# FOCTTA: the full website as Markdown > Every public page of https://foctta.com, built 2026-10-14. The short index is https://foctta.com/llms.txt. ======== # FOCTTA - DPDP consent, data security and privacy compliance, made in India > FOCTTA runs consent, rights, breach response, data discovery, activity monitoring, detection and vendor risk for the DPDP Act 2023, with GDPR and CCPA. Hosted in India, or on your own server. Web page: https://foctta.com/ This Markdown copy has the same content as the web page. Built 2026-10-14. --- MADE IN INDIA DPDP · GDPR · CCPA # Show the Data Protection Board what you did, and when. Consent, data discovery, database monitoring and vendor risk for regulated Indian enterprises, from banks and insurers to NBFCs. Built for the DPDP Act, hosted in India or on your own server. [Book a demo](https://foctta.com/company) See it working - Hosted on AWS in Mumbai, or in your own cloud - Signed releases with an SBOM - Hash-chained audit trail - Notices in 23 languagesConsent सहमति সম্মতি ஒப்புதல் సమ్మతి संमती ಸಮ್ಮತಿ സമ്മതം સંમતિ ਸਹਿਮਤੀ ସମ୍ମତି رضامندی **Consent receipt** c09d…31b7 · notice v4 **Access request** Day 62 of 90 **Breach** CERT-In report due in 5h 12m Pause motion **New to DPDP?** India's data protection law in two minutes: who it covers, the key dates, the penalties. [Read the basics](https://foctta.com/dpdp-basics) [Free 12-lesson course, with a certificate to share](https://foctta.com/learn) [Glossary of terms](https://foctta.com/glossary) ## Start with the product your next audit will ask about. Consent, Discovery (DSPM), Activity (DAM), Detection (DDR) and TPRM are sold separately. Each works alone. FOCTTA Consent Privacy and consent governance Every consent a receipt. Every right on the clock. See how it works (https://foctta.com/consent) FOCTTA Discovery DSPM Data security posture management Find personal data wherever it hides. See how it works (https://foctta.com/discovery) FOCTTA Activity DAM Database activity monitoring Know who touched it, and if that was normal. See how it works (https://foctta.com/activity) FOCTTA Detection DDR Data detection and response A decision on every query, before it runs. See how it works (https://foctta.com/detection) FOCTTA TPRM Third-party risk management Every vendor scored, and every score explains itself. See how it works (https://foctta.com/tprm) [Training Academy](https://foctta.com/training) Phone and watch apps [DPDP readiness check](https://foctta.com/readiness) [Free gap assessment](https://foctta.com/company) Discovery (DSPM) finds the data. Activity (DAM) shows who reads it. Detection (DDR) decides who may. ### Connects to the systems you already run. Ready-made connectors, so the first integration is setup, not a project. 118 FOCTTA Consent Connector templates for CRM, email, marketing and ad platforms. Explore Consent (https://foctta.com/consent) 25+ FOCTTA Discovery (DSPM) Native scanners for databases, warehouses, cloud storage and SaaS. Explore Discovery (https://foctta.com/discovery) 7 FOCTTA Activity (DAM) Activity sources: PostgreSQL, SQL Server, Oracle, Snowflake, BigQuery, AWS CloudTrail and a SQL proxy. Explore Activity (https://foctta.com/activity) 3 FOCTTA Detection (DDR) Alert destinations: Splunk, Microsoft Sentinel and any webhook. Guards PostgreSQL queries inline. Explore Detection (https://foctta.com/detection) 34 FOCTTA TPRM Integrations for the tools your vendor reviews already use. Explore TPRM (https://foctta.com/tprm) Legacy systems too. Discovery (DSPM) reads IBM i (AS/400) Db2 databases and COBOL copybook mainframe extracts, alongside the modern stack. See Discovery (https://foctta.com/discovery) See it working ## One console. Every role. Consent Rights Discovery Vendors Training Pause app.foctta.com/consents Illustrative data FOCTTA Overview Consents Notices Rights Breach Assessments Discovery Vendors Training Reports Consent ledger Retail business unit · all purposes Export proof Active consents 1,24,806 Receipts today 8,430 Withdrawn this month 1,212 Languages served 14 Data principal Purpose Status Notice Language Receipt p\_8a3f…c7d2 Offers and updates Withdrawn v4 हिन्दी c09d…31b7 p\_41b0…9e12 Improve the service Granted v4 தமிழ் a7b3…f2e1 p\_7c22…04aa Credit bureau sharing Granted v4 English 4f1e…88c0 p\_19de…b3f5 Offers and updates Declined v4 বাংলা 9c1d…2a7e p\_0e7a…6d19 Location for fraud checks Expiring v3 मराठी 5b92…e0d4 p\_c3f8…1a60 Guardian consent (minor) Granted v4 ಕನ್ನಡ e81c…7f33 **Access request** RQ-2419 · s.11 Rights portal DPDP · 90 days **Day 62** Identity verified **Correction** RQ-2433 · s.12 Email DPDP · 90 days **Day 71** Re-KYC routing **Erasure** RQ-2440 · s.12 Rights portal DPDP · 90 days **Day 12** Awaiting approval **Grievance** GR-0318 · s.13 Complaint form DPDP · 90 days **Day 83** Escalated to DPO **Nomination** RQ-2451 · s.14 Rights portal DPDP · 90 days **Day 5** Both parties confirmed **GDPR access** RQ-2455 · Art. 15 Email GDPR · 30 days **Day 18** In progress Where What Records Consent coverage crm.customers Aadhaar numbers 48,210 **92%** s3://kyc-archive PAN card scans 12,604 **71%** \\\\fs01\\hr\\ Salary slips 3,118 **100%** crm.students Dates of birthChild 9,402 **38%** laptop · FIN-114 Bank statements 216 **0%** sharepoint · Sales Phone numbers 22,870 **84%** Scanning 42 data stores Only masked metadata leaves your network. Vendor Tier Band DPA Next review **Cloud payments processor** Tier 1 B Active 14 Oct 2026 **KYC verification provider** Tier 1 A Active 02 Dec 2026 **SMS and WhatsApp gateway** Tier 2 B Expires in 30 days 23 Oct 2026 **Call centre partner** Tier 1 C Missing Overdue **Analytics SaaS** Tier 3 A Active 11 Jan 2027 **Document storage** Tier 2 A Active 30 Nov 2026 Why band B 1 Processes customer personal data DPDP s.8(2) 2 Stores data outside India RBI Outsourcing 2025 3 Encryption evidence verified ISO 27001 A.8.24 Same inputs, same band. Second approver required. **86%** completed Overdue learners get a reminder automatically. **DPDPA fundamentals** 94% **Children's data, Section 9** 88% **Breach response, Rule 7** 81% **Handling rights requests** 77% **Consent done right** 64% Certificate issued **Ananya Rao** Children's data, Section 9 · 92% Signed by your DPO Add to LinkedIn Verify Withdrawal applied on every server Receipt issued · notice v4 [Explore Consent](https://foctta.com/consent) Why FOCTTA ## 36 details an Indian auditor will ask about, already built. DPDP Act Consent Data security Evidence Enterprise India Screens, clocks and citations follow the Act and the Rules, including the duties most tools leave to a spreadsheet. Complete privacy notices A notice can't publish without your name and complaint route. DPDP S.5 **FOCTTA Consent**A DPDP notice cannot publish without the fiduciary name and the route to complain to the Data Protection Board. Auto-erase dormant accounts Find inactive users, warn them 48 hours ahead, then erase. Third Schedule **FOCTTA Consent**Dormant users found for e-commerce, social media and gaming, a 48-hour notice by WhatsApp, SMS or email, then erasure. Duties for large data holders Yearly DPIA, audit and board sign-off in one tracked flow. SDF · Rule 13 **FOCTTA Consent**Annual DPIA with the Rule 13(3) algorithmic step, auditor attestation, board sign-off and the Rule 13(2) bundle. Safe nominee requests One-time codes for both people and a hold stop fake claims. DPDP S.14 **FOCTTA Consent**One-time codes for both parties, a cooling-off hold, and a waiver only by two different approvers. "What data do you hold?" One secure download, Aadhaar and PAN masked, legal holds respected. DPDP S.11 **FOCTTA Consent**No-tipping-off holds, Aadhaar and PAN masking, and a ZIP with a manifest, checksums and a certificate. Every breach deadline, one screen CERT-In, RBI, SEBI and IRDAI clocks tracked side by side. 6 h · 72 h **FOCTTA Consent**CERT-In, RBI and SEBI within 6 hours of detection, with IRDAI copied and a SEBI portal report at 24 hours. From May 2027, DPDP adds the Board and affected people told without delay, and a detailed Board report within 72 hours. Consent that a regulator can check, for every brand in the group, in every language your customers read. Proof of a "no" too A declined purpose gets its own record and receipt. **FOCTTA Consent**A declined purpose is its own record, with its own receipt, so you can prove a no as well as a yes. No lost consent clicks Choices retry offline for up to 7 days, and never duplicate. **FOCTTA Consent**Choices retry and queue offline for up to 7 days, and duplicates never create a second record. 23 Indian languages Banners and preference centres in English and all 22 scheduled languages. **FOCTTA Consent**Banners and preference centres in 23 languages, detected from the page. One tag for every brand Each group company keeps its own consents; withdrawals don't cross over. **FOCTTA Consent**The brand is recognised from the page domain, and a withdrawal never crosses to another company unless the person asks. Old consents keep their dates Migrated records keep original dates; external feeds sync every 5 minutes. New in 2.1 **FOCTTA Consent**Migrated consents keep their original date and import batch, and external consent feeds arrive every 5 minutes. Vendors confirm erasure easily Each processor confirms deletion through a secure link, no account. **FOCTTA Consent**Each processor confirms erasure through a secure link. No account, no chasing by email. Find, watch and guard sensitive data without handing over passwords or slowing production down. Scan without sharing passwords Upload a schema, or run scanners that keep credentials on your servers. **FOCTTA Discovery (DSPM)**Upload a schema and FOCTTA classifies from structure. When scanners connect, credentials stay on your host. Reads PDFs and scans PDF, Word and Excel, scan errors fixed, unreadable files reported. **FOCTTA Discovery (DSPM)**PDF, Word and Excel files, common OCR misreads repaired, and a report of every file it could not read. Finds forgotten data stores Cloud accounts, asset lists and network sweeps, merged into one inventory. **FOCTTA Discovery (DSPM)**Cloud accounts, CMDB, directory, DNS sweeps and Kubernetes, merged into one inventory with owners. Look back to any date Snapshots show your data risk on any past date, for audits. **FOCTTA Discovery (DSPM)**Snapshots of the whole posture, and a diff between any two dates, for the audit you did not see coming. Sensitive fields masked live Queries are rewritten so the database returns masked values. PostgreSQL **FOCTTA Detection (DDR)**The gateway rewrites the query so the database returns masked values, and blocks a query it cannot mask safely. Spots misused app accounts Learns each application's normal queries, so misuse stands out. **FOCTTA Activity (DAM)**Each application's normal query pattern is learned, so a misused service account stands out. Proof you can hand to an auditor, from a product that never shows green while doing nothing. A receipt for every change A tamper-evident audit trail, and one-click proof of any consent. **FOCTTA Consent**A hash-chained audit trail, and one-click proof of every consent a person gave. Audit-ready evidence packs Signed packs for DPDP, SEBI CSCRF, GDPR and CCPA audits. Pilot **FOCTTA Discovery (DSPM)**DPDPA, SEBI CSCRF, GDPR and CCPA packs with a signed manifest. What FOCTTA stores, listed Every table and column FOCTTA keeps is documented, exportable as PDF. New in 2.1 **FOCTTA Consent**Every table and column FOCTTA keeps is described, and exportable as a PDF. No false "zero affected" Unknown impact reads "not yet established" in regulator drafts, never 0. **FOCTTA Detection (DDR)**An unknown number of affected people reads "not yet established" in a regulator draft, never 0. One ID, block to ticket The same ID links the blocked query, audit trail and ticket. **FOCTTA Detection (DDR)**The same ID in the blocked query, the decision, the audit chain and the ticket, with a "why was I blocked?" page. Certificates anyone can verify DPO-signed training certificates, with a public verification page. **Training Academy**Training certificates signed by your DPO, with a public verification page and Open Badges 3.0 data. Separation of duties, second approvers and explanations, because a bank will ask for all three. Two approvers for risky steps Destructive response steps need two different people, enforced on the server. **FOCTTA Detection (DDR)**Destructive playbook steps need two different approvers, enforced on the server. Controlled emergency access Needs a written reason, a time limit and two approvers. **FOCTTA Detection (DDR)**Emergency access needs a written reason, a 15 to 240 minute limit and two approvers, and ends with a summary. Vendor scores with reasons Each risk band cites the rule behind it; same inputs, same band. **FOCTTA TPRM**Every band cites the rule and clause behind it. Same inputs, same band, and a second approver on each step. No-login vendor questionnaires Vendors answer through a secure link: no licence, no password. **FOCTTA TPRM**Vendors answer through a portal link. No licence, no password, no friction. Directory health check 19 read-only checks on your Active Directory, scored 0 to 100. **FOCTTA Consent**19 read-only checks on your directory, scored from 0 to 100. Roles that split duties 8 roles and 144 permissions, custom roles, single sign-on and MFA. **FOCTTA Consent**8 roles and 144 permissions, custom roles, SSO, SCIM and MFA. Designed, built and hosted in India, and able to run inside your own walls. Hosted in India A dedicated database for each organisation by default. **Deployment**A dedicated database per organisation by default. Your own PostgreSQL FOCTTA runs on your database and never hosts your data. **Deployment**FOCTTA connects to and migrates your database. It never hosts your data. On your own server Linux or Windows Server, signed releases, nothing sent to FOCTTA. **Deployment**Linux or Windows Server, signed releases, an SBOM, and nothing sent to FOCTTA by default. Buy one product, or all Five products that work alone, and better together. **Product line**Consent, Discovery (DSPM), Activity (DAM), Detection (DDR) and TPRM work alone, and better together. DPO phone and watch app Android and Wear OS apps that work offline too. Pilot **Android and Wear OS**An Android app and a Wear OS tile and watch-face complication, with an offline queue. Accessible banners by default Brand colours that fail contrast rules are held for review. **FOCTTA Consent**Brand colours that fail WCAG AA are held until someone acknowledges them, citing RPwD s.46. Free · 12 questions · 3 minutes ## How ready are you for May 2027? [Take the check](https://foctta.com/readiness) [Book a demo](https://foctta.com/company) Question 3 of 12 · S.6(4) **Is withdrawing as easy as giving consent?** Yes Partly Not yet ## Built in India, for Indian law, in English and all 22 scheduled languages. India Hosted in India The hosted service runs on servers in India. 23 Languages English and all 22 scheduled Indian languages. DPDP Built on the Act Screens and clocks follow the Act, section by section. GDPR · CCPA Ready abroad Notices and request clocks for Europe and California too. ## Three laws. Six sector overlays. IN DPDP Act 2023 and Rules 2025 Up to ₹250 crore What FOCTTA covers IN · WHAT FOCTTA COVERS Notices with the Board complaint route Rights under Sections 11 to 14 Children's data, Section 9 SDF duties under Rule 13 EU GDPR Up to €20 million or 4% What FOCTTA covers EU · WHAT FOCTTA COVERS Geo-aware notices for EU visitors 30-day request clock, 60-day extension Article 28 DPA clause checklist Breach clock of 72 hours US CCPA and CPRA Per-violation fines What FOCTTA covers US · WHAT FOCTTA COVERS Geo-aware notices for US visitors CCPA DPA clauses for service providers 45-day clocks on requests your team logs Switched on when you need it **RBI** 6h incident clock, DAKSH **SEBI** CSCRF 6h notice, 24h portal **IRDAI** 6h copy, record retention **CERT-In** 6h reporting **PMLA** 5-year hold, no tipping off **RPwD** WCAG AA contrast check The life of one consent ## Every tap on the banner becomes a receipt, chained to the one before. Notice in their language Versioned, with the Board complaint route. DPDP S.5 A choice becomes a receipt Refusals are recorded too. DPDP S.6 Systems ask before use Every system checks consent before using data. DPDP S.4 They withdraw consent Applied on every server at once. DPDP S.6(4) Their data is locked Masked or blocked, with FOCTTA Detection (DDR). DPDP S.6(6) Erased, or kept by law Each erasure decided by rule, with a certificate. DPDP S.8(7) Proof in one click A tamper-evident trail and a receipt for each choice. DPDP S.6(10) 23 Languages 181 Industry packs 58 Assessment templates 346 Webhook events 6 Training courses ## Hosted in India, or on your own server. [Deployment](https://foctta.com/deployment) FOCTTA cloud, in India On AWS in Mumbai, dedicated database by default. Shared and isolated One shared database, each organisation walled off. Fastest start. Your own PostgreSQL We connect to it. We never host your data. Your server or cloud On-premise, or your AWS, Azure or Google Cloud account. Android and Wear OS Pilot · not on an app store yet ## The DPO's day, on your wrist. Report a breach Breach intake on the phone, with every regulator clock. Sign off assessments Review and approve DPIAs away from your desk. Rights and grievances Every queue with its clock. Alerts that reach you Push notifications, mirrored to the watch. Compliance on your watch Score, breaches, rights and DPIAs at a glance. Acknowledge from the wrist Escalations acknowledged even offline, synced later. **9:41** **FOCTTA** Retail · DPO **82** **Compliance health** 3 items need you today **Breach · CERT-In** 4h 51m left Card data exposed in a test bucket **Grievance GR-0318** Day 83 of 90 **DPIA · loan app v2** awaits your sign-off Approve Review **Erasure RQ-2440** In progress **Notice v5 · 3 languages** Published Today Breach Rights Alerts Compliance **82** 1 breach · 4h 51m Acknowledge Pinned connection · device integrity checked May 2027 ## Most DPDP duties apply from May 2027. Find out which reach you first. The DPDP Rules were notified in November 2025; most duties apply 18 months later. [Book a demo](https://foctta.com/company) [Talk to us](https://foctta.com/company) ======== # FOCTTA Consent - DPDP consent management, rights requests and breach response > Consent and cookie banners in 23 languages, rights requests with statutory clocks, breach timelines, DPIAs, ROPA and a hash-chained audit trail, built for the DPDP Act and Rules 2025. Web page: https://foctta.com/consent This Markdown copy has the same content as the web page. Built 2026-10-14. --- FOCTTA CONSENT DPDP Act 2023 and Rules 2025, section by section # Consent you can prove. Withdrawal you can enforce. FOCTTA Consent is consent management software for India's DPDP Act : it collects and proves consent, handles data rights requests and tracks breach deadlines. In English and all 22 scheduled languages, and ready for GDPR and CCPA. [Book a demo](https://foctta.com/company) Follow one consent, step by step **Made in India, for India** Hosted in India Consent, in every scheduled language Consent सहमति সম্মতি ஒப்புதல் సమ్మతి संमती ಸಮ್ಮತಿ സമ്മതം સંમતિ ਸਹਿਮਤੀ ସମ୍ମତି رضامندی Consent receipt issued hash-chained · tamper-evident Purpose withdrawn. Query blocked. At the database, with FOCTTA Detection (DDR) Data access request S.11 · day 62 of 90, on track Languages English plus 22 Indian languages Industry packs 1,229 ready-made purposes Assessment templates Ready-made privacy risk assessments DPIA · PIA · TIA System event types Signed updates to your other systems Webhooks Regulator clocks Breach reporting deadlines, tracked together CERT-In · RBI · SEBI · IRDAI · Board The life of one consent ## From a tap on a banner to a receipt you can show the Board. 