Looking for help? Here are our most frequently asked questions.
Everything you need to know about our offerings.
Does the Act regulate anonymous or fully anonymized data?
No. The DPDP Act governs personal data. Data that has been irreversibly anonymized and can no longer identify an individual generally falls outside its scope.
Is verbal consent sufficient under the DPDP Act?
The Act does not prescribe a specific mode of obtaining consent. However, organizations should maintain verifiable records demonstrating that valid consent was obtained.
KGS Insight: If consent cannot be demonstrated, it becomes difficult to establish compliance.
Can silence or inactivity be treated as consent?
Organizations should not assume consent merely because an individual does not object or continues to use a service.
Can organizations rely on legitimate use for marketing?
Organizations should carefully evaluate whether marketing activities fall within any legitimate use. In many cases, consent may still be the appropriate basis.
Can a startup become a Significant Data Fiduciary?
Yes. The status depends on Government notification and the applicable statutory criteria, not merely on the size or age of the organization.
What is the biggest implementation mistake organizations make while meeting obligations relating to special categories of Data Fiduciaries and children's personal data?
Organizations often confuse Section 7 (Legitimate Uses) with Section 17 (Exemptions) or apply Section 17 without proper legal assessment and documentation.
KGS Insight: Always determine the lawful basis for processing first, then assess whether a specific exemption under Section 17 applies.