Vol. II · Issue 07 · 2026-07-07
The compliance register · DPDP Act, 2023 · Rules, 2025
Ed. Bureau v2
A · 01
Compliance register
क़ानून, सीधी भाषा में। The DPDP Act, in plain terms.
What the law asks of anyone issuing certificates. What pramaan.me does about each.
The Digital Personal Data Protection Act, 2023 governs how anyone in India — a company, a college, a blood-camp organiser — handles personal data in digital form. Collect names and emails to issue certificates and you are a data fiduciary under the Act. The obligations below apply whether or not you use software to meet them.
11 Aug 2023
The Act receives assent. Definitions, obligations, and penalties on the books; enforcement waits on the Rules.
14 Nov 2025
The DPDP Rules are notified. An 18-month phased schedule begins. The Data Protection Board of India stands up.
13 Nov 2026
Consent Manager provisions take effect. The Board is expected to move from guidance to active supervision around this date.
13 May 2027
All remaining obligations take effect. Penalties run to ₹250 crore per violation.
Dates per the Rules as notified 14 Nov 2025. Checked 07 Jul 2026.
B · 01
दायित्व, एक-एक करके। The obligations, one by one.
Sixteen rows. Each states what the Act asks, what pramaan.me does about it today, and where that lives. Marked honestly — partial means partial.
| Obligation | What the law asks | Status | Where it lives |
|---|---|---|---|
| Notice at collection§5 · Rule 3 | A plain-language notice — what is collected, why, and how to complain — presented before consent is sought. | ✓ ImplementedThe recipient sign-up presents the notice at the point of collection; issuance is blocked until it is acknowledged. | Privacy §4 |
| Free, specific consent§6 | Consent must be free, specific, informed, and unambiguous — one purpose per consent, no bundling. | ✓ ImplementedPhoto reuse and marketing email are separate, unticked opt-ins. Neither gates the certificate. | /profile |
| Easy withdrawal§6(4) | Withdrawing consent must take no more effort than giving it did. | ✓ ImplementedEvery opt-in is revocable from the profile page, no email required. | /profile |
| Consent records§6 · Rules | Keep proof of what was consented to, when, and when it was withdrawn. | ✓ ImplementedEvery consent and withdrawal is written to the audit trail with a timestamp. | /profile |
| Right to access§11 | On request, a summary of the personal data held and the processing done with it. | ◐ PartialServed by email within 7 working days. A self-serve export is not yet built. | Privacy §8 |
| Correction & erasure§12 | Correct inaccurate data; erase personal data on request, unless retention is required by law. | ◐ PartialAccount fields correct self-serve on /profile. Erasure is honoured on request as a hard delete — certificate and audit references survive without personal data. A self-serve delete is not yet built. | /profile · Privacy §8 |
| Grievance redressal§13 | A published grievance officer and a working escalation path. | ✓ ImplementedNamed officer, acknowledgement in 24 hours, resolution in 15 days, escalation to the Data Protection Board. | Grievance |
| Nomination§14 | A data principal may nominate someone to exercise their rights after death or incapacity. | ◐ PartialThe right is documented and honoured by email. No in-product nomination field yet. | Privacy §8 |
| Security safeguards§8(5) · Rule 6 | Reasonable safeguards: encryption, access control, logging, backups. | ✓ ImplementedTLS 1.3 in transit, AES-256 at rest, least-privilege IAM, CloudTrail on production access. Verify pages set no cookies. | Privacy §7 |
| Breach notification§8(6) · Rule 7 | Notify affected data principals and the Board within 72 hours of a personal-data breach. | ✓ ImplementedThe 72-hour commitment is published; an internal incident runbook covers detection through notification. CERT-In 6-hour reporting sits alongside it. | Privacy §7 |
| Retention limits§8(7) · Rule 8 | Erase when the purpose is served; keep each class of data no longer than needed. | ✓ ImplementedPublished schedule: magic-link tokens 90 days, closed accounts 30 days, audit logs 18 months, invoices 8 years per the Income-tax Act. | Privacy §6 |
| Processor contracts§8(2) | Personal data goes to third parties only under a valid contract, for a stated purpose. | ✓ ImplementedTwo subprocessors — AWS (Mumbai) and Dodo Payments — published with purpose. 30 days' notice before any addition. | Privacy §5 |
| Children's data§9 · Rule 10 | Verifiable parental consent before processing a minor's data. No tracking or targeted advertising at children. | ◐ PartialOrganisers must obtain parental consent before issuing event codes to minors; an in-product verification flow is on the roadmap. No ads and no tracking — for anyone. | Privacy §10 |
| Cross-border transfer§16 | Transfer personal data only to countries the central government has not restricted. | ✓ ImplementedAll primary data lives in Mumbai (AWS ap-south-1). Nothing crosses a border in v1. | Privacy §11 |
| Consent Manager interop§6(7)–(9) | Accept consent given and managed through registered Consent Managers. In force 13 November 2026. | ○ On the roadmapThe Board's register of Consent Managers is still being populated. Integration is scheduled ahead of the November 2026 date. | — |
| Significant Data Fiduciary duties§10 | Impact assessments, annual audits, a resident data protection officer — for fiduciaries the government designates. | ○ Not designatedApplies only on government notification, by volume and sensitivity of data. Reviewed quarterly. | — |
Sources: the Act as assented 11 August 2023; the Rules as notified 14 November 2025. This page is a compliance record, not legal advice. Rows marked partial name their gap; the mark changes when the gap closes, and the date above changes with it.
C · 01
Issuing abroad — GDPR and CCPA.
Certificates cross borders even when data doesn't. Every consent surface is built to the strictest of the three regimes, so meeting one standard meets all three.
Consent design
Built to GDPR Article 7 — separable, unbundled, revocable. That standard satisfies DPDP §6 and CCPA consent requirements in the same motion.
Erasure
The DPDP erasure path doubles as the GDPR Article 17 right and the CCPA right to delete. Same request, same hard delete.
Sale of data
Nothing is sold or shared for advertising, so the CCPA "Do Not Sell or Share" obligation is met by the architecture, not a toggle.
One contact
The DPDP grievance officer is also the GDPR and CCPA privacy contact. One address, one log.
Residency
Primary data stays in Mumbai by default. An EU representative is appointed when EU traffic becomes material — not before.
Questions the table doesn't answer, or an error in it: founders@hawklogicsystems.com.
Corrections are made, and dated.