01A notice in their language 02A choice becomes a receipt 03Systems ask before they use data 04They change their mind 05Checked at the database 06Erased, or lawfully kept 07Proof you can show the Board Notice S.5 · Rule 3 The banner speaks their language and names who to complain to. Language Tamil · தமிழ் Notice version v4 · published Complaint route Data Protection Board A DPDPA notice cannot be published without the fiduciary name and the Board complaint route. Consent S.6 · S.6(10) Every choice, including a refusal, is its own record with a receipt. Offers and updates declined · receipt Improve the service granted · receipt Receipt a7b3…f2e1 · notice v4 Clicks retry and queue offline for up to 7 days, and duplicates never create a second record. Consent check S.4 Any system can ask "may I?" and get the current answer. crm.campaigns purpose: marketing → no app.analytics purpose: service → yes Change feed webhook delivered · signed 346 signed event types reach your systems, with a delivery log. Withdrawal S.6(4) · S.6(6) Withdrawal is as easy as giving, and it lands everywhere at once. Cached "yes" answers retired on every server Downstream systems withdrawal event sent Live database sessions ended Ending live database sessions needs FOCTTA Detection (DDR) in the data path. With FOCTTA Detection (DDR) Enforcement S.6(6) · S.8(7) A query for a purpose without consent is masked or blocked, with a reason. SELECT name, pan … masked · purpose not consented SELECT \* FROM kyc … blocked · BLK-7F2C SELECT plan, city … allowed Allow, mask a column or block, through the FOCTTA Detection (DDR) gateway on PostgreSQL. With FOCTTA Detection (DDR) Erasure S.12 · S.8(7) A legal decision tree erases what it should and keeps what the law requires. Marketing CRM erased · flagged Loan ledger retained · tax law citation Processor confirmed by link Flag-and-suppress by default, hard delete only if you opt in, with a certificate anyone can verify. Evidence S.6(10) Prove what this person agreed to, and when, in one click. Audit chain verified · unbroken Consent history 3 receipts · notice v3 → v4 Evidence pack DPDPA · signed manifest Hash-chained audit events, receipts on every consent, and a verification page for certificates. **Built on the Act, not adapted to it** Every screen, clock and citation is organised the way the DPDP Act 2023 and the 2025 Rules are written. ## Pick a section. See what FOCTTA does for it. Each section of the DPDP Act sets a duty. Pick one to see what the law asks and how FOCTTA helps. Notice S.5 Consent S.6 Legitimate uses S.7 Processors S.8(2) Breach S.8(6) Erasure S.8(7) Inactivity S.8(8) Children S.9 Extra duties S.10 Access S.11 Correction S.12 Grievance S.13 Nomination S.14 Cross-border S.16 Rights portal R.14 The Board S.27 S.5 · Notice **The Act asks:** An itemised notice before or with the consent request, with how to withdraw and complain. Versioned notices that cannot publish without the complaint route. Every consent stamped with the notice in force Served by country, language and brand Re-consent when the notice changes S.6 · Consent **The Act asks:** Free, specific, informed and unambiguous consent, and withdrawal as easy as giving it. A consent ledger that proves yes, proves no, and enforces withdrawal. One record per person, purpose and business unit Refusals recorded as evidence Withdrawal applied on every server at once S.7 · Legitimate uses **The Act asks:** Processing without consent only for the uses the Act lists. The lawful basis is on every record, and the DPIA reads it. Deemed consent and legitimate uses recorded as the basis Assessments conclude from the recorded basis, never a guess S.8(2) · Processors **The Act asks:** Processors engaged only under a valid contract. Sharing consent is refused without an active processing contract (DPA). Processor register with DPA status and expiry Alerts at 180, 90, 60, 30, 14 and 0 days DPA clause checklist for DPDPA, GDPR and CCPA S.8(6) · Personal data breach **The Act asks:** Inform the Board and each affected person of a breach. Parallel regulator clocks from the moment you know. CERT-In, RBI, SEBI 6h; IRDAI copy; Board from May 2027 Blast radius matched to your data map Board breach report and a drafted action plan S.8(7) · Erasure **The Act asks:** Erase when consent is withdrawn or the purpose is served, unless law requires retention. A legal decision tree for every system, with a certificate. Retention reasons from a catalogue of 11 laws Legal hold respected Processors confirm erasure by secure link S.8(8) · Erasing inactive accounts (Third Schedule) **The Act asks:** Erase after the prescribed inactivity, with a 48-hour notice first. The 48-hour notice by WhatsApp, SMS or email, then erasure. Dormant users found for the Third Schedule classes Legal hold respected Switched on per organisation S.9 · Children's data **The Act asks:** Verifiable guardian consent, and no tracking or targeted ads at children. Tracking blocked for children, even when they tap Accept All. Child-directed mode and an under-18 choice in the banner Guardian details required and encrypted Children's data makes a DPIA mandatory S.10 · Significant Data Fiduciary **The Act asks:** A DPO in India, independent audit, periodic DPIA and algorithmic due diligence. The extra duties of a Significant Data Fiduciary, as one governed chain. Annual DPIA with the Rule 13(3) algorithmic step Independent auditor attestation and board sign-off Rule 13(2) submission bundle S.11 · Right to access **The Act asks:** A summary of the data, the processing and who it was shared with. An access package with India-aware redaction. No tipping off, Aadhaar and PAN masking ZIP with manifest, checksums and certificate Opened behind a one-time code S.12 · Correction and erasure **The Act asks:** Correct, complete, update or erase on request. Correction fanned out to every system, with rollback. Re-KYC routing for hard fields Correction certificate Credit-information compensation accrual S.13 · Grievance redressal **The Act asks:** An effective grievance mechanism within the prescribed period. A 12-state workflow on the 90-day clock. Public complaint form with 13 categories Warnings at 50, 75 and 90 percent Board escalation packet after redressal is exhausted S.14 · Right to nominate **The Act asks:** Let a person nominate someone to act for them. Nomination with two-party confirmation and a cooling-off hold. One-time codes for both parties A waiver only by two different approvers DPO approval S.16 · Cross-border transfer **The Act asks:** Transfers restricted only to countries the government notifies. Transfer country and safeguards on every vendor. Per-vendor transfer records A cross-border register in the evidence pack, with Discovery (DSPM) R.14 · Publishing how to exercise rights **The Act asks:** Publish how to exercise rights and which identifiers are needed. A rights portal builder per business unit. Identifier sets under Rule 14(5) Identity-check floors that rise for BFSI and children English and Hindi portal text today S.27 · Complaints to the Board **The Act asks:** A person may complain to the Data Protection Board. The Board complaint link on every banner and notice. Tamper-evident escalation packet The person records their Board filing reference 16 capability areas ## Notices, consents, rights requests, breaches and DPIAs in one console. Pick an area to see what FOCTTA Consent does in it. An orange tag marks a stated limit. Consent records Cookie banner Privacy notices Group companies Importing consents People's data rights Erasing dormant accounts Children's data Breach response Risk assessments Data map and register Vendors and contracts Audit and evidence Workflows and alerts Sign-in and access Reports and branding S.4 · S.6 · S.6(10) Prove exactly what each person agreed to, and that they said no when they did. **One record per purpose**: Each purpose a person agrees to is recorded separately. Per person, purpose, regulation and business unit, with lawful basis and notice version. **Refusals as evidence** A "no" gets its own record and receipt too. **Expiry and renewal**: Consents expire after 12 months by default, with reminders. Alerts at 30, 7 and 2 days. **Withdrawal everywhere** A withdrawal retires saved "yes" answers on every server at once. **38 consent templates**: Ready-made consent forms for 21 industries, plus a generic set. Including a minor-and-guardian template. **Consent by email link** Collect consent from people who never visit your website. Add-on S.5(3) · S.6 A compliant banner in every Indian language whose choices become provable consent. **23 languages** English and all 22 scheduled languages, picked from the page. **Google Consent Mode v2**: Google tools start as "denied" until the visitor chooses. Default-denied state and updates, with region defaults. **No lost choices** Choices retry and wait offline for up to 7 days. **Banner Builder**: Design the banner with live desktop, tablet and phone previews. Publish and archive versions. **Cookie scanner**: Find the cookies your website sets, quickly or in depth. Instant check plus a deep crawl in a real browser. **Child-directed mode**: Blocks tracking for children, even after Accept All. With a Section 9 notice. S.5 · Rule 3 The right notice, in the right language, for the right brand, every version kept. **Versioned notices**: Every edit is saved as a new version, never overwritten. Each version is immutable and carries a change summary. **Complete notices only** Won't publish without your organisation's name and the Board complaint route. DPDP S.5 **Served by country and brand**: Each visitor sees the right law's notice and the right brand. India to DPDPA, EU to GDPR, US to CCPA, brand from the domain. **Re-consent campaigns**: Ask people to renew consent when the notice changes. Move consents under an older notice to renewal in one click. **Embeddable consent form** Turn any web form into a DPDP notice with a purposes table. English text Business units Run a whole group on one platform. Each company keeps its own consents. **One tag, many brands** One website snippet recognises each brand from its domain. **Settings per company** Keys and system connections are bound to one company. API keys · webhooks New in 2.1 **Withdrawals never cross** A withdrawal moves to another company only by the person's audited choice. New in 2.1 **Roles per company** Members and permissions set per company, checked on the server. Day one history Bring years of consents across with their true dates and withdrawals intact. **Bulk import with dry run** Import past consents after a test run; each row gets a receipt. Enterprise and BFSI **Migrated consents say so** Imported consents keep their original date and import batch. New in 2.1 **External consent feeds New in 2.1**: Consents from your other systems arrive every 5 minutes. For example from an eKYC platform. S.11 · S.12 · S.13 · S.14 Every right in the Act with its own queue, clock, identity check and evidence. **A copy of their data S.11**: Give people a secure copy of what you hold on them. India-aware redaction, a ZIP with manifest and certificate. **Corrections S.12**: Correct a person's data in every system, with rollback. Re-KYC routing for hard fields. **Erasure requests S.12**: Erase what should go, and keep what the law requires. A legal decision tree decides for each system. **Complaints S.13**: Handle complaints within the 90-day clock the Rules allow. 13 categories and a 12-state workflow. **Nominees S.14**: Let a person name someone to act for them, safely. Two-party confirmation and a cooling-off hold. **Rights portal English and Hindi**: A page on your website where people make requests. Embeddable, with a builder per business unit. Third Schedule · S.8(8) · Rule 8 One of the Rules' most specific duties, handled end to end. **Inactive users found** Finds inactive users on e-commerce, social media and gaming platforms. Third Schedule **Warning before erasure** A 48-hour notice by WhatsApp, SMS or email first. **Legal hold respected** Held records are kept; erasure is off until you switch it on. S.9 · Rule 10 · Rule 11 Children's data flagged, protected from tracking and escalated wherever it appears. **Tracking blocked** Child-directed mode and an under-18 choice in the banner. **Guardian details**: A parent's details are required for a child's consent. Stored encrypted. **Breaches flagged critical** A breach with children's data is critical from the start. **Staff course on children** A course with quiz and certificate in the Training Academy. S.9 S.8(6) · Rule 7 From first report to regulator filing, every clock visible and the plan drafted. **Every deadline at once 72 h · 6 h**: All regulator reporting deadlines run side by side. CERT-In, RBI and SEBI within 6 hours of detection, IRDAI copied; the DPDP Board duty from May 2027. **Who is affected** Worked out from your data map and consent records. Best with Discovery (DSPM) **Action plan** Drafted for the board and regulators, never filed on its own. **Board breach report** An eight-section PDF for the Data Protection Board. DPIA · SDF · S.10 · Rule 13 Assessments that follow the Act and leave tamper-evident evidence. **58 assessment templates** Ready-made privacy risk assessments, 44 made for specific industries. DPIA · PIA · TIA **Extra duties, one chain SDF · Rule 13**: Yearly assessment, auditor sign-off and board approval, in one tracked flow. For a Significant Data Fiduciary: annual DPIA, auditor attestation, board sign-off and the Rule 13(2) bundle. **Risk register**: Log privacy risks and score them on a matrix. 3x3 to 5x5 matrices with a signed lock. **Tamper-evident report**: A PDF anyone can check has not been altered. It carries a fingerprint and a verify endpoint. ROPA · records of processing A register that draws itself, and shows where declaration and reality differ. **181 industry packs**: Ready-made data, purpose and clause lists for your industry. 2,570 data elements, 1,229 purposes and 1,577 clauses. **Diagram import and export**: Move data-flow diagrams in and out of common tools. draw.io, Mermaid and Graphviz. **Bulk import** Load up to 10,000 rows, with a test run first. **Declared versus discovered Needs Discovery (DSPM)**: Compare what you declared with what FOCTTA Discovery (DSPM) finds. Children's data flagged first. S.8(2) · DPA Know every vendor that handles your data, and share only under a valid contract. **Vendor register**: Every vendor handling your data, with its contract status. DPA status, transfer country and safeguards. **Expiry alerts**: Reminders before a vendor contract runs out. At 180, 90, 60, 30, 14 and 0 days. **Contract clause checklist DPA**: Check each vendor contract has the clauses each law needs. 