Notifications
Clear all
Topic starter
12/07/2026 12:17 pm
TL;DR: India’s DPDP Act 2023 makes consent, purpose limitation, audit trails, SDF duties, and cross-border safeguards mandatory for organizations handling Indian citizens’ personal data, with penalties reaching 250 crores for serious violations, according to eMudhra. For identity and access teams, the practical issue is proving who accessed what, when consent changed, and whether sensitive records stayed within policy boundaries.
NHIMG editorial — based on content published by eMudhra: DPDP Act 2023 compliance, consent management, and digital trust
By the numbers:
- The DPDP Act 2023 compliance framework permits penalties up to 250 crores for serious violations, including unauthorized processing and failure to honor data principal rights.
- For multinational organizations managing DPDP Act compliance alongside GDPR, DPDP Act 2023 applies to Indian citizen data globally while GDPR fines can reach 4% of global revenue.
Questions worth separating out
Q: How should organisations make DPDP consent records auditable?
A: They should bind each consent event to a verified identity, a clear purpose statement, and a tamper-evident timestamp.
Q: Why does DPDP compliance matter for IAM teams?
A: Because lawful processing depends on controlling who can access personal data, who can approve processing changes, and who can alter audit evidence.
Q: What breaks when data localisation is not mapped to access paths?
A: Residency policy can be violated even when storage appears compliant, because replicas, backups, processors, and support access may still move data across borders.
Practitioner guidance
- Map consent records to identity controls Link every consent event to a verifiable data principal identity, purpose statement, and processing timestamp so the record can survive audit and dispute.
- Restrict access to consent and rights systems Limit who can modify, approve, or export consent logs and data principal request records, and require privileged access review for those paths.
- Build residency-aware access maps Track which identities can access Indian personal data, where replicas and backups exist, and which transfer mechanisms cross jurisdictional boundaries.
What's in the full article
eMudhra's full article covers the operational detail this post intentionally leaves for the source:
- How eMudhra positions emCA, emSigner, and SecurePass within a DPDP compliance workflow
- Specific consent and audit record features described as legally defensible under the statute
- The article’s comparison points between DPDP Act 2023 and GDPR for multinational programmes
- The penalties and enforcement framing used to justify compliance prioritisation
👉 Read eMudhra’s analysis of DPDP Act 2023 compliance and identity trust controls →
DPDP Act compliance: what IAM and identity teams need to watch?
Explore further
12/07/2026 12:31 pm
DPDP compliance is now an identity governance problem as much as a privacy obligation. The article makes clear that lawful processing depends on being able to prove consent, purpose limitation, access control, and retention discipline. That moves IAM and audit teams into the core of privacy enforcement rather than leaving compliance to legal review. Practitioners should treat consent systems and access logs as control surfaces, not records after the fact.
A question worth separating out:
Q: Who is accountable when DPDP obligations fail?
A: The data fiduciary remains accountable for lawful processing, security, breach handling, and rights fulfilment, even when processors or platforms perform parts of the work. That means governance must include contracts, access controls, and evidence trails. Delegation does not remove responsibility under the statute.
👉 Read our full editorial: DPDP Act compliance raises the bar for consent and auditability
