The Act, explained against the clock

The Act is forty-four sections long; most of the work comes from three of them: Sec. 5 on what a notice must contain, Sec. 6 on what makes a consent valid and what withdrawing one obliges you to do, and Sec. 8 on who answers for processing carried out on your behalf. Sec. 1(2) brings it into force on dates the Central Government appoints, different dates for different provisions — which is why these guides are written against the clock rather than against the section order.

Two questions settle before the rest is worth reading. Does the DPDP Act apply to my organisation? takes the first out of Sec. 3, which reaches processing inside India and processing abroad connected with offering goods or services to Data Principals in India, and excludes only personal or domestic use and data the Data Principal made public herself. What commences when takes the second, and is the page to re-read when the Gazette moves.

The other two are mechanics. What a consent notice must contain works through Sec. 5, which attaches a notice to every request for consent and, at Sec. 5(3), gives the Data Principal the option of English or any Eighth Schedule language. Consent Manager registration applies to fewer readers: Sec. 6(7) lets a Data Principal give, manage, review or withdraw consent through a Consent Manager, and Sec. 6(9) requires one to be registered with the Board. Where a duty lands differently by sector, a guide hands off to industries; the build order is in resources.