10 DPDPA, 12 GDPR and 8 CCPA clauses. **No contract, no sharing** Consent to share is refused without an active vendor contract. DPA S.6(10) Evidence a regulator can verify, and transparency about FOCTTA itself. **Tamper-evident audit trail** Every change gets a receipt, and any later edit shows. Hash-chained **Proof per person** Everything one person agreed to, in one click. **"What FOCTTA stores" New in 2.1**: A plain list of every table and column FOCTTA keeps. Exportable as a PDF. **Logs to security tools SIEM**: Forward audit events to your security monitoring system. QRadar and Splunk push, or a pull key. Automation Any event can start a workflow, and the right person hears in time. **Visual workflow designer** Draw workflows from email, webhook, event and breach steps. Some actions coming **Two-person approval** Ordered approvals before any correction or erasure. Maker-checker **WhatsApp and SMS**: Message people through 15 India-ready providers. DLT enforced. **Slack, Teams, PagerDuty** Alerts in the tools your team uses, with timed escalation. Administration Enterprise sign-in and separation of duties from day one. **Company sign-in SSO · SCIM**: Staff sign in with company accounts, added and removed automatically. SAML 2.0, OIDC and SCIM 2.0 provisioning. **Two-step sign-in** A code from an app, with backup codes and session control. MFA · TOTP **8 roles, 144 permissions**: Give each person only the access they need. Plus custom roles. **Directory health check** 19 read-only checks on your directory, scored 0 to 100. Active Directory Board-ready The DPO's day in one queue, and your brand on every public surface. **Approval queue** Everything waiting for the signed-in approver, in one list. DPO My Queue **Board report** A report for your board, with DPDP penalty exposure. **Your brand, pulled in** Colours, fonts and logo taken from your website. **Accessibility guard**: Hard-to-read colours are held until someone acknowledges them. Checked against WCAG AA contrast. Breach management · S.8(6) · Rule 7 ## One incident. Every regulator clock, from the moment you know. After a personal data breach, each regulator has its own reporting deadline. FOCTTA tracks every one that applies. Your sector's clocks Deadlines for your sector, counted from the moment you know. Breach scope What a breach reached, matched to your data map. Action plan drafted A plan for the board and regulators, never filed on its own. Board breach report, eight sections Escalation to every data protection officer Children's data escalates to critical 6 hours CERT-In 6 hours RBI (DAKSH) 6 hours SEBI, portal 24h 6 hours IRDAI (CERT-In copy) 72 hours Board, from May 2027 For groups of companies ## One platform for the whole group. Each company keeps its own consents. One tag, every brand One website snippet recognises each brand from its domain. **Keys and notices stay put** Keys, webhooks, notices and preference centres stay with their company. Withdrawals never cross It stays with its company unless the person asks. Evidence, not assertions ## Every change leaves a receipt, chained to the one before. Each record is linked to the one before it, so any later change shows. That is proof a regulator can check. Tamper-evident audit trail A receipt for every change, and any later edit shows. Hash-chained Proof per person Show everything one person agreed to, in one click. **Signed evidence packs** With FOCTTA Discovery (DSPM): packs for DPDPA, SEBI CSCRF, GDPR and CCPA. Accessibility report (WCAG 2.2 AA) on request Company sign-in and two-step login Personal details encrypted Consent granted · marketing prev 9c1d… → a7b3… #846 Notice v4 published prev a7b3… → 4f1e… #847 Consent withdrawn · marketing prev 4f1e… → c09d… #848 Erasure certificate issued prev c09d… → 31b7… #849 India-first, by design ## Every notice and choice in English and all 22 scheduled languages. Designed and built in India Hosted in India, or on your own server. हिन्दी বাংলা తెలుగు मराठी தமிழ் اردو ગુજરાતી ಕನ್ನಡ ଓଡ଼ିଆ മലയാളം ਪੰਜਾਬੀ অসমীয়া हिन्दी বাংলা తెలుగు मराठी தமிழ் اردو ગુજરાતી ಕನ್ನಡ ଓଡ଼ିଆ മലയാളം ਪੰਜਾਬੀ অসমীয়া मैथिली संस्कृतम् कोंकणी नेपाली सिन्धी डोगरी कॉशुर ꯃꯩꯇꯩꯂꯣꯟ बड़ो ᱥᱟᱱᱛᱟᱲᱤ English हिन्दी मैथिली संस्कृतम् कोंकणी नेपाली सिन्धी डोगरी कॉशुर ꯃꯩꯇꯩꯂꯣꯟ बड़ो ᱥᱟᱱᱛᱟᱲᱤ English हिन्दी The DPDP timeline Penalties up to ₹250 crore per breach of duty 13 Nov 2025 Rules notified The Data Protection Board and definitions came into force. **Nov 2026 Consent Manager rules**: Rules begin for companies registered to manage people's consents. Consent Manager provisions start under Rule 4. The Board has not yet published how to apply. May 2027 Main obligations Notice, consent, security, breach reporting and rights apply. ## Add FOCTTA Detection (DDR) and consent is checked at the database. Stop a query that touches a withdrawn person, and find where personal data really lives with FOCTTA Discovery (DSPM). [See how Detection blocks a query](https://foctta.com/detection) [See how Discovery finds data](https://foctta.com/discovery) [Book a demo](https://foctta.com/company) ======== # FOCTTA Discovery - DSPM for personal data across your estate > Find and classify personal data across databases, cloud accounts, file shares and laptops, with posture, risk and lineage mapped to the DPDP Act. Web page: https://foctta.com/discovery This Markdown copy has the same content as the web page. Built 2026-10-14. --- FOCTTA Discovery (DSPM) Find personal data # Your register says what you hold. Discovery shows what is really there. FOCTTA Discovery finds personal data across your databases, clouds, SaaS, file servers and laptops, and shows how exposed it is and where it goes. (DSPM \- data security posture management) Sold on its own, with or without FOCTTA Consent. [Book a demo](https://foctta.com/company) See how Discovery finds data Aadhaar outside a vault · shared drive PAN in a KYC PDF · file server Children's dates of birth · CRM How it works 1. Connect databases, clouds, files and laptops 2. Find and classify the personal data 3. See the exposure, then fix each finding ## Find personal data, rate the risk, see where it flows, then fix it or flag it. Hover or tap a card for detail. **India-grade classification**: Finds Aadhaar, PAN, UPI and other Indian IDs. Indian identifiers are validated with their checksums and context, not just pattern-matched. - Aadhaar, PAN, GSTIN, UPI, ABHA and more - Inside PDFs, Word and Excel files - Turn detectors on or off per organisation **Exposure and risk**: Risky copies and coverage gaps, ranked. Toxic combinations, shadow copies, orphan data and coverage gaps, ranked across the estate. - Public exposure and cross-border findings - Board summary - Posture on any past date **Where data flows**: Who can reach each field, and where it goes. Where each sensitive column is used, who can reach it, and which data leaves the estate, by country. - Views, procedures and jobs that use a column - Data leaving the estate, by country - Cross-border register **Findings you can act on**: One row per file, with an owner and a fix. One row per file, not one per match, with an owner, a status and a fix. - A "what we did not read" report - Malware and attacker tools flagged in files - Owner, status and remediation per finding **Find one person's data**: Give one ID, see every store that holds them. Give one identifier and find every store that holds that person, following foreign keys. - Signed, metadata-only DSAR export - Erasure run inside your network - Checks the old value is really gone **Children's data DPDP S.9**: Where minors' data sits, and guardian consents. A children's data report by system and business unit, and a guardian-consent register. - Minor dates of birth detected - PDF export - Hard block with FOCTTA Detection (DDR) Where it looks Most sources in pilot **Only masked metadata leaves your network.** File servers proven at a customer site. Others: lab and demo data. **Databases** Databases · 9 PostgreSQL, MySQL, SQL Server, Oracle, Cloud SQL, Azure SQL, MongoDB, Elasticsearch, Redis **Warehouses and streams** Warehouses and streams · 4 Snowflake, BigQuery, Databricks, Kafka **Cloud storage** Cloud storage · 3 Amazon S3, Azure Blob, Google Cloud Storage **SaaS and drives** SaaS and drives · 5 SharePoint, OneDrive, Google Drive, Salesforce, Workday **Servers and mainframes** Servers and mainframes · 4 File servers, IBM i, Mainframe extracts, Unix over SSH **Laptops** Laptops · 1 Windows and Linux laptops Laptops, at fleet scale Pilot **Files are classified on the laptop. Only findings leave.** How it rolls outA silent installer for Intune or SCCM, rolled out in waves and paused with one action, with a local log of what was read for the employee's comfort. Finding data you did not know you had ## Eight ways to build the inventory, most automated first. From your cloud accounts and IT asset register to a plain CSV file. **Schema upload: no database passwords shared** For banks that will not share database passwords, upload the schema instead: FOCTTA classifies from structure and never receives credentials. Credentials stay on your host Read-only scanners L1 Cloud accounts Data stores in your AWS account: RDS, Redshift and S3. L2 IT asset register Databases and servers IT registered. ServiceNow CMDB L3 Endpoint security tool Computers and servers it tracks. EDR L4 Staff sign-in directory Unapproved cloud apps staff can reach. SSO / SCIM L5 HR system People and teams, to name owners. L6 Network exports Every host seen on your network. L7 Active scanning Everything FOCTTA's scanners read. L8 CSV import A plain list, when nothing is automated. Works on its own. Works better together. ## Pair it with FOCTTA Consent, Activity (DAM) or Detection (DDR) when you are ready. **With FOCTTA Consent Consent linked to the data Per customer**: Flags data used beyond what people agreed to. Consents with no data found, and data used beyond its purpose, flagged. **With FOCTTA Consent Breach: locate and report back Pilot**: Locates breached data from hashed IDs. A breach asks Discovery where the breached data sits, using hashed identifiers only. **With FOCTTA Consent Findings become risks**: Serious findings raise and close register risks. Serious findings raise and close risks in the risk register. **With FOCTTA Activity (DAM) Behaviour on the data you found**: Activity (DAM) watches the stores marked sensitive. Activity (DAM) watches the stores Discovery classified as sensitive. **With FOCTTA Detection (DDR) Your identifiers, not defaults**: Detection (DDR) learns which columns hold IDs. The gateway learns which columns hold person identifiers from Discovery. **With FOCTTA Detection (DDR) Children's data blocked Pilot**: No guardian consent, no minors' data. Queries on minors' data blocked without the Section 9 role and guardian consent. **Signed evidence packs** Pilot **India's DPDP Act** A ZIP with a signed manifest for the Act. **SEBI CSCRF** Disaster-recovery and continuity test log. **EU privacy law GDPR** For people in the EU. **California privacy law CCPA** For California consumers. ## Discovery (DSPM) finds the data. Activity (DAM) shows who reads it. Detection (DDR) decides who may. [See how Activity watches data](https://foctta.com/activity) [See how Detection blocks a query](https://foctta.com/detection) [Book a demo](https://foctta.com/company) ======== # FOCTTA Activity - database activity monitoring (DAM) for sensitive data > See who touches sensitive data, learn what normal looks like, and start the right breach clock when it is not. Web page: https://foctta.com/activity This Markdown copy has the same content as the web page. Built 2026-10-14. --- FOCTTA Activity (DAM) See who touched data On-premise # Know who touched sensitive data, and whether that was normal. FOCTTA Activity records who read or moved sensitive data, learns what is normal for each person, and warns before an export completes. (DAM \- database activity monitoring) Each record shows from where, how much and for what purpose, per person and per application. [Book a demo](https://foctta.com/company) See what Activity catches **svc-reporting · rows read per hour** baseline learned Export 11x this account's normal step-up required Touched cold tables for the first time early warning How it works 1. Connect audit logs, cloud trails or the gateway 2. Learn what is normal for each person 3. Get warned before an export completes ## Three ways to capture activity. No agent on the database needed. Person identifiers inside queries are stored as hashes, never raw. Retention up to seven years. **Mode A Native audit logs PostgreSQL SQL Server Oracle** Survives log rotation and partial lines. **Mode B Cloud event streams Snowflake BigQuery AWS CloudTrail** Includes S3 downloads measured in bytes, with guidance that keeps logging costs in check. **Mode C Through the gateway With FOCTTA Detection (DDR) Field proof pending** Every query that passes the FOCTTA Detection (DDR) gateway is also recorded as activity. Named detectors, not a black box ## Warnings before the damage, each with a reason you can read. **Baselines per person**: Spots a sudden change for any person. Normal volume is learned for each person and account, so a sudden change stands out. **Application fingerprints**: Flags when an app's account is misused. Each application has a normal query pattern. A shift exposes a misused service account. **Early warnings Pilot**: Spots probing before any data leaves. Reconnaissance, off-pattern access, new credentials, audit disabling, schema mapping, cold tables. **Mass export, tiered**: Big exports alerted, challenged or blocked. 5x normal alerts, 10x asks for step-up sign-in, 50x blocks. **Low and slow**: Catches many small queries that add up. Thousands of small, normal-looking queries that add up to a large move. **Purpose drift**: Flags use that strays from usual purposes. Someone whose data use drifts away from their usual purpose mix. **Attack stories**: Joins separate warnings into one finding. Separate signals joined into one finding: recon, pivot, escalate, exfiltrate. **Privileged users**: Watches admin accounts for mass exports. Volume tracking and a dedicated rule for mass export by a privileged account. Breach readiness ## When something is found, the clocks are already on screen. A live query stream A forensic timeline you can export A drill-through from each finding to the decisions it relates to **72** hours DPDP Act India, report to the Board **72** hours GDPR Art. 33 EU, report to the regulator **60** days HIPAA US health data Consent-aware findings **Did the people whose data was touched agree to this purpose?** How it is answeredEach finding can carry the answer, from FOCTTA Consent or a local consent ledger. If the answer cannot be checked, the finding says so. On its own, or together **Activity is sold on its own. Pair it when you are ready.** FOCTTA Detection (DDR) Baselines feed the decision on each query. (https://foctta.com/detection) FOCTTA Discovery (DSPM) Tells Activity which stores hold sensitive data. (https://foctta.com/discovery) ## See your own audit logs turned into findings. [Book a demo](https://foctta.com/company) ======== # FOCTTA Detection - data detection and response (DDR) > Allow, mask or block each query at a decision gateway, then respond with detection rules, playbooks and your SIEM and SOAR. Web page: https://foctta.com/detection This Markdown copy has the same content as the web page. Built 2026-10-14. --- FOCTTA Detection (DDR) Check every query PostgreSQL gateway # A decision on every query to sensitive data, before it runs. FOCTTA Detection checks every query to sensitive data before it runs, inside the database connection, and allows, masks, challenges or blocks it. (DDR \- data detection and response) Then it runs the response playbook and drafts the regulator notification. Your application only changes its connection string. [Book a demo](https://foctta.com/company) See how Detection blocks a query Allow Mask Alert Step-up Break-glass Quarantine Block ALLOW SELECT plan, city FROM customers no identifiers MASK SELECT name, pan FROM customers pan masked BLOCK SELECT \* FROM kyc\_documents name the columns · BLK-7F2C STEP-UP SELECT \* FROM ledger LIMIT 500000 10x normal volume BLOCK SELECT dob, guardian FROM students children's data MASK SELECT email, phone FROM leads phone masked ALLOW SELECT sku, stock FROM inventory no personal data BLOCK COPY customers TO STDOUT mass export ALLOW SELECT plan, city FROM customers no identifiers MASK SELECT name, pan FROM customers pan masked BLOCK SELECT \* FROM kyc\_documents name the columns · BLK-7F2C STEP-UP SELECT \* FROM ledger LIMIT 500000 10x normal volume BLOCK SELECT dob, guardian FROM students children's data MASK SELECT email, phone FROM leads phone masked ALLOW SELECT sku, stock FROM inventory no personal data BLOCK COPY customers TO STDOUT mass export How it works 1. Point your application at the gateway 2. Each query is checked against your rules 3. Allowed, masked, challenged or blocked ## The gateway decides. The database does the masking. Hover or tap a card for detail. The gateway speaks the PostgreSQL protocol today. **Masking inside the query**: Returns masked values, like the last 4 digits. The query is rewritten so the database itself returns masked values: last four digits, masked Aadhaar or a token. **Fail closed, always**: Blocks when it cannot mask safely, or is down. If a query cannot be masked safely, it is blocked with a clear instruction. If the policy engine is down, the gateway denies. **Purpose checked at the query**: No consent for the purpose, no raw data. A query for a purpose without valid consent is masked at the column or blocked, with the reason attached. **One Request ID everywhere**: One ID links the error, decision and audit trail. The same ID in the error, the decision, the audit chain and the SOC ticket, plus a "why was I blocked?" page. **Blocks your apps understand**: A block looks like a normal database error. A blocked query gets a well-formed database error, so existing error handling and retries behave. **Real session kill**: Ends the offending live database sessions. Ends the offending database sessions, matched by the person's hashed identifiers, and says so when none were found. 41 built-in rules ## Rules for Indian data, Indian banks and Indian law. **Pause, copy or test-run any rule** Pause or fork any rule, dry-run a new one against real data before publishing, and publish it only when you are happy with what it would have done. Core data security 11 Banking and financial services 10 Healthcare 5 Cloud 10 DPDPA 5 Core data security · 11 rules Aadhaar outside a vault Section 9 minor data without guardian consent Cross-border personal data without safeguards Publicly exposed personal data Orphan personal data Mass export by a privileged user Mass export over a time window Audit logging disabled Consent-failed queries Purpose drift Schema-mapping reconnaissance Respond ## 15 playbooks that act, and say so honestly when they cannot. Destructive steps wait for two different people. Safe steps run on their own. A step with nothing to run reports "not implemented", never a false green. See the 15 playbooksAadhaar vault escalation Section 9 guardrail Cross-border geofence Breach console pre-fill Session quarantine Lock session, then review Quarantine export Disable user, then notify Block egress destination Revoke encryption grant Re-enable audit logging Force consent check DPIA kick-off Rights request escalation Block minor access **Emergency access, done properly** Emergency access needs a written reason, a time limit of 15 to 240 minutes and two approvers, and ends with a summary. **Breach drafted for you** A confirmed block drafts the incident with the attack chain. Unknown counts read "not yet established", never zero. **Rules you can test first** Dry-run a new rule against real data, see what it would have decided, then publish, pause or fork it. SIEM and SOAR **29 targets, with native delivery to Microsoft Sentinel, Splunk and CEF syslog.