Every duty, mapped to what discharges it
You are accountable for obligations spread across systems you do not own, on a deadline you did not set. This page sets out which part of the platform answers which section of the Act — so you can check our claims against your own obligation list.
What makes this hard
Evidence, not assertions
Most organisations can describe their posture. Far fewer can evidence it on the day they are asked. Records derived from the live system stay true; records maintained by hand are accurate the week they are written.
A deadline you do not control
The DPDP Rules, 2025 were notified in November 2025 with an eighteen-month transition. Full compliance is due on 13 May 2027, and the Data Protection Board is already operational.
Duties that span systems you do not own
Erasure, withdrawal and correction all have to reach processors and downstream systems. The obligation stays with you even where the data has moved on.
Duty-to-module map
Generated from the module pages themselves, so it cannot drift out of step with what each one claims.
| Section | Duty | Handled by |
|---|---|---|
| CERT-In | Report specified cyber incidents within six hours of awareness | |
| s.5 | Give an itemised notice, in the language the person chooses | |
| s.6(1) | Consent must be free, specific, informed and unambiguous | |
| s.6(4) | Withdrawal must be as easy as giving consent | |
| s.6(6) | Cease processing within a reasonable time of withdrawal | |
| s.7 | Legitimate uses must still be specific — model training is a purpose | |
| s.8(3) | Ensure processors operate under a valid contract | |
| s.8(4) | Keep personal data complete, accurate and consistent | |
| s.8(4) | Accuracy duties extend to data used in automated decisions | |
| s.8(5) | Apply reasonable security safeguards to prevent breach | |
| s.8(5) | Reasonable security safeguards across all processing, including AI | |
| s.8(6) | Notify the Board and each affected Data Principal of a breach | |
| s.8(7) | Erase data when the purpose is served — you must know where it is | |
| s.8(7) | Erase personal data once the purpose is no longer served | |
| s.8(9) | Publish contact details of the DPO or responsible person | |
| s.9 | Identify children's data and apply heightened obligations | |
| s.10 | Significant Data Fiduciary duties: DPO, audit, periodic DPIA | |
| s.11 | Right to access information about personal data | |
| s.12 | Right to correction, completion, updating and erasure | |
| s.13 | Right to grievance redressal | |
| s.14 | Right of nomination |
Section references are to the Digital Personal Data Protection Act, 2023 and are provided for orientation, not as legal advice. This map covers the duties our modules address; it is not an exhaustive statement of every obligation the Act imposes on you.
Find out where you actually stand
Twelve questions, about three minutes, no sign-up to see your score — across the eight areas the Board is most likely to ask about.