DPDP related usual business questions

Do employee records come under DPDP, or is it only customer data?

Employee data counts. DPDP is not limited to customer information. Employee, contractor, applicant, student, patient, supplier and other individual-related information may fall within its scope depending on the circumstances. For many organisations the largest and oldest collection of personal data is in HR and payroll, not in the customer database.

We handle data on behalf of our clients. Are we a Data Fiduciary or a Data Processor?

It depends on who decides. The organisation that determines why and how personal data is processed is the Data Fiduciary. An organisation that processes data on another's behalf, under contract and without deciding the purpose, is a Data Processor. Many firms are both at once: a Processor for client data, and a Fiduciary for their own employees, vendors and prospects. The obligations differ, so the distinction is worth establishing early rather than assuming.

We already have a privacy policy. Does that mean we are compliant?

Not necessarily. A privacy policy is one part of the picture. You also need to know what personal data you actually hold, how it is used, who it is shared with, how it is protected, how long it is retained, and how you respond when an individual exercises their rights. A policy describes intent; the rest is whether practice matches it.

Do I need consent for every piece of personal data we use?

No. Consent is one basis for processing personal data, and the framework also provides for certain specified legitimate uses where consent is not required. The more useful question is not "do we have consent?" but "why are we processing this, and what allows us to do so?"

Our data sits with cloud providers and software vendors. Is that still our responsibility?

Yes. Engaging another organisation to process personal data does not transfer the responsibility away from you. You need to know what information your vendors hold, why they hold it, what arrangements govern its use, and how it is protected. The practical difficulty is usually that nobody has ever written the list down.

Does keeping data in the cloud mean it has left India?

Not necessarily. Cloud storage and cross-border transfer are related questions but not the same one. What matters is where the data is actually stored or processed, and whether it is transferred or made available outside India. Other laws or sector-specific requirements may also apply. This is answerable: ask each provider, in writing, which region your data resides in. Most can tell you within a day, and the answer belongs in your records.

Do we have to delete all personal data we no longer use?

Not all of it, but not none of it either. Data should not simply be kept forever by default. You need to understand why data is being retained, how long it needs to be kept, and when it should be removed. Some information must be retained because of legal or other applicable requirements, which is a reason to keep it deliberately rather than a reason to keep everything.

What happens if someone asks us to show them their personal data?

You need a way to receive, verify and answer the request. That sounds straightforward until the person's information is spread across a CRM, an HR application, a shared drive, several inboxes and two external providers. The request is rarely the hard part. Knowing where everything is, is the hard part.

What happens if a customer's data is accidentally exposed?

A defined response has to begin. You need to establish what happened, what information was affected, who may be affected, and what notifications and remedial steps are required. Waiting until an incident happens to decide who does what is a poor strategy, and it is the point at which the absence of a data inventory becomes expensive.

Does a small business really need a dedicated privacy team?

Not necessarily. The size and structure of the organisation determine what arrangements are appropriate. What matters is that somebody is responsible for understanding how personal data is processed, for managing the required processes, and for making sure responsibilities do not fall between the cracks. In a smaller firm that is usually a named person with a clear remit, not a department.

Do we need to buy a DPDP software platform to become compliant?

No. Technology helps with discovery, classification, consent, rights requests, monitoring and evidence, and at a certain scale it becomes difficult to manage without it. But compliance does not begin with software. It begins with understanding your data, your purposes, your processes and the controls you already have. Buying a tool before that is understood usually produces an expensive record of the wrong things.

What does this cost, and how long does it take?

It depends on the size of the estate, and it is knowable in advance. The variables are the number of systems holding personal data, the number of departments involved, how many external providers are in the picture, and how much documentation already exists. A gap assessment is scoped after a short conversation about those four things, so you get a defined piece of work with a defined end rather than an open commitment. Remediation is scoped separately, once the assessment has shown what actually needs doing.

What happens if we do nothing?

The obligations apply whether or not you have prepared for them. The Data Protection Board can investigate breaches and complaints and impose penalties where applicable. But the more common cost arrives earlier and more quietly: a client's procurement questionnaire you cannot answer, a customer asking for their data when you have no way to find it, or an incident where the first hour is spent working out what was even held. Preparation is considerably cheaper than discovery under pressure.

Is DPDP compliance something we can finish once and forget about?

No. Systems change, vendors change, new services are introduced, data moves into new applications and business processes are redesigned. Compliance has to be maintained as the organisation changes rather than treated as a project with a completion date.