** Automatic push on the roadmap Today: test sends, a history per target, audit forwarding. Named targetsSplunk Microsoft Sentinel IBM QRadar Elastic Sumo Logic Securonix Exabeam LogRhythm Google Chronicle Datadog Cortex XSOAR ServiceNow SecOps Tines Webhook CEF syslog Kafka On its own, or together **Detection runs with no other FOCTTA product. Pairing adds depth.** FOCTTA Discovery (DSPM) Recognises the IDs in your tables. (https://foctta.com/discovery) FOCTTA Activity (DAM) Normal behaviour feeds the rules. (https://foctta.com/activity) FOCTTA Consent Checks the purpose people agreed to. (https://foctta.com/consent) ## Put a decision in front of your most sensitive tables. [Book a demo](https://foctta.com/company) ======== # FOCTTA TPRM - third-party and vendor risk management > Tier vendors, send questionnaires, score risk with reasons you can read, and track incidents and exits for every processor. Web page: https://foctta.com/tprm This Markdown copy has the same content as the web page. Built 2026-10-14. --- FOCTTA TPRM # Every vendor score shows the rule and clause behind it. FOCTTA TPRM is third-party risk management software: it tiers every vendor that handles your data, collects their questionnaires and scores each one with its reasons. Built for RBI, SEBI, IRDAI and the DPDP Act . [Book a demo](https://foctta.com/company) See how it works A C B Vendor incident · 7 clocks Second approver required How it works ## From the first quick-add to an exit a regulator can follow. **01 Quick add**: Add a vendor and check its business IDs. PAN, GSTIN, CIN, Udyam, IFSC and LEI checks. **02 Tier by risk**: Readable rules place each vendor in a tier. 22 readable tiering rules, override by a second person. **03 Send questionnaires**: Vendors answer online, with no account needed. Campaigns through the vendor portal: one-time code, save and resume, uploads. **04 Score with reasons**: Each vendor gets a band that shows why. Explainable bands with citations: the rules that fired and the clause each one cites. **05 Approve and onboard**: Checks must pass before a vendor goes live. A 7-condition gate and a 12-step onboarding. **06 Respond to incidents**: Track a vendor incident against regulator deadlines. Incidents with 7 regulatory clocks. **07 Exit with proof**: Offboard with a record that checks itself. 11 exit items and a self-verifying dossier. Explainable by design ## Same inputs, same band. Every time. 6 Questionnaires, 665 questions 7 Regulatory clocks on incidents 15 Personas, from buyer to board **Cloud payments processor** Tier 1 · personal data · cross-border Band B Why this band The rules that fired, the clause each cites, and each answer's source. 1 Processes customer personal data DPDP s.8(2) 2 Stores data outside India RBI Outsourcing 2025 3 Business continuity evidence missing ISO 22301 4 Encryption evidence verified ISO 27001 Scoring is rule-based and reproducible No AI decides your risk **A portal vendors actually use** Save and resume, file uploads, and a spreadsheet round trip. **Maker-checker everywhere** Enforced in the database. **Tamper-evident evidence** A SHA-256 evidence chain per customer, checked in one click. **Incident exposure answer** With 7 live regulatory countdowns. **Exits a regulator can follow** A sign-off chain per tier, legal holds and a self-verifying dossier. **Account closure proof Needs setup** The evidence comes from Microsoft Entra ID. **Procurement clearance** By API, or a CSV of up to 1,000. **Contracts and DPAs** 19 document kinds with expiry, and 15 data elements per processing record. **Board pack and reports** 8 management reports and a programme report for the board. Content packs cite The questionnaires and scoring rules cite these laws and standards. RBI Outsourcing Risk 2025 SEBI CSCRF SEBI BRSR IRDAI DPDP Act 2023 DPDP Rules 2025 CERT-In 2022 ISO 27001 ISO 27701 ISO 22301 ISO 42001 SSAE 18 ISAE 3402 OWASP ASVS Companies Act **Linked to FOCTTA Consent** FOCTTA TPRM is its own product with its own console and sign-in. Today its vendor risks flow into the FOCTTA Consent risk register, and treatment decisions flow back. ## Show your regulator exactly why each vendor scored the way it did. [Book a demo](https://foctta.com/company) ======== # FOCTTA Training Academy - DPDP privacy training for your teams > Role-based DPDP courses, assignments and completion evidence, built into FOCTTA Consent. Web page: https://foctta.com/training This Markdown copy has the same content as the web page. Built 2026-10-14. --- FOCTTA Training Academy DPDP S.8(4), S.8(5) # A trained workforce, with certificates anyone can verify. FOCTTA Training Academy gives your people six courses on India's DPDP Act , each ending in a quiz and a certificate your data protection officer signs. New joiners are enrolled automatically, and vendor staff can join too. [Book a demo](https://foctta.com/company) See the six courses Your logo ![FOCTTA](https://foctta.com/foctta-header-logo.png) Certificate of completion This certifies that Ananya Rao completed **DPDPA: the 72-hour breach** with a score of 90 percent. Your DPO Data Protection Officer ID 7Q4K-M2XD PASSED 90% in Added to LinkedIn Verified on a public page ## Six courses built around the DPDP Act. **01 DPDP Act Data protection fundamentals**: What the law asks of everyone who handles personal data. The DPDP Act is India's law on how organisations collect and use personal data, and the rights people have over it. **02 DPDP S.9 Children's data**: Guardian consent, no tracking, and what to escalate. Processing a child's data needs verifiable parental consent, and tracking or targeted ads at children are not allowed. **03 DPDP Rule 7 The 72-hour breach**: Spotting a breach and who to tell, by when. After a personal data breach: tell affected people and the Board without delay, then send the Board a report within 72 hours. **04 DPDP S.11-14 Handling rights requests**: Access, correction, erasure and nomination, step by step. People can ask what data you hold, have it corrected or erased, complain to you first and name a nominee. **05 DPDP S.6 Consent done right**: Free, specific, informed, and as easy to withdraw as to give. People can withdraw consent at any time, and it must be as easy as giving it. Once consent is withdrawn, you and your vendors must stop using that person's data within a reasonable time. **06 RBI · SEBI Banking and insurance edition**: The same essentials, for banks, finance companies and insurers. The BFSI edition: the same essentials for banks, NBFCs and insurers. A certificate worth posting ## Certificates signed by your DPO that anyone can check on a public page. 01 Finish the course Every course ends with a graded quiz. 02 Pass with 70 percent The result is recorded against the learner. **03 Signed by your DPO** Set once for the whole company or per business unit. Every certificate issued after that carries it. 04 Add to LinkedIn One click, with a credential ID. 05 Anyone can verify it A public page confirms it is genuine. AR **Ananya Rao** Relationship Manager Proud to complete the DPDPA 72-hour breach course. Knowing who to tell, and by when, matters. Certificate of completion **DPDPA: the 72-hour breach** Signed by the company DPO ID 7Q4K-M2XD Add to profile Show credential **Certificate is genuine** holder · Ananya Rao course · DPDPA: the 72-hour breach signed · Data Protection Officer formats · PDF, PNG, Open Badges 3.0 ## Your training and ours, in one place. **Courses you already run**: Show completions from your current provider in one report. Record completions from your current training provider next to FOCTTA courses, so one report shows everyone. That provider issues its own certificates. One report Due dates Overdue list **Invite anyone by email**: Vendor staff and contractors sign in with a one-time code. Vendor staff, contractors and people not on your systems yet sign in with a one-time code and get certificates in their real names. One-time code Email list Vendor learners **Build your own courses Coming soon**: Publish your own policies and courses, with your own quiz. Publish your own policies and internal courses with your own quiz, and issue the same DPO-signed FOCTTA certificate. Your content Your quiz Same certificate **Automatic assignment**: New joiners get their courses without anyone assigning them. Whether they arrive by invite, SSO, LDAP or SCIM. **Due dates and tracking**: See who has finished, who is due and who is overdue. A My training page, the completion rate and the overdue list. **Signed certificates**: Your logo and your data protection officer's signature on each. PDF or PNG, with a QR code. **Public verification page**: Anyone can check that a certificate is real. A public page confirms it is genuine, and each certificate carries a QR code. **Add to LinkedIn**: Learners put their certificate on LinkedIn in one click. It goes on with a credential ID. **Portable digital badges Open Badges 3.0**: Certificates carry standard badge data other platforms can read. Certificates carry portable, standard badge data in the Open Badges 3.0 format. **Vendor learners**: Vendor staff and other outsiders can take the courses too. They join by magic link and one-time code. **Graded quizzes**: Every course ends in a quiz; 70 percent passes. The result is recorded against the learner. ## Train your people and your vendors' people, in one place. [Book a demo](https://foctta.com/company) ======== # Compare DPDP privacy platforms: the buyer's checklist | FOCTTA > 26 questions to ask any DPDP consent, DSPM, DAM, DDR or vendor-risk vendor, from the DPDP Act and Rules 2025 to hosting in India, with FOCTTA's answer to each and the page that shows it. Web page: https://foctta.com/compare This Markdown copy has the same content as the web page. Built 2026-10-14. --- Buyer's checklist # Comparing DPDP privacy platforms? Ask every vendor these 26 questions. The questions an Indian auditor, a bank's risk team or the Data Protection Board will ask. Next to each, **FOCTTA's answer** and the page that shows it. [Take the 3-minute readiness check](https://foctta.com/readiness) [Book a demo](https://foctta.com/company) FOCTTA's own answers, checked on 10 October 2026. Where the product pages say Pilot, so does this list. **23** languages, English and all 22 scheduled **181** industry packs across 60 industries **118** Consent connector templates **4** ways to host, in India or on your server Built for India's law 7 Data security, not only paperwork 5 Evidence an auditor accepts 5 Where your data lives 5 Fits the group you already run 4 ## Built for India's law Does the product follow the DPDP Act and Rules 2025, or was it adapted from a European tool? 1. **01 Does it follow the DPDP Act and Rules section by section?** Yes. Screens, clocks and citations follow the Act and the Rules, from notice (S.5) to the Board (S.27) and the rights portal (Rule 14). Built [See it on Regulations →](https://foctta.com/regulations) 2. **02 Can a notice go live without the complaint route to the Board?** No. A DPDP notice cannot publish without the fiduciary name and the route to complain to the Data Protection Board. Built [See it on Consent →](https://foctta.com/consent) 3. **03 Can you prove a "no" as well as a "yes"?** Yes. A declined purpose gets its own record and its own receipt, and each purpose a person agrees to is recorded separately. Built [See it on Consent →](https://foctta.com/consent) 4. **04 Are rights requests run on the statutory clock?** Access, correction, erasure, nomination and grievances (Sections 11 to 14) each run on their clock, next to GDPR and CCPA request clocks. Built [See it on Consent →](https://foctta.com/consent) 5. **05 What happens with children's data?** A child-directed mode blocks tracking for children, even after Accept All. FOCTTA Discovery (DSPM) adds a report of where children's data sits and a guardian-consent register (Section 9). Built [See it on Consent →](https://foctta.com/consent) 6. **06 Are breach clocks for the Board and the sector regulators tracked together?** Yes. DPDP Rule 7 (without delay, then a full report in 72 hours) sits next to the 6-hour clocks for CERT-In, RBI, SEBI and IRDAI. Built [See it on Regulations →](https://foctta.com/regulations) 7. **07 Does it speak your customers' languages?** Banners and preference centres in English and all 22 scheduled Indian languages: 23 in all, detected from the page. Built [See it on Consent →](https://foctta.com/consent) ## Data security, not only paperwork Can it find the data, see who reads it, and stop a query, or does it stop at forms? 8. **08 Can it find personal data across the whole estate, including legacy systems?** FOCTTA Discovery (DSPM) has 25+ native scanners for databases, warehouses, cloud storage, SaaS, file servers and laptops, and reads IBM i (AS/400) Db2 and COBOL copybook mainframe extracts. Pilot [See it on Discovery (DSPM) →](https://foctta.com/discovery) 9. **09 Are Indian identifiers validated, or only pattern-matched?** Validated with their checksums and context: Aadhaar, PAN, GSTIN, UPI, ABHA and more, inside PDF, Word and Excel files too. Built [See it on Discovery (DSPM) →](https://foctta.com/discovery) 10. **10 Do you have to hand over database passwords?** No. Upload a schema and FOCTTA classifies from its structure, or run scanners that keep credentials on your own host. Only masked metadata leaves your network. Built [See it on Discovery (DSPM) →](https://foctta.com/discovery) 11. **11 Can you see who touched sensitive data, and whether that was normal?** FOCTTA Activity (DAM) reads 7 sources, from PostgreSQL to AWS CloudTrail, with no agent on the database, and learns a baseline for each person and application. Built [See it on Activity (DAM) →](https://foctta.com/activity) 12. **12 Can consent be enforced at the database, not just recorded?** FOCTTA Detection (DDR) checks each query to sensitive data on PostgreSQL before it runs: no consent for the purpose, no raw data. It masks inside the query and fails closed. Built [See it on Detection (DDR) →](https://foctta.com/detection) ## Evidence an auditor accepts When the auditor or the Board asks "show me", what can you hand over? 13. **13 Is the audit trail tamper-evident?** Each change writes a hash-chained event and a receipt, and any consent can be proved in one click. Built [See it on Deployment →](https://foctta.com/deployment) 14. **14 Are there signed evidence packs for audits?** Signed packs for DPDP, SEBI CSCRF, GDPR and CCPA audits, each a ZIP with a signed manifest. Pilot [See it on Discovery (DSPM) →](https://foctta.com/discovery) 15. **15 Does every vendor score explain itself?** FOCTTA TPRM shows the rule and clause behind each score, and the same inputs always give the same band. Built [See it on TPRM →](https://foctta.com/tprm) 16. **16 Can anyone check a training certificate is real?** Yes. Certificates are signed by your DPO, carry Open Badges 3.0 data, and have a public verification page. Built [See it on Training →](https://foctta.com/training) 17. **17 Are risky actions under separation of duties?** Destructive response steps need two different approvers, enforced on the server, and emergency access needs a written reason and a time limit. Built [See it on Detection (DDR) →](https://foctta.com/detection) ## Where your data lives Your regulator decides where the data may sit. The product should fit that, not the other way round. 18. **18 Is the hosted service in India?** Yes. It runs on AWS in Mumbai, with a dedicated database for each organisation by default. Built [See it on Deployment →](https://foctta.com/deployment) 19. **19 Can it run on your own server, with nothing sent to the vendor?** Yes. One Linux or Windows server, or your own AWS, Azure or Google Cloud account. It sends nothing to FOCTTA unless you configure it to. Built [See it on Deployment →](https://foctta.com/deployment) 20. **20 Can it use your own PostgreSQL database?** Yes. FOCTTA connects to and migrates your database, and never hosts your data. Built [See it on Deployment →](https://foctta.com/deployment) 21. **21 How do you know the software you install is genuine?** Release packages are signed and verified, every image digest is checked before install, and each image ships with a CycloneDX SBOM. Built [See it on Deployment →](https://foctta.com/deployment) 22. **22 Does it fit your sign-in and roles?** SAML 2.0, OIDC, SCIM 2.0 and TOTP with backup codes, with 8 roles, 144 permissions and custom roles. Built [See it on Deployment →](https://foctta.com/deployment) ## Fits the group you already run Indian groups run many brands, many systems and many vendors. Does the product? 23. **23 Can one tag serve every brand in the group?** Yes. The brand is recognised from the page domain, and a withdrawal never crosses to another company unless the person asks. Built [See it on Home →](https://foctta.com/) 24. **24 Does it connect to the systems you already run?** 118 connector templates for CRM, email, marketing and ad platforms, 346 webhook events, and an API with a sandbox. Built [See it on Developers →](https://foctta.com/developers) 25. **25 Does it start from your sector, or from a blank form?** 181 ready-made industry packs across 60 industries, with the data elements, purposes and clauses each sector uses. Built [See it on Industries →](https://foctta.com/industries) 26. **26 Do you have to buy everything at once?