All Sectors Overview

Lawful Basis for Processing

Every personal data processing activity must have a lawful basis — consent, contract performance, legal obligation, or vital interest. Consent is the most common basis and must be freely given, specific, informed, and unambiguous.

Notice and Transparency

Data Fiduciaries must provide clear notices to Data Principals before collecting their data. Notices must be in plain language, available in the relevant scheduled language, and must specify the purpose, categories of data, and third parties with whom data will be shared.

Purpose Limitation

Personal data collected for one purpose cannot be used for a different purpose without fresh consent. This applies across all sectors — health data collected for treatment cannot be used for marketing; employee data collected for payroll cannot be used for performance profiling without consent.

Data Minimisation

Collect only the personal data that is strictly necessary for the stated purpose. Avoid collecting ancillary data on the assumption it might be useful later.

Data Principal Rights

Every individual whose data is processed has the right to access their data, correct inaccuracies, withdraw consent, and request erasure. Organisations must have a mechanism to handle these requests within the timeframe set by the DPDP Rules.

Security Safeguards

Data Fiduciaries must implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction.

Breach Notification

Any personal data breach that is likely to cause harm to Data Principals must be reported to the Data Protection Board and affected individuals without undue delay.

Data Retention and Deletion

Personal data must not be retained longer than necessary for the purpose for which it was collected. Organisations must implement automated deletion schedules and conduct periodic data audits.