Short answers to the questions we hear most. Each links to a deeper guide.
Frequently asked questions
Is DPDP compliance mandatory?+
Yes, for Data Fiduciaries within the Act's scope, as provisions commence in phases.
What is the maximum penalty?+
The Schedule to the Act lists maximum penalties per category of breach; the highest tier relates to failure to maintain reasonable security safeguards. See the Act for amounts.
Do I need a Data Protection Officer?+
A DPO based in India is required for Significant Data Fiduciaries. Others should still name an accountable contact.
Can I rely on 'legitimate interests'?+
No. The Act has a closed list of 'legitimate uses', not a general legitimate-interests basis.
What happens if there is a breach?+
Intimate the Board and affected individuals as prescribed. Have a breach plan and an authorised approver ready.
Can a compliance platform certify me?+
No. No tool or consultant can issue a government-recognised DPDP certificate. OmniCompliq produces a Readiness Score, which is not a certificate.
Does erasure always have to happen on request?+
Erasure is subject to legal retention and other exceptions, after identity verification.
Is OmniCompliq a Consent Manager?+
No. A Consent Manager is a separately registered statutory entity. Our software helps your organisation record consent for its own processing.
- Section 5Rule 3 · pending verificationPrivacy notice at or before collection
- Section 6(1)-(3)Valid consent for processing
- Section 8(6)Rule 7 · pending verificationPersonal data breach intimation
See where your business stands.
Run a free evidence-based website scan or talk to a compliance specialist about implementation.