** No. Consent, Discovery (DSPM), Activity (DAM), Detection (DDR) and TPRM are sold separately, and each works alone. Built [See it on Home →](https://foctta.com/) ## The FOCTTA family, by market category Each product is sold on its own. Together they cover the record, the data and the vendors. Product Category What it does [FOCTTA Consent](https://foctta.com/consent) Privacy and consent governance (consent management platform) Consent and cookie banners in 23 languages, rights requests with statutory clocks, breach timelines, DPIAs, ROPA and a hash-chained audit trail, built for the DPDP Act and Rules 2025. [FOCTTA Discovery (DSPM)](https://foctta.com/discovery) Data security posture management (DSPM) Finds and classifies personal data across databases, cloud accounts, SaaS, file servers and laptops, with posture, risk and lineage mapped to the DPDP Act. [FOCTTA Activity (DAM)](https://foctta.com/activity) Database activity monitoring (DAM) Records who read or moved sensitive data, learns what is normal for each person, and warns before an export completes. [FOCTTA Detection (DDR)](https://foctta.com/detection) Data detection and response (DDR) Checks every query to sensitive data before it runs, inside the database connection, and allows, masks, challenges or blocks it, then runs the response playbook. [FOCTTA TPRM](https://foctta.com/tprm) Third-party risk management (TPRM) Vendor risk from the first quick-add to an exit a regulator can follow, with every score showing the rule and clause behind it. [FOCTTA Training Academy](https://foctta.com/training) Privacy and data protection training Six DPDP courses with graded quizzes and certificates signed by your DPO that anyone can verify on a public page. ## Questions people ask Short answers. The glossary explains every term. Is FOCTTA a Consent Manager? No. A Consent Manager is a company registered with the Data Protection Board to manage people's consents on their behalf. FOCTTA is software that your organisation uses to collect, record and prove consent and to run the rest of its DPDP programme. Which laws does FOCTTA cover? India's DPDP Act 2023 and Rules 2025 first, then GDPR and CCPA with CPRA, with sector overlays for RBI, SEBI, IRDAI, CERT-In, PMLA and RPwD. What does "Pilot" mean on this page? The same as on the product pages: the capability is labelled Pilot there, and this checklist keeps that label rather than rounding it up. How do I see it on my own data? Book a 30-minute walkthrough on your sector's industry pack. A pilot can be hosted in India or on your own server, and every demo comes with a free DPDP gap assessment. **See the answers on your own data.** A 30-minute walkthrough on your sector's pack, with a free DPDP gap assessment. [Book a demo](https://foctta.com/company) [The Act, section by section](https://foctta.com/regulations) ======== # For AI assistants and agents: FOCTTA facts and site policy | FOCTTA > Facts about FOCTTA in one place: what it is, its six products and their categories (DSPM, DAM, DDR, TPRM), hosting, laws and languages, how the forms work for agents, the crawling policy and the Markdown copies of every page. Web page: https://foctta.com/ai-agents This Markdown copy has the same content as the web page. Built 2026-10-14. --- For AI assistants and agents # FOCTTA, in facts you can cite. What FOCTTA is, what each product does, where it runs and how this site works for an assistant or agent acting for a person. Every fact here is also on the page it links to. Updated 10 October 2026. ## The products, and the names to cite Each is sold on its own and works alone. The market category is in brackets. FOCTTA Consent Privacy and consent governance (consent management platform) Consent and cookie banners in 23 languages, rights requests with statutory clocks, breach timelines, DPIAs, ROPA and a hash-chained audit trail, built for the DPDP Act and Rules 2025. foctta.com/consent → (https://foctta.com/consent) FOCTTA Discovery (DSPM) Data security posture management (DSPM) Finds and classifies personal data across databases, cloud accounts, SaaS, file servers and laptops, with posture, risk and lineage mapped to the DPDP Act. foctta.com/discovery → (https://foctta.com/discovery) FOCTTA Activity (DAM) Database activity monitoring (DAM) Records who read or moved sensitive data, learns what is normal for each person, and warns before an export completes. foctta.com/activity → (https://foctta.com/activity) FOCTTA Detection (DDR) Data detection and response (DDR) Checks every query to sensitive data before it runs, inside the database connection, and allows, masks, challenges or blocks it, then runs the response playbook. foctta.com/detection → (https://foctta.com/detection) FOCTTA TPRM Third-party risk management (TPRM) Vendor risk from the first quick-add to an exit a regulator can follow, with every score showing the rule and clause behind it. foctta.com/tprm → (https://foctta.com/tprm) FOCTTA Training Academy Privacy and data protection training Six DPDP courses with graded quizzes and certificates signed by your DPO that anyone can verify on a public page. foctta.com/training → (https://foctta.com/training) ## Key facts Taken from the Company, Deployment, Regulations and Industries pages. Company FOCTTA Technologies Private Limited. The name is written FOCTTA, in capitals. What it makes Privacy, consent and data security software for India's DPDP Act 2023 and Rules 2025, ready for GDPR and CCPA. Six products, each sold on its own. Made in India: designed, built and hosted in India. Hosting FOCTTA cloud on AWS in Mumbai with a dedicated database per organisation by default; shared and isolated; on your own PostgreSQL; or on your own server or AWS, Azure or Google Cloud account, sending nothing to FOCTTA unless configured. Laws covered DPDP Act 2023 and Rules 2025, GDPR, CCPA with CPRA, and sector overlays for RBI, SEBI, IRDAI, CERT-In, PMLA and RPwD. Languages Banners and notices in English and all 22 scheduled Indian languages: 23 in all. Sectors 181 ready-made industry packs across 60 industries, from banks, insurers and NBFCs to healthcare, telecom, e-commerce and education. Security Hash-chained audit trail with receipts; personal data encrypted with AES-256-GCM; SAML 2.0, OIDC, SCIM 2.0 and TOTP; 8 roles and 144 permissions; signed releases with a CycloneDX SBOM per image. Pricing Not published on the site. Ask through the demo form or support@foctta.com. Contact Phone +91 98051 89051. Email support@foctta.com (a reply within 24 hours). Privacy questions about your own data: dpo@foctta.com. Comparing vendors? The [buyer's checklist](https://foctta.com/compare) answers the questions an Indian auditor or a bank's risk team asks, with the page that shows each answer. ## Forms, when an agent acts for a person Reading is welcome. The forms are for the person you act for. **The demo request form** For a real person who asked for a demo, with that person's own work email. One request per person. Submissions that look automated or bulk are dropped before they reach anyone. **Selling to FOCTTA** Vendors, recruiters and agencies: write to support@foctta.com rather than using the demo form. **The free DPDP certificate** Earned by the named learner passing the final assessment personally. It asks for a code sent to the learner's own inbox and checks the time taken, so an agent cannot take it on someone's behalf. **Questions about your own data** For questions about personal data FOCTTA holds about you, write to dpo@foctta.com. ## Crawling policy Public pages are open to search engines, AI search, AI assistants and training crawlers. **Allowed** Everything public, for search, for answering questions and for training: `Content-Signal: search=yes, ai-input=yes, ai-train=yes`. Only `/internal/` is closed. **Bot operators** Questions about crawling, or a crawler being blocked: support@foctta.com. ## Machine-readable files The same content as the web pages, in formats that are easy to read. /llms.txt A short index of the site for AI systems, with links to each page as Markdown. (https://foctta.com/llms.txt) /llms-full.txt Every public page as Markdown, in one file, products first. (https://foctta.com/llms-full.txt) Any page as Markdown Add .md to a page address (/consent.md, /index.md), or send Accept: text/markdown. Same content as the web page. (https://foctta.com/consent.md) /sitemap.xml Every public page, with the date it last changed. (https://foctta.com/sitemap.xml) /robots.txt The crawling policy below, with content signals. (https://foctta.com/robots.txt) /.well-known/security.txt Where to report a security issue (RFC 9116). (https://foctta.com/.well-known/security.txt) ## Questions people ask Short answers, each repeated from a page on this site. What is FOCTTA? An Indian company that makes privacy, consent and data security software for India's DPDP Act 2023 and Rules 2025, ready for GDPR and CCPA. Its products are FOCTTA Consent, FOCTTA Discovery (DSPM), FOCTTA Activity (DAM), FOCTTA Detection (DDR), FOCTTA TPRM and the FOCTTA Training Academy. Is FOCTTA a Consent Manager under the DPDP Act? No. A Consent Manager is a company registered with the Data Protection Board to manage people's consents on their behalf. FOCTTA is software an organisation uses to collect, record and prove consent and to run the rest of its DPDP programme. Can FOCTTA run inside an organisation's own walls? Yes. It runs on one Linux or Windows server, or in the organisation's own AWS, Azure or Google Cloud account, with signed releases and nothing sent to FOCTTA unless configured. Where is the hosted service? On AWS in Mumbai, India, with a dedicated database for each organisation by default. ======== # Deployment and security - hosted in India, or on your own server | FOCTTA > Run FOCTTA hosted in India with a dedicated database per organisation, connect your own PostgreSQL, or install it on your own server. Web page: https://foctta.com/deployment This Markdown copy has the same content as the web page. Built 2026-10-14. --- Deployment and security # Four ways to run FOCTTA. Your data stays where your regulator expects it. Hosted on AWS in Mumbai and isolated per organisation, or run it yourself: on your own database, your own server, or your own cloud account on AWS, Azure or Google Cloud, with nothing sent to us by default. **01 FOCTTA cloud, AWS Mumbai** A dedicated database per organisation, by default. **02 Shared and isolated** Row-level security in the database, for teams that want the fastest start. **03 Your own PostgreSQL database** FOCTTA connects to and migrates your database. **04 Your server or your cloud** Updates arrive only as signed archives. On your own server ## One server, Linux or Windows. Signed from end to end. The bootstrap installs Docker itself. Use the bundled PostgreSQL or your own, your CA and TLS certificates, with backup, restore and rollback built in. Consent only **2 vCPU · 8 GB** 60 GB disk With Discovery (DSPM), Activity (DAM) or Detection (DDR) **4 vCPU · 32 GB** 200 to 500 GB disk **Signed release packages** The manifest is signed and verified, and every image digest is checked before anything installs. **Software bill of materials SBOM** One for every image, in CycloneDX, named by image digest. **Images scanned before release** Fixable high and critical findings are cleared before each release. **Licence never locks you out** Writes stop after a grace period. Reads are never blocked. **Nothing sent to FOCTTA** It sends nothing unless you configure it to. **Outbound-only edge agents Pilot** They carry consent mirroring and rights jobs over outbound HTTPS only. **FOCTTA Receiver Beta** PostgreSQL, MySQL, SQL Server, Oracle or MongoDB. ## Security that shows its working. Our terms commit to 99.9 percent uptime on the hosted service. Sign-in tied to your organisation Your organisation's address accepts only your own users. **Your company sign-in SSO · SCIM · MFA** SAML 2.0, OIDC, SCIM 2.0 and TOTP with backup codes. **Separation of duties** 8 roles, 144 permissions and custom roles. **Personal data encrypted** Encrypted with AES-256-GCM. **No raw visitor IPs kept** Pseudonymous: kept only as keyed hashes. **An audit trail of changes** Each change writes a hash-chained event and a receipt. Service credentials sealed Keys for the services you connect are sealed per organisation. Accessibility report An accessibility conformance report is available on request. WCAG 2.2 AA ## Tell us where your data has to stay. We will show you how FOCTTA fits. [Talk to us about hosting](https://foctta.com/company) ======== # DPDPA compliance, GDPR and CCPA, with RBI, SEBI and IRDAI clocks | FOCTTA > The DPDP Act 2023 and Rules 2025 section by section, GDPR and CCPA, and the sector regulator bundles FOCTTA ships today. Web page: https://foctta.com/regulations This Markdown copy has the same content as the web page. Built 2026-10-14. --- Regulations # Built on India's DPDP Act. Ready for GDPR and CCPA. One platform answers three privacy laws and India's sector regulators, each with its own clocks, notices and evidence. DPDP Act 2023 India's data protection law GDPR The EU's data protection law CCPA and CPRA California's consumer privacy law Sector regulators Banking, markets, insurance and cyber rules ## Pick a section. See what FOCTTA does for it. Each section of the DPDP Act sets a duty. Pick one to see what the law asks and how FOCTTA helps. Penalties up to ₹250 crore Notice S.5 Consent S.6 Legitimate uses S.7 Processors S.8(2) Breach S.8(6) Erasure S.8(7) Inactivity S.8(8) Children S.9 Extra duties S.10 Access S.11 Correction S.12 Grievance S.13 Nomination S.14 Cross-border S.16 Rights portal R.14 The Board S.27 S.5 · Notice **The Act asks:** An itemised notice before or with the consent request, with how to withdraw and complain. Versioned notices that cannot publish without the complaint route. Every consent stamped with the notice in force Served by country, language and brand Re-consent when the notice changes S.6 · Consent **The Act asks:** Free, specific, informed and unambiguous consent, and withdrawal as easy as giving it. A consent ledger that proves yes, proves no, and enforces withdrawal. One record per person, purpose and business unit Refusals recorded as evidence Withdrawal applied on every server at once S.7 · Legitimate uses **The Act asks:** Processing without consent only for the uses the Act lists. The lawful basis is on every record, and the DPIA reads it. Deemed consent and legitimate uses recorded as the basis Assessments conclude from the recorded basis, never a guess S.8(2) · Processors **The Act asks:** Processors engaged only under a valid contract. Sharing consent is refused without an active processing contract (DPA). Processor register with DPA status and expiry Alerts at 180, 90, 60, 30, 14 and 0 days DPA clause checklist S.8(6) · Personal data breach **The Act asks:** Inform the Board and each affected person of a breach. Parallel regulator clocks from the moment you know. CERT-In, RBI, SEBI 6h; IRDAI copy; Board from May 2027 Blast radius matched to your data map Board breach report and a drafted action plan S.8(7) · Erasure **The Act asks:** Erase when consent is withdrawn or the purpose is served, unless law requires retention. A legal decision tree for every system, with a certificate. Retention reasons from a catalogue of 11 laws Legal hold respected Processors confirm erasure by secure link S.8(8) · Erasing inactive accounts (Third Schedule) **The Act asks:** Erase after the prescribed inactivity, with a 48-hour notice first. The 48-hour notice by WhatsApp, SMS or email, then erasure. Dormant users found for the Third Schedule classes Legal hold respected S.9 · Children's data **The Act asks:** Verifiable guardian consent, and no tracking or targeted ads at children. Tracking blocked for children, even when they tap Accept All. Child-directed mode and an under-18 choice Guardian details required and encrypted Children's data makes a DPIA mandatory S.10 · Significant Data Fiduciary **The Act asks:** A DPO in India, independent audit, periodic DPIA and algorithmic due diligence. The extra duties of a Significant Data Fiduciary, as one governed chain. Annual DPIA with the Rule 13(3) step Auditor attestation and board sign-off Rule 13(2) submission bundle S.11 · Right to access **The Act asks:** A summary of the data, the processing and who it was shared with. An access package with India-aware redaction. No tipping off, Aadhaar and PAN masking ZIP with manifest, checksums and certificate S.12 · Correction and erasure **The Act asks:** Correct, complete, update or erase on request. Correction fanned out to every system, with rollback. Re-KYC routing for hard fields Correction certificate S.13 · Grievance redressal **The Act asks:** An effective grievance mechanism within the prescribed period. A 12-state workflow on the 90-day clock. Public form with 13 categories Warnings at 50, 75 and 90 percent Board escalation packet after redressal S.14 · Right to nominate **The Act asks:** Let a person nominate someone to act for them. Two-party confirmation and a cooling-off hold. One-time codes for both parties Waiver only by two different approvers S.16 · Cross-border transfer **The Act asks:** Transfers restricted only to countries the government notifies. Transfer country and safeguards on every vendor. Per-vendor transfer records A cross-border register in the evidence pack, with Discovery (DSPM) R.14 · Publishing how to exercise rights **The Act asks:** Publish how to exercise rights and which identifiers are needed. A rights portal builder per business unit. Identifier sets under Rule 14(5) Identity floors that rise for BFSI and children S.27 · Complaints to the Board **The Act asks:** A person may complain to the Data Protection Board. The Board complaint link on every banner and notice. Tamper-evident escalation packet The person records their Board filing reference **The DPDP timeline** 13 Nov 2025 **Rules notified** The Data Protection Board and definitions came into force. **Nov 2026 Consent Manager rules**: Rules begin for companies registered to manage people's consents. Consent Manager provisions start under Rule 4. The Board has not yet published how to apply. May 2027 **Main obligations** Notice, consent, security, breach reporting and rights apply. EU · GDPR ## GDPR for your EU customers. The same console that runs your DPDP programme answers people in the EU, with GDPR clocks, notices and clauses. Fines up to €20 million or 4% of worldwide annual turnover. Notices by location EU visitors see the GDPR notice in their language. **30-day request clock Staff-entered**: Answer EU people's data requests within 30 days. With the 60-day extension, and warnings at 50, 75 and 90 percent, on requests your team logs. Processor contract checks 12 contract clauses tracked for each vendor. GDPR Art. 28 · DPA 72-hour breach clock The GDPR breach deadline, next to the Indian clocks. **Legal grounds for use GDPR lawful bases**: Record the legal ground for each use of data. Consent, contract, legal obligation, vital interest, public task and legitimate interest. Risk assessment templates Ready-made GDPR and multi-law risk assessments. DPIA · TIA **Signed GDPR evidence pack Pilot**: A signed bundle of proof for GDPR audits. With FOCTTA Discovery (DSPM). US · CCPA ## CCPA and CPRA for your California customers. Switch CCPA on when you serve California. Notices, service-provider clauses and request clocks sit in the same console as your DPDP programme. Civil penalties per violation, higher for intentional violations. Notices by location US visitors see the CCPA notice. Service provider contracts 8 contract clauses tracked for each service provider. CCPA **45-day request clock Staff-entered**: Answer California data requests within 45 days. With the 45-day extension, on requests your team logs. **Signed CCPA evidence pack Pilot**: A signed bundle of proof for CCPA audits. With FOCTTA Discovery (DSPM). India · Sector ## India's sector regulators, built in. Breach clocks, retention rules and content packs for the regulators your board answers to, and 17 more regulator bundles ready to apply. From May 2027 these run alongside the DPDP Board duty. **Banking regulator RBI**: A 6-hour clock for cyber incident reports to RBI. 6-hour cyber incident clock on DAKSH (2026 Directions), credit-information correction compensation and BFSI identity floors. **Securities regulator SEBI CSCRF Evidence pack with Discovery (DSPM)**: 6-hour notice, then a portal report at 24 hours. 