update: capture, purpose-binding, withdrawal propagation, and Consent Manager interoperability all need system design.
Data principal rights are workflow problems
Access, correction, erasure, grievance redressal, and nomination rights each imply an operational workflow with statutory response expectations. The organizations that handle rights requests cheaply are the ones whose data maps are current — you cannot erase what you cannot locate. A maintained record of processing activities is the quiet prerequisite for every other obligation in the Act.
A pragmatic sequence for readiness
Sequence matters: map personal data flows first, remediate consent and notice second, stand up rights and grievance workflows third, then formalize breach-notification playbooks against Data Protection Board and CERT-In timelines. Attempting policy documentation before the data map exists produces paperwork that an audit dismantles in an afternoon.