Does the DPDP Act only matter for very large companies?

No. Section 3 applies regardless of company size — any processing of digital personal data within India, plus processing outside India connected to offering goods or services to people in India. The only carve-outs are personal/domestic processing by an individual and data the person made publicly available herself.

If we have a privacy policy, are we covered under the DPDP Act?

Not on its own. Section 5 requires a specific notice accompanying or preceding each consent request, with content set out in Rule 3 — an itemised description of the data, the specified purpose, and a way to withdraw consent, exercise rights, and complain to the Board. A general policy page does not satisfy that on its own.

Is consent the only real issue under the DPDP Act?

No. Section 7 lists nine “certain legitimate uses” that let processing happen without fresh consent, and obligations like security safeguards (Section 8(5)), breach notification (Section 8(6)), and grievance redressal (Section 13) apply no matter which basis you process on.

Is deletion easy if users can just close their accounts?

Not necessarily. Section 8(7)–(8) and Rule 8(2) require 48 hours’ notice before scheduled erasure actually runs, and certain large e-commerce, online gaming, and social media platforms face an extended 3-year retention window under the Third Schedule. Closing an account does not erase data instantly.

Is vendor responsibility someone else's problem under the DPDP Act?

No. Section 8(1)–(2) makes the Data Fiduciary responsible for compliance even where processing is carried out by a Data Processor on its behalf, regardless of any contrary agreement.

Comparison

Common DPDP Myths

Audience: founders, operators, product, growth · Last reviewed: March 2026

A lot of DPDP confusion comes from assumptions carried over from generic privacy discourse, incomplete summaries, or shallow compliance theater.

Common myths

“This only matters for very large companies.” Reality: Section 3 applies regardless of company size — any processing of digital personal data within India, plus processing outside India connected to offering goods or services to people in India. The only carve-outs are personal/domestic processing by an individual and data the person made publicly available herself.
“If we have a privacy policy, we are covered.” Reality: Section 5 requires a specific notice accompanying or preceding each consent request, with content set out in Rule 3 — an itemised description of the data, the specified purpose, and a way to withdraw consent, exercise rights, and complain to the Board. A general policy page does not satisfy that on its own.
“Consent is the only real issue.” Reality: Section 7 lists nine “certain legitimate uses” that let processing happen without fresh consent, and obligations like security safeguards (Section 8(5)), breach notification (Section 8(6)), and grievance redressal (Section 13) apply no matter which basis you process on.
“Deletion is easy if users can close accounts.” Reality: Section 8(7)–(8) and Rule 8(2) require 48 hours’ notice before scheduled erasure actually runs, and certain large e-commerce, online gaming, and social media platforms face an extended 3-year retention window under the Third Schedule. Closing an account does not erase data instantly.
“Vendor responsibility is someone else’s problem.” Reality: Section 8(1)–(2) makes the Data Fiduciary responsible for compliance even where processing is carried out by a Data Processor on its behalf, regardless of any contrary agreement.

Why myths are costly

They cause teams to underinvest in mapping, retention, rights workflows, notices, and practical ownership. That creates both trust risk and operational pain later.

Common DPDP Myths

Common myths

Why myths are costly

Read next