6-hour notice and 24-hour portal report, a signed CSCRF evidence pack and a DR and BCP log. **Insurance regulator IRDAI**: 6-hour CERT-In report, with a copy to IRDAI. 6-hour CERT-In report copied to IRDAI, and IRDAI record-retention reasons. National cyber agency 6-hour reporting clock and a ready report bundle. CERT-In **Record-keeping laws PMLA · Companies Act · tax**: Records these laws require are kept, not erased. Retention reasons in the erasure catalogue, and STR details kept out of access packages (no tipping off). **Broadcast and accessibility TRAI · MIB · RPwD**: Broadcast overlays and a colour contrast check. Broadcasting overlays and a WCAG AA contrast check that supports RPwD s.46 duties. **Banking and markets bundles Regulator bundle**: Ready rule sets for banks and market firms. RBI 2026 cybersecurity Directions (DAKSH), SEBI CSCRF and SEBI BRSR Core. **Cyber and critical sectors Regulator bundle**: Rule sets for cyber reporting, critical systems and power. The CERT-In 6-hour direction, NCIIPC critical information infrastructure and the CEA power sector cyber rules. **Identity, health and gaming Regulator bundle**: Rule sets for Aadhaar, health data and gaming. UIDAI Aadhaar offline eKYC, the ABDM health information exchange and the MeitY online gaming rules. **Money, trade and sanctions Regulator bundle**: Money-laundering, foreign exchange and sanctions rules. FIU-IND suspicious transaction reporting, FEMA, FCRA, DGFT, STPI and SEZ, PNGRB and sanctions screening. ## Main DPDP obligations start in May 2027. [Check how ready you are](https://foctta.com/readiness) [Book a demo](https://foctta.com/company) ======== # Industry packs for DPDP compliance - banking, insurance, healthcare and more | FOCTTA > 181 industry packs with the purposes, data elements and clauses Indian sectors actually use, across 60 industries. Web page: https://foctta.com/industries This Markdown copy has the same content as the web page. Built 2026-10-14. --- Industries # Start from your sector's real purposes, not a blank form. FOCTTA comes with 181 ready-made industry packs: the data elements, purposes and clauses Indian sectors actually use, ready to drop into consent profiles, ROPA and DPIAs . Industry packs Data elements Purposes Clauses **Banks, lenders and fintech RBI 6h, DAKSH**: Ready consent purposes for lending, credit checks and co-lending. Digital lending, account aggregator, credit bureau pulls and co-lending purposes, with RBI clocks and BFSI identity floors. RBI 6h, DAKSH Co-lending Account aggregator **Insurance IRDAI 6h copy**: Policyholder consent, retention reasons and the 6-hour incident report. Policyholder consent, IRDAI record-retention reasons and the 6-hour CERT-In report, copied to IRDAI. IRDAI 6h copy Retention **Capital markets SEBI CSCRF**: Six-hour incident notices and a signed evidence pack. SEBI CSCRF 6-hour incident notice and a signed CSCRF evidence pack with FOCTTA Discovery (DSPM). SEBI CSCRF Evidence pack **Healthcare, healthtech and pharma DPIA**: Health data purposes, with impact assessments required where they apply. Health data purposes and elements, with DPIAs made mandatory where they apply. Health data DPIA **Telecom CERT-In 6h**: Subscriber data and telecom add-ons, with cyber incident reporting. Subscriber data and sector overlays, with CERT-In reporting. CERT-In 6h Overlays **E-commerce and social Third Schedule**: Erase inactive users' data after a 48-hour notice; banners in 23 languages. Third Schedule inactivity erasure with the 48-hour notice, and banners in 23 languages. Third Schedule 23 languages **Media, streaming and broadcasting OTT**: Sector packs for broadcasting, streaming, print and radio. Broadcasting, OTT, print and radio overlays, with TRAI, BARC and MIB data elements. OTT Broadcasting **Education, edtech and gaming DPDP S.9**: Children's data first: guardian details and child-directed banners. Children's data first: child-directed banners, guardian details and the MeitY online gaming bundle. Section 9 Gaming bundle And many more ## 60 industries, each with its own pack. Oil and gas to online gaming, housing societies to maritime. Each pack brings the purposes, data elements and clauses of that sector. Scheduled commercial banks NBFCs NBFC-MFIs and microfinance Cooperatives Housing finance companies Fintech and payments Payment aggregators and gateways Brokerage and securities Insurance TPAs for health insurance Crypto and VDAs Accounting and tax Healthcare Healthtech and digital health Pharma and clinical research Telecom Cloud and data centres Cybersecurity Software resellers Adtech and martech Social media and UGC Media and entertainment Gaming and esports Sports and fitness E-commerce Retail and FMCG Food and quick commerce Travel and OTAs Aviation and airlines Maritime and shipping Logistics and supply chain Automotive and mobility Manufacturing Aerospace and defence Construction and infrastructure Real estate and proptech Housing societies Gated community apps Coworking and facilities Energy and utilities Electricity generation Electricity transmission Electricity distribution Oil and gas upstream Oil and gas midstream Oil and gas downstream Mining and natural resources Agriculture and agritech Education Edtech and online learning Recruitment and HR tech Staffing and gig economy Consulting and advisory Legal and professional services Events and weddings Blockchain and Web3 Government NGOs and non-profits MSMEs Personal data vaults Show all 60 industries ## See your sector's pack on a live demo. [Book a demo](https://foctta.com/company) ======== # Developers - consent APIs, webhooks and SDKs | FOCTTA > REST APIs for consent checks and rights requests, signed webhooks, and SDKs for web, Android and iOS. Web page: https://foctta.com/developers This Markdown copy has the same content as the web page. Built 2026-10-14. --- Developers # Ask "may I?" from any system. Get the answer that is true right now. A consent check API, signed webhooks, a change feed for firewalled networks, and SDKs for web, Android and iOS. See what the API does [Request sandbox access](https://foctta.com/company) consent-check.sh POST /v1/consents/check { "dataPrincipalId": "p\_8a3f…c7d2",   "purpose": "marketing",   "businessUnit": "retail" } 200 OK { "hasConsent": false,   "reason": "withdrawn",   "noticeVersion": 4 } **10,000 Consent checks a minute** Up to 10,000 calls a minute per organisation. **346 Webhook event types** Signed to the Standard Webhooks spec, 6 delivery attempts, a delivery log and per-unit subscriptions. **3.1 OpenAPI reference** An OpenAPI 3.1 reference, an AsyncAPI contract and a Postman collection per organisation. **30 Day event stream** A cursor change feed and a 30-day event stream, for networks that block inbound webhooks. **Beta 23 Languages in the mobile SDKs** Native Android and iOS: banner, preference centre and rights portal, with an offline queue. **Beta 5 Databases the Receiver writes to** PostgreSQL, MySQL or MariaDB, SQL Server, Oracle and MongoDB. **Pilot 443 Outbound-only edge agents** Consent mirroring and rights jobs over outbound HTTPS (port 443), with signed jobs. Private release JS Web and Node SDK Check and grant consent from your web or Node.js code. **v2 Google Consent Mode** Default-denied state and updates, including ad_user_data and ad_personalization. ## A sandbox with live widgets and signed test webhooks. [Request sandbox access](https://foctta.com/company) ======== # About FOCTTA and book a demo - made in India, for India > FOCTTA is designed, built and hosted in India. Book a demo and get a free DPDP gap assessment. Web page: https://foctta.com/company This Markdown copy has the same content as the web page. Built 2026-10-14. --- Made in India, for India # We build privacy software for the country that wrote the DPDP Act . FOCTTA is designed, built and hosted in India. We started from the Act and the Rules, section by section, and from the way Indian groups of companies actually run. Then we made it ready for GDPR and CCPA too. हिन्दी বাংলা తెలుగు मराठी தமிழ் اردو ગુજરાતી ಕನ್ನಡ ଓଡ଼ିଆ മലയാളം ਪੰਜਾਬੀ অসমীয়া हिन्दी বাংলা తెలుగు मराठी தமிழ் اردو ગુજરાતી ಕನ್ನಡ ଓଡ଼ିଆ മലയാളം ਪੰਜਾਬੀ অসমীয়া मैथिली संस्कृतम् कोंकणी नेपाली सिन्धी डोगरी कॉशुर ꯃꯩꯇꯩꯂꯣꯟ बड़ो ᱥᱟᱱᱛᱟᱲᱤ English हिन्दी मैथिली संस्कृतम् कोंकणी नेपाली सिन्धी डोगरी कॉशुर ꯃꯩꯇꯩꯂꯣꯟ बड़ो ᱥᱟᱱᱛᱟᱲᱤ English हिन्दी **Control**: You stay in charge of every decision. Clear hierarchy and information architecture make that possible. **Trust**: It behaves the same in every room. A consistent, professional product. **Transparency**: We show what we store about you. Table by table, and what each claim rests on. **Accountability**: Every action leaves a receipt. And every status is clear at a glance. Contact and demos ## Talk to a person, the way you prefer. Call, write or book a walkthrough. We reply within 24 hours. [Email **support@foctta.com** We reply within 24 hours.](mailto:support@foctta.com) [Call us **+91 98051 89051** Talk to the team directly.](tel:+919805189051) Privacy and DPO dpo@foctta.com Questions about your own personal data. (mailto:dpo@foctta.com) What happens next 01 **We reply within 24 hours** A person confirms a time that suits you. 02 **A 30-minute walkthrough** On your sector's industry pack, across the products you picked. 03 **A plan for your data** A pilot hosted in India, or on your own server. **Free with every demo The FOCTTA DPDP gap assessment Try the 3-minute readiness check first** A curated form your team can use internally, covering the DPDP Act and Rules, with the evidence to look for. (Form on the web page: https://foctta.com/company#contact) ======== # DPDP readiness check - a free 3-minute self-assessment | FOCTTA > Answer a few questions and see how ready your organisation is for the DPDP Act and Rules 2025, with the next steps that matter most. Web page: https://foctta.com/readiness This Markdown copy has the same content as the web page. Built 2026-10-14. --- Free # How ready are you for May 2027? Most duties under India's DPDP Act apply from May 2027. This quick self-check gives you a score, your gaps by section, and which part of FOCTTA closes each one. 12 questions About 3 minutes No sign-up to see your result Question 1 of 12 · S.5 Notice ## Do you give an itemised notice, in the person's language, before or with every consent request? **Why we ask:** It should say what you collect, why, how to withdraw and how to complain to the Board. Yes Partly Not yet Back A self-check, not legal advice. Live score **0%** 0 of 12 answered Want the full picture? **Book a demo and get our curated DPDP gap assessment, free.** A detailed form your team can use internally, section by section, with the evidence to look for. [Book a demo](https://foctta.com/company) ======== # DPDP Act basics, in plain English | FOCTTA > India's Digital Personal Data Protection Act and Rules 2025 in two minutes: who it covers, the key dates, your core duties, breach deadlines and penalties. Web page: https://foctta.com/dpdp-basics This Markdown copy has the same content as the web page. Built 2026-10-14. --- New to DPDP? # India's data protection law, in two minutes. The **Digital Personal Data Protection Act, 2023** (the DPDP Act) and its **Rules 2025** decide how organisations may collect and use personal data about people in India, and what rights those people have. A plain-English summary, checked on 28 September 2026. It is not legal advice. ## Who is who Four roles appear everywhere in the law. **Data Fiduciary** Your organisation, when it decides why and how personal data is used. Most duties fall here. **Data Principal** The person the data is about: a customer, an employee, a user. For a child, the parent too. **Data Processor** A vendor that handles data for you, such as a cloud, payroll or call-centre provider. **Data Protection Board** The regulator that hears complaints, looks into breaches and imposes penalties. ## The key dates The law is passed; most duties start in May 2027. 1. Aug 2023 **The Act is passed** The Digital Personal Data Protection Act, 2023 becomes law. 2. 13 Nov 2025 **The Rules are notified** The DPDP Rules 2025 are published. The Board provisions apply at once. 3. Nov 2026 **Consent Managers** Registration of Consent Managers with the Board applies, 12 months after the Rules. 4. May 2027 **Most duties apply** Notice, consent, security, breach notice, rights and erasure: 18 months after the Rules. ## What you must do Six duties cover most of the Act. The section numbers are for your legal team. **Tell people, then ask** A clear notice of what you collect and why, then consent that is free, specific and easy to withdraw. DPDP S.5, S.6 **Keep it safe** Reasonable security safeguards, including over your vendors, to prevent a breach. DPDP S.8(5) **Report breaches** Tell affected people and the Board without delay, and send the Board a full report within 72 hours. DPDP S.8(6), Rule 7 **Erase when done** Delete data once its purpose is served or consent is withdrawn, unless a law says keep it. DPDP S.8(7), Rule 8 **Answer requests** Let people see, correct and erase their data, name a nominee, and complain to you first. DPDP S.11 to S.14 **Protect children** Verifiable parental consent for a child's data, and no tracking or targeted ads at children. DPDP S.9, Rule 10 **Large data holders do more** An organisation named a **Significant Data Fiduciary** needs a DPO based in India, an independent auditor, and a yearly DPIA and audit. **Breach deadlines** DPDP: tell people and the Board **without delay**, full report in **72 hours**. Sector rules (CERT-In, RBI, SEBI, IRDAI): a first report in **6 hours**. **Penalties** Up to **Rs 250 crore** for weak security, and up to **Rs 200 crore** for an unreported breach or children's-data failures. ## Questions people ask Short answers; the glossary explains every term. Does the DPDP Act apply to my company? Yes, if you process digital personal data in India, or data collected offline and then digitised. It also applies to companies outside India that offer goods or services to people in India. Purely personal or household use is outside it. When do I have to comply? Most duties apply from May 2027, 18 months after the Rules were notified on 13 November 2025. The Board provisions already apply, and Consent Manager registration applies from November 2026. Building notices, consent records and breach processes takes months, so most organisations start now. What are the penalties? The Act sets penalties per breach of duty, imposed by the Data Protection Board after an inquiry: up to Rs 250 crore for failing to keep reasonable security safeguards, and up to Rs 200 crore for failing to report a breach or for breaching the duties on children's data. What is a Significant Data Fiduciary? An organisation the government names for extra duties because of the volume or sensitivity of the data it handles, or the risk to people. It must appoint a Data Protection Officer based in India and an independent data auditor, and run a DPIA and an audit every year. Is FOCTTA a Consent Manager? No. A Consent Manager is a company registered with the Data Protection Board to manage people's consents on their behalf. FOCTTA is software that your organisation uses to collect, record and prove consent and to run the rest of its DPDP programme. How does this sit with RBI, SEBI or IRDAI rules? Sector rules still apply alongside DPDP. Most sector cyber rules require a first incident report within 6 hours: to CERT-In, to RBI on its DAKSH portal, to SEBI, and for insurers to CERT-In with a copy to IRDAI. FOCTTA tracks these clocks next to the DPDP ones. Read the law itself: the official Gazette texts The DPDP Act 2023, the DPDP Rules 2025 and the notifications and corrigenda, as published by the Government of India, with a short guide to reading them. PDF, 72 pages, 7.3 MB. Download the free pack ↓ (https://foctta.com/downloads/foctta-dpdp-gazette-pack.pdf) ## Where FOCTTA helps Start with the duty that worries you most. FOCTTA Consent Notices, consent receipts, rights requests, breach clocks and DPIAs. See Consent → (https://foctta.com/consent) FOCTTA Discovery (DSPM) Find where personal data sits, so you know what to protect and erase. See Discovery (DSPM) → (https://foctta.com/discovery) FOCTTA TPRM Check the vendors who handle your data, a duty the Act puts on you. See TPRM → (https://foctta.com/tprm) Ready for the detail? [Take the free 12-lesson DPDP course](https://foctta.com/learn), clause by clause, with a short quiz after each lesson, and a free certificate to share on LinkedIn, X or anywhere when you pass the final assessment. Every term on this page is in the [glossary](https://foctta.com/glossary). For the law section by section, see [Regulations](https://foctta.com/regulations), or [check how ready you are](https://foctta.com/readiness) in three minutes. ======== # Learn the DPDP Act, free: 12 short lessons | FOCTTA > A free course on India's Digital Personal Data Protection Act, 2023 and the DPDP Rules 2025: 12 short lessons with quizzes, no sign-up. Web page: https://foctta.com/learn This Markdown copy has the same content as the web page. Built 2026-10-14. --- Free DPDP course # Learn India's DPDP Act, clause by clause 12 short lessons on the **Digital Personal Data Protection Act, 2023** and the **DPDP Rules 2025**, each with a quiz. Free, and no sign-up. Pass the final assessment and get a certificate in your name to share on LinkedIn, X or anywhere you like. - 12 lessons - About 70 minutes - 58 quiz questions - Free certificate [Start here: lesson 1](https://foctta.com/learn/what-the-act-covers) [Open the dictionary](https://foctta.com/glossary) Checked against the official texts on 28 September 2026. A plain-English course, not legal advice. ## How this course works Three steps, repeated for each lesson. 