Data Protection India.
Know exactly where you stand.

"Personal data" under the DPDP Act means any data that identifies or can identify an individual. This includes: customer names, email addresses, phone numbers, purchase history, health information, financial information, location data, biometric data, and IP addresses. Even a simple customer database or email marketing list contains personal data subject to the Act. "Sensitive personal data" — health, financial, biometric, sexual orientation — has additional protection requirements.

A data mapping exercise documents: what personal data your organisation collects, where it is stored (databases, spreadsheets, email, cloud services), who has access, what it is used for, how long it is retained, and who it is shared with (vendors, service providers, government). The data map is the foundation of DPDP Act compliance — you cannot implement consent management, security controls, or deletion policies without knowing what data you actually have and where it lives.

The DPDP Act restricts transfer of personal data outside India to countries notified by the Central Government as having adequate data protection. The notified countries list has not yet been published (expected in 2025). Until the list is published, businesses should: identify all instances of personal data leaving India (cloud services hosted abroad, sharing with foreign group companies, international service providers), document the legal basis for these transfers, and prepare to implement transfer restrictions if required when the country list is notified.

A Consent Management Platform (CMP) is a system that captures, records, and manages user consent for data processing. Under the DPDP Act, every processing purpose requires separate, specific, and freely given consent. A CMP: presents consent requests in plain language (not legal jargon), records consent with timestamp and version of the privacy notice shown, allows users to withdraw consent, and maintains audit logs for regulatory compliance. For Indian businesses, a basic CMP can be implemented in existing website/app forms without a dedicated platform — IBEAN's Fractional CISO designs the right approach for your scale.