1. Step 1 **Read a short lesson** Five to eight minutes, built from the Act and the Rules. 2. Step 2 **Practise with a quiz** Every answer shows why, with the section it comes from. 3. Step 3 **Keep going** Your progress stays in this browser. No sign-up, no email. ## The learning path Twelve lessons in order, from what the Act covers to getting ready. 1. Lesson 1: What the DPDP Act covers Which data and organisations the Act covers, and what it leaves out. 5 min 5 questions Not started (https://foctta.com/learn/what-the-act-covers) 2. Lesson 2: Who is who in the law Fiduciary, Principal, Processor, Consent Manager and the Board. 4 min 5 questions Not started (https://foctta.com/learn/the-roles) 3. Lesson 3: Consent and legitimate uses When you may process data: consent or a listed legitimate use. 5 min 5 questions Not started (https://foctta.com/learn/lawful-grounds) 4. Lesson 4: The notice before consent The notice you must give before or with every consent request. 5 min 5 questions Not started (https://foctta.com/learn/notice) 5. Lesson 5: Consent in detail, Consent Managers Valid consent, withdrawal, proving consent, and registered Consent Managers. 7 min 5 questions Not started (https://foctta.com/learn/consent-and-consent-managers) 6. Lesson 6: Duties of a Data Fiduciary Security, breach notices, erasure, a published contact and grievances. 8 min 5 questions Not started (https://foctta.com/learn/fiduciary-duties) 7. Lesson 7: Children and persons with disability Parent or guardian consent, and limits on tracking and ads. 6 min 5 questions Not started (https://foctta.com/learn/children-and-disability) 8. Lesson 8: Significant Data Fiduciaries Extra duties: a data protection officer in India, audits, impact assessments. 5 min 4 questions Not started (https://foctta.com/learn/significant-data-fiduciaries) 9. Lesson 9: Rights and duties of people Four rights, how requests and grievances work, and people's duties. 6 min 5 questions Not started (https://foctta.com/learn/rights-and-duties) 10. Lesson 10: Sending data outside India When data may go abroad, and the conditions that can apply. 4 min 4 questions Not started (https://foctta.com/learn/cross-border) 11. Lesson 11: Board, penalties and appeals Who sits on the Board, inquiries, penalty caps and appeals. 8 min 5 questions Not started (https://foctta.com/learn/board-penalties-appeals) 12. Lesson 12: Timelines and getting ready When each part starts, and how sector clocks run alongside. 7 min 5 questions Not started (https://foctta.com/learn/timelines-and-readiness) ## Review what you have learned Recalling an answer helps it stick better than reading it again. Five questions drawn at random from the lessons you have finished. Nothing is scored against your lessons. Start a 5-question review Finish any lesson's quiz to unlock review. Clear my progress (it is kept only in this browser) ## Get your certificate Finished the lessons? Pass a 20-question final assessment (pass mark 80%). At the end you get a certificate in your name, with your score and the date. Add it to your LinkedIn profile, post it on LinkedIn, X or WhatsApp in one click, or download the PDF and publish it anywhere you like. Anyone can check it is genuine from its QR code. [Take the final assessment](https://foctta.com/learn/certificate) ![Sample FOCTTA certificate: Certificate of Completion, DPDP Act Foundations, with the learner's name, score, date, QR code and the FOCTTA seal](https://foctta.com/learn/certificate-sample.jpg) Sample certificate. Yours carries your name, score, date and its own ID. ## Keep learning Free references to use alongside the lessons. DPDP dictionary Every term in the course, A to Z, in one plain sentence. Open the dictionary → (https://foctta.com/glossary) DPDP basics The whole law in two minutes, for first-time readers. Read the basics → (https://foctta.com/dpdp-basics) The official Gazette pack The Act, the Rules and the notifications, as published. PDF, 72 pages, 7.3 MB Download the free PDF ↓ (https://foctta.com/downloads/foctta-dpdp-gazette-pack.pdf) A plain-English summary of the DPDP Act 2023 and DPDP Rules 2025, checked on 28 September 2026. It is not legal advice. For advice on your own situation, speak to a lawyer. For how FOCTTA helps with these duties, see [FOCTTA Consent](https://foctta.com/consent) or [check how ready you are](https://foctta.com/readiness). ======== # DPDP course certificate: final assessment | FOCTTA > Pass the final assessment of FOCTTA's free DPDP course and get a certificate you can check, download and add to LinkedIn. Web page: https://foctta.com/learn/certificate This Markdown copy has the same content as the web page. Built 2026-10-14. --- Free DPDP course # Your DPDP Act Foundations certificate Finish the 12 lessons, then pass a 20-question final assessment. Your certificate shows your name, score and date. Publish it anywhere: add it to your LinkedIn profile, post it on LinkedIn, X or WhatsApp, or download the PDF. Anyone can check it is genuine. - 20 questions - Pass mark 80% - Free Verified FOCTTA certificate This certificate is not valid Awarded to Course Score Awarded on Credential ID Post your certificate on LinkedIn Add to LinkedIn profile Share on X Share on WhatsApp Copy link Download image Download PDF **To show your certificate in a LinkedIn post,** use "Post your certificate on LinkedIn", or download the image and add it to your post. The post LinkedIn offers after "Add to LinkedIn profile" always uses LinkedIn's own picture. A certificate of completion for FOCTTA's free course and final assessment (pass mark 80%). It is not a professional accreditation. "Add to LinkedIn profile" puts it under Licences & certifications with FOCTTA as the issuer; on your profile you can also add the image to it as media. Check this certificate at its verification page. [Take the free DPDP course yourself](https://foctta.com/learn) ![Sample FOCTTA certificate: Certificate of Completion, DPDP Act Foundations, with the learner's name, score, date, QR code and the FOCTTA seal](https://foctta.com/learn/certificate-sample.jpg) Sample certificate. Yours carries your name, score, date and its own ID. ## Finish the lessons first 1. [1\. What the DPDP Act covers](https://foctta.com/learn/what-the-act-covers) 2. [2\. Who is who in the law](https://foctta.com/learn/the-roles) 3. [3\. Consent and legitimate uses](https://foctta.com/learn/lawful-grounds) 4. [4\. The notice before consent](https://foctta.com/learn/notice) 5. [5\. Consent in detail, Consent Managers](https://foctta.com/learn/consent-and-consent-managers) 6. [6\. Duties of a Data Fiduciary](https://foctta.com/learn/fiduciary-duties) 7. [7\. Children and persons with disability](https://foctta.com/learn/children-and-disability) 8. [8\. Significant Data Fiduciaries](https://foctta.com/learn/significant-data-fiduciaries) 9. [9\. Rights and duties of people](https://foctta.com/learn/rights-and-duties) 10. [10\. Sending data outside India](https://foctta.com/learn/cross-border) 11. [11\. Board, penalties and appeals](https://foctta.com/learn/board-penalties-appeals) 12. [12\. Timelines and getting ready](https://foctta.com/learn/timelines-and-readiness) Progress is kept in this browser only. Studied on another device? Go to the assessment anyway (Form on the web page: https://foctta.com/company#contact) (Form on the web page: https://foctta.com/company#contact) (Form on the web page: https://foctta.com/company#contact) ======== # DPDP dictionary: glossary of data protection terms, A to Z | FOCTTA > Plain-English definitions of 98 terms from India's DPDP Act and Rules and from across foctta.com: roles, rights, breach deadlines, regulators and security products, with their sources. Web page: https://foctta.com/glossary This Markdown copy has the same content as the web page. Built 2026-10-14. --- Glossary # The DPDP dictionary, A to Z 98 terms from the law, the [free course](https://foctta.com/learn) and this site, each in one plain sentence. New to the law itself? Start with [DPDP basics](https://foctta.com/dpdp-basics). (Form on the web page: https://foctta.com/company#contact) A B C D E F G I L M N O P R S T U V W ## A **Adult (Rule 10)** An adult is an individual who has completed eighteen years, when checking a parent under Rule 10. Consent and rights Rules r.10(2)(a) **Appellate Tribunal** Telecom Disputes Settlement and Appellate Tribunal (TDSAT) The Appellate Tribunal is TDSAT, which hears appeals against orders of the Data Protection Board. The law Act s.2(a), s.29 **Authorised entity (Rule 10)** An authorised entity is a body entrusted by law or government to issue identity and age details or tokens. Consent and rights Rules r.10(2)(b) **Automated** Automated is any digital process that can run automatically on instructions, for processing data. The law Act s.2(b) ## B **BFSI** Banking, financial services and insurance The industry group of banks, lenders, brokers and insurers, regulated by RBI, SEBI and IRDAI. Programme **Blocking direction (S.37)** A blocking direction is a Government order to block public access to a Fiduciary penalised in two or more cases. The law Act s.37 **Board inquiry (S.28)** A Board inquiry is the Board's investigation of a breach, run on natural justice and due within six months. The law Act s.28, Rules r.19(9) **Breach notice (Rule 7)** After a personal data breach: tell affected people and the Board without delay, then send the Board a report within 72 hours. Breach and security ## C **CCPA and CPRA** California Consumer Privacy Act and Privacy Rights Act California's privacy laws, giving consumers there rights over the personal data businesses hold. The law **CERT-In** Indian Computer Emergency Response Team India's national cyber-security agency. Most cyber incidents must be reported to it within 6 hours. Breach and security **Certain legitimate uses (S.7)** Certain legitimate uses is the Act's term for the nine section 7 purposes that need no fresh consent. Consent and rights Act s.2(d), s.7 **Chairperson** Chairperson of the Data Protection Board The Chairperson is the head of the Data Protection Board, with general superintendence of its administration. The law Act s.2(e), s.26 **Child** A child is an individual who has not completed the age of eighteen years. Consent and rights Act s.2(f) **Children's data (S.9)** Processing a child's data needs verifiable parental consent, and tracking or targeted ads at children are not allowed. Consent and rights **CMDB** Configuration Management Database IT's register of servers, databases and applications, with their owners. Often kept in ServiceNow. Security products **Commencement** Commencement is the date a provision comes into force; DPDP provisions start in three stages. The law Act s.1(2), Rules r.1 **Consent Manager** A company registered with the Data Protection Board to manage people's consents. A registered legal role, not a software category. The law **Correction and erasure (S.12)** People can ask you to correct, complete, update or erase their personal data. Consent and rights **Cross-border transfer (S.16)** Cross-border transfer is sending personal data abroad; allowed unless the Government restricts a notified country. The law Act s.16(1) ## D **DAKSH** RBI's supervisory portal. Under RBI's 2026 cyber Directions, regulated entities report cyber incidents on it within 6 hours. Breach and security **DAM** Database Activity Monitoring Software that watches who reads or changes data in databases, and flags unusual activity. Security products **Data** Data is information, facts, concepts, opinions or instructions in a form people or machines can communicate or process. The law Act s.2(h) **Data Fiduciary** The organisation that decides why and how personal data is used. Most DPDP duties fall on it. The law **Data Principal** The person the data is about: a customer, employee or user. For a child, the parent also acts. The law **Data Processor** A vendor that handles personal data on a Data Fiduciary's behalf, such as a cloud or payroll provider. The law **Data Protection Board** Data Protection Board of India The regulator that hears DPDP complaints, investigates breaches and imposes penalties. The law **DDR** Data Detection and Response Software that checks each data request as it happens and allows, masks or blocks it, then responds to threats. Security products **Digital Locker service provider** A Digital Locker service provider is a notified intermediary through which identity and age details can be verified. Consent and rights Rules r.10(2)(c) **Digital office** A digital office is one that runs proceedings online, from receiving a complaint or appeal to deciding it. The law Act s.2(m) **Digital personal data** Digital personal data is personal data in digital form, the only kind the Act covers. The law Act s.2(n), s.3 **DPA** Data Processing Agreement The contract that sets how a vendor may handle your personal data, and what happens when it ends. Programme **DPDP Act** Digital Personal Data Protection Act, 2023 India's law on how organisations collect and use personal data, and the rights people have over it. The law **DPDP Rules 2025** Digital Personal Data Protection Rules, 2025 The rules that put the DPDP Act into practice. Notified on 13 November 2025; most duties apply from May 2027. The law **DPIA** Data Protection Impact Assessment A structured check of the privacy risks of a system or process before and while you run it. Programme **DPO** Data Protection Officer The person who answers for data protection. A Significant Data Fiduciary must appoint one based in India. Programme **DSAR** Data Subject (Principal) Access Request A request from a person to see, correct or erase their data. Under DPDP these are rights requests. Programme **DSPM** Data Security Posture Management Software that finds where personal and sensitive data lives, and shows who can reach it and how exposed it is. Security products **Duty of a Data Principal (S.15)** A Data Principal's duty is to obey laws, not impersonate, not file false complaints and give authentic information. Consent and rights Act s.15 ## E **E-commerce entity** An e-commerce entity is anyone running an e-commerce platform under the Consumer Protection Act, excluding marketplace sellers. Programme Rules Third Schedule note (a) **EDR** Endpoint Detection and Response Security software on laptops and servers that spots and stops threats on each machine. Security products **Eighth Schedule languages** An Eighth Schedule language is one listed in the Constitution's Eighth Schedule; notices and consent requests must offer them. Consent and rights Act s.5(3), s.6(3) **Erasure (S.8(7))** Personal data must be erased once its purpose is served or consent is withdrawn, unless a law requires keeping it. Consent and rights **Exemptions (S.17)** An exemption is a case where most DPDP duties do not apply, such as legal claims or preventing offences. The law Act s.17 ## F **First Schedule (Consent Managers)** The First Schedule is the Rules' list of Consent Manager registration conditions (Part A) and obligations (Part B). The law Rules r.4 **Fourth Schedule** The Fourth Schedule is the list of who and what is exempt from verifiable parental consent and the tracking ban. Consent and rights Rules r.12 ## G **G.S.R.** General Statutory Rules G.S.R. is the Gazette numbering series for rules and notifications, such as G.S.R. 846(E) for the Rules. The law **Gain** Gain is a gain in property or services, or a chance to earn more, beyond legitimate remuneration. The law Act s.2(o) **GDPR** General Data Protection Regulation The European Union's data protection law. It applies when you handle personal data of people in the EU. The law **Grievance (S.13)** A complaint to you first. The Rules give you up to 90 days to resolve it; then people can go to the Board. Consent and rights ## I **Identifier (Rule 14(5))** An identifier is a code the Fiduciary issues to identify a person, such as a customer ID or mobile number. Consent and rights Rules r.14(5) **Incapacity (S.14)** Incapacity is inability to exercise DPDP rights due to unsoundness of mind or infirmity of body. Consent and rights Act s.14(2) **Independent data auditor** An independent data auditor is the auditor a Significant Data Fiduciary appoints to evaluate its DPDP compliance. Programme Act s.10(2)(b) **IRDAI** Insurance Regulatory and Development Authority of India The insurance regulator. Insurers report cyber incidents to CERT-In within 6 hours and copy IRDAI. Breach and security ## L **Lawful guardian (Rule 11)** A lawful guardian is a guardian appointed by a court, designated authority or local level committee. Consent and rights Act s.9(1), Rules r.11 **Lawful purpose (S.4)** A lawful purpose is any purpose not expressly forbidden by law. Consent and rights Act s.4(2) **Loss** Loss is a loss of property or interrupted services, or a lost chance to earn remuneration or financial advantage. The law Act s.2(p) ## M **Mediation (S.31)** Mediation is the Board directing parties to settle a complaint through an agreed mediator. The law Act s.31 **Member** Member of the Data Protection Board A Member is a member of the Data Protection Board; the term includes the Chairperson. The law Act s.2(q) ## N **NBFC** Non-Banking Financial Company A lender or finance company regulated by RBI that is not a bank, such as a microfinance firm. Programme **Nomination (S.14)** A person can name someone to exercise their rights if they die or cannot act themselves. Consent and rights **Notification** A notification is a notice published in the Official Gazette; notify and notified follow from it. The law Act s.2(r) ## O **Official Gazette** Gazette of India The Official Gazette is the Government's official journal, where the Act, Rules and notifications are published. The law Act s.2(r) **One-year log retention** One-year log retention is the Rules' minimum period for keeping processing logs and security logs. Breach and security Rules r.6(1)(e), r.8(3) ## P **Person** A person, in the Act, is an individual, Hindu undivided family, company, firm, association, the State or juristic person. The law Act s.2(s) **Person with disability (Rule 11)** A person with disability, for Rule 11, is someone unable to take legally binding decisions despite adequate support. Consent and rights Rules r.11(2)(d) **Personal data** Personal data is any data about an individual who is identifiable by or in relation to that data. The law Act s.2(t) **Personal data breach** A personal data breach is unauthorised or accidental processing that compromises data's confidentiality, integrity or availability. Breach and security Act s.2(u) **PMLA** Prevention of Money-laundering Act, 2002 Requires financial firms to keep transaction and identity records for five years, which can override erasure. Programme **Prescribed** Prescribed is the Act's word for anything set out in rules made under it, such as the DPDP Rules 2025. The law Act s.2(v) **Privacy notice (S.5)** What you must tell people before asking consent: the data, the purpose, how to withdraw and how to complain. Consent and rights **Proceeding** A proceeding is any action the Data Protection Board takes under the Act. The law Act s.2(w) **Processing** Processing is any wholly or partly automated operation on digital personal data, from collection to erasure. The law Act s.2(x) **Proof of consent (S.6(10))** Proof of consent is the Fiduciary's duty to prove notice and consent if questioned in a proceeding. Consent and rights Act s.6(10) ## R **Right to access (S.11)** People can ask what data you hold about them, how it is used and who it was shared with. Consent and rights **ROPA** Record of Processing Activities A register of what personal data you process, why, where it goes and how long you keep it. Programme ## S **Schedule (penalties)** The Schedule is the Act's table of maximum penalties, from Rs 10,000 up to Rs 250 crore. Breach and security Act s.33, Schedule **SDF** Significant Data Fiduciary An organisation the government names for extra duties: an India-based DPO, a yearly DPIA and an independent audit. The law **Search-cum-Selection Committee** A Search-cum-Selection Committee is a panel that recommends people for appointment as Board Chairperson or Members. The law Rules r.17 **SEBI CSCRF** SEBI Cybersecurity and Cyber Resilience Framework SEBI's cyber rules for market entities: a 6-hour incident notice and a portal report within 24 hours. Breach and security **Second Schedule** The Second Schedule is the set of standards for State processing under section 7(b) and for research exemptions. The law Rules r.5, r.16 **Security duties (S.8(4), S.8(5))** Take the technical and organisational measures the Act needs, and reasonable safeguards to prevent a breach. Breach and security **Seventh Schedule** The Seventh Schedule is the list of purposes for which the Government may call for information from Fiduciaries. The law Rules r.23, r.8(3) **She** She is the pronoun the Act uses for any individual, irrespective of gender. The law Act s.2(y) **SIEM and SOAR** The security team's tools: SIEM collects and alerts on security events; SOAR runs automated responses. Security products **Specified purpose** The specified purpose is the purpose stated in the notice given to the Data Principal. Consent and rights Act s.2(za) **SSO and SCIM** SSO lets staff sign in with their company login; SCIM adds and removes their accounts automatically. Security products **Startup (S.17(3))** A startup is a recognised Indian private company, partnership or LLP that the Government may exempt from some duties. The law Act s.17(3) **State** The State is the State as defined in article 12 of the Constitution, including governments and their instrumentalities. The law Act s.2(zb) **Stop processing (S.6(6))** Once consent is withdrawn, you and your vendors must stop using that person's data within a reasonable time. Consent and rights ## T **Techno-legal measures** A techno-legal measure is a digital method the Board and Tribunal use so no one must attend in person. The law Rules r.2(1)(b), r.20 **Third Schedule** The Rules' list of large e-commerce, gaming and social platforms that must erase data of users inactive for three years. Consent and rights **TPRM** Third-Party Risk Management Checking vendors and partners who handle your data: tiering, questionnaires, scoring, contracts and exit. Security products ## U **User account** A user account is a person's online account with a Fiduciary, including profiles, handles, email and mobile number. Consent and rights Rules r.2(1)(c) ## V **Valid consent (S.6(1))** Valid consent is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. Consent and rights Act s.6(1) **Verifiable consent** Verifiable consent is consent of a parent or lawful guardian obtained and checked as Rules 10 and 11 require. Consent and rights Rules r.2(1)(d) **Virtual token** A virtual token is a digital stand-in mapped to real details, used for security or age checks. Breach and security Rules r.6(1)(a), r.10(1)(b) **Voluntary undertaking (S.32)** A voluntary undertaking is a promise accepted by the Board that bars proceedings on its contents. The law Act s.32 ## W **Withdrawal (S.6(4))** People can withdraw consent at any time, and it must be as easy as giving it. Consent and rights No term matches that search. Try a shorter word, or browse the letters above. Definitions are simplified for clarity and checked on 28 September 2026. They are not legal advice. For the law in order, take the [free 12-lesson course](https://foctta.com/learn). ======== # Lesson 11: Board, penalties and appeals | Learn DPDP | FOCTTA > The Data Protection Board: who sits on it, how inquiries run, the penalty caps in the Schedule, and how appeals work. Web page: https://foctta.com/learn/board-penalties-appeals This Markdown copy has the same content as the web page. Built 2026-10-14. --- 1. [Home](https://foctta.com/) 2. [Learn DPDP](https://foctta.com/learn) 3. Lesson 11 Lesson 11 of 12 · 8 min read # Board, penalties and appeals The Data Protection Board: who sits on it, how inquiries run, the penalty caps in the Schedule, and how appeals work. Jump to the quiz ## Where things stand - The Board was established on 13 November 2025 and its size fixed at four members. Sections 18 to 26 and Rules 17 to 21 apply now. Checked 28 Sep 2026 Source: G.S.R. 844(E); G.S.R. 845(E); G.S.R. 843(E) para (a); Rules r.1(2) - On 6 May 2026 MeitY invited applications for one Chairperson post and four Member posts. No appointment was confirmed from a primary source. LiveLaw reported on 1 August 2026 that none had been made (secondary source). Checked 28 Sep 2026 Source: MeitY F. No. 2(1)/2026-Pers.I, 6 May 2026; appointment not confirmed - The Board's powers to act on breaches and complaints, inquiries, penalties and appeals (sections 27 to 34, Rule 22) start around May 2027. Its power over Consent Manager registration breaches, section 27(1)(d), starts in November 2026. Checked 28 Sep 2026 Source: G.S.R. 843(E) paras (b) and (c); Rules r.1(4) ## The Board The Government established the Data Protection Board of India from 13 November 2025, with its head office in the National Capital Region, and fixed its size at four members. Members serve two years and can be reappointed. At least one must be an expert in law. Search-cum-selection committees recommend candidates: the Cabinet Secretary chairs the one for the Chairperson, and the MeitY Secretary the one for Members. The Chairperson's salary is Rs 4.5 lakh a month and a Member's Rs 4 lakh, without house or car. Sources: G.S.R. 844(E) G.S.R. 845(E) Act s.19 Act s.20(2) ## A digital office The Board works as a digital office. Receiving complaints, hearings and decisions are to be digital by design. It can use techno-legal measures so that no one needs to attend in person, while keeping its power to summon people and examine them on oath. Sources: Act s.28(1) Rules r.20 ## What the Board can act on The Board acts on a breach intimation from a Fiduciary, or a person's complaint about a breach or an unmet duty. It also acts on references from the Central or a State Government, and on court directions. Other triggers are complaints against Consent Managers, breaches of their registration conditions, and references about intermediaries ignoring blocking directions. It can direct urgent remedial measures after a breach. Sources: Act s.27 ## How an inquiry runs The Board first decides whether there are sufficient grounds. If not, it closes the matter with written reasons. If so, it inquires following natural justice, with civil court powers to summon, take evidence and inspect documents. It must not take equipment or bar premises in ways that disrupt day-to-day functioning. It can issue interim orders after a hearing. Rule 19(9) says an inquiry must finish within six months of receiving the matter, extendable by up to three months at a time with written reasons. The Board may warn or impose costs on a false or frivolous complainant. Sources: Act s.28 Rules r.19(9) ## Penalties If the Board finds a significant breach, it may impose a monetary penalty up to the Schedule's caps, after a hearing. It weighs the nature, gravity and duration of the breach, the data affected, repetition, and any gain made or loss avoided. It also weighs mitigation and its timeliness, proportionality, and the likely impact on the person. The caps are Rs 250 crore for security safeguards, Rs 200 crore for breach notice and Rs 200 crore for children's duties. Next come Rs 150 crore for SDF duties, Rs 10,000 for Data Principal duties, and Rs 50 crore for any other breach. Penalties go to the Consolidated Fund of India. The Government may amend the Schedule but cannot raise any penalty above twice its original amount. After penalties in two or more cases, the Board may advise, and the Government may order, blocking public access to a Fiduciary's platform in the public interest, after a hearing. Sources: Act s.33 Act s.34 Act Schedule Act s.42 Act s.37 ## Settling and appealing The Board may send a complaint to mediation, and may accept a voluntary undertaking at any stage of a proceeding. An accepted undertaking bars proceedings on its contents; breaking it is treated as a breach of the Act. Civil courts cannot hear matters the Board is empowered to decide. Anyone aggrieved by a Board order can appeal to the Appellate Tribunal, which is TDSAT, within 60 days; late appeals are allowed for sufficient cause. The Tribunal aims to decide within six months. Rule 22 makes filing digital, with a fee like that for TRAI Act appeals, payable by UPI. Sources: Act s.31 Act s.32 Act s.39 Act s.29 Rules r.22 ## Key points - The Board is a digital office with civil court powers. - Inquiries: six months, extendable by three months at a time. - Highest cap: Rs 250 crore for weak security safeguards. - Voluntary undertakings and mediation can settle matters. - Appeals go to TDSAT within 60 days. ## In practice A checklist for your organisation. - Keep evidence of safeguards and mitigation; the Board weighs both. - Prepare to receive and answer Board notices online. - Assign an owner for Board correspondence and deadlines. - Diary the 60-day appeal window from any Board order. ## Check what you learned 5 questions. Choose an answer to see why it is right. 0 of 5 answered 1. Question 1 of 5 ### Where does an appeal against a Board order go? - The Appellate Tribunal (TDSAT) - The Supreme Court directly - MeitY - The High Court Show the answer **A. The Appellate Tribunal (TDSAT)** Section 29(1) provides for appeal to the Appellate Tribunal, which section 2(a) defines as the Telecom Disputes Settlement and Appellate Tribunal. Act s.29(1), s.2(a) 2. Question 2 of 5 ### Within how many days must an appeal normally be filed? - 30 days - 60 days - 90 days - 120 days Show the answer **B. 60 days** Section 29(2) requires an appeal within sixty days from receipt of the order or direction; section 29(3) allows late appeals for sufficient cause. Act s.29(2) 3. Question 3 of 5 ### What is the penalty cap for breaching the additional duties on children? - Rs 50 crore - Rs 150 crore - Rs 200 crore - Rs 250 crore Show the answer **C. Rs 200 crore** Item 3 of the Schedule: breach of the additional obligations in relation to children under section 9 may attract up to two hundred crore rupees. Act Schedule item 3 4. Question 4 of 5 ### What must the Board do before imposing a monetary penalty? - Nothing - Get court approval - Give the person an opportunity of being heard - Publish a draft order for comment Show the answer **C. Give the person an opportunity of being heard** Section 33(1) lets the Board impose a penalty for a significant breach only after giving the person an opportunity of being heard. Act s.33(1) 5. Question 5 of 5 ### Under Rule 19(9), within what period must a Board inquiry normally be completed? - Two years - 90 days - One year - Six months Show the answer **D. Six months** Rule 19(9) requires completion within six months of receiving the matter, extendable for reasons in writing by up to three months at a time. Rules r.19(9) Try again[Next lesson: Timelines and getting ready](https://foctta.com/learn/timelines-and-readiness) ## Official sources for this lesson - [The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) - [Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), MeitY, 13 November 2025 (with Schedules)](https://egazette.gov.in/WriteReadData/2025/267650.pdf) - [G.S.R. 843(E), 13 November 2025: dates on which provisions of the DPDP Act come into force](https://egazette.gov.in/WriteReadData/2025/267647.pdf) - [G.S.R. 844(E), 13 November 2025: establishment of the Data Protection Board of India](https://egazette.gov.in/WriteReadData/2025/267648.pdf) - [G.S.R. 845(E), 13 November 2025: the Board shall consist of four members](https://egazette.gov.in/WriteReadData/2025/267649.pdf) - [MeitY F. No. 2(1)/2026-Pers.I, 6 May 2026: appointment to the posts of Chairperson and Members, Data Protection Board of India](https://www.meity.gov.in/static/uploads/2026/05/cd481c027470b420b4cb85fb40a91c53.pdf) - [MeitY advertisement: filling up the posts of Chairman and Members in the Data Protection Board of India (2026)](https://www.meity.gov.in/static/uploads/2026/05/53b1bcf01cab9a0adde463e73fbc3417.pdf) A plain-English summary of the DPDP Act 2023 and DPDP Rules 2025, checked on 28 September 2026. It is not legal advice. Words in this lesson are explained in the [DPDP dictionary](https://foctta.com/glossary). [← Lesson 10 **Sending data outside India**](https://foctta.com/learn/cross-border) [Lesson 12 → **Timelines and getting ready**](https://foctta.com/learn/timelines-and-readiness) **In this lesson** 1. Where things stand 2. The Board 3. A digital office 4. What the Board can act on 5. How an inquiry runs 6. Penalties 7. Settling and appealing 8. Key points 9. In practice 10. Quiz Take the quiz ======== # Lesson 7: Children and persons with disability | Learn DPDP | FOCTTA > Extra protection for children under 18 and persons with disability: verifiable consent of a parent or guardian, and limits on tracking and ads. Web page: https://foctta.com/learn/children-and-disability This Markdown copy has the same content as the web page. Built 2026-10-14. --- 1. [Home](https://foctta.com/) 2. [Learn DPDP](https://foctta.com/learn) 3. Lesson 7 Lesson 7 of 12 · 6 min read # Children and persons with disability Extra protection for children under 18 and persons with disability: verifiable consent of a parent or guardian, and limits on tracking and ads. Jump to the quiz ## Where things stand - Not yet in force. Section 9 and Rules 10, 11 and 12 start eighteen months after 13 November 2025, around May 2027. Checked 28 Sep 2026 Source: G.S.R. 843(E) para (c); Rules r.1(4) - No notification under section 9(5), setting an exempt age for verifiably safe processing, was located. Checked 28 Sep 2026 Source: Search of eGazette and meity.gov.in, 28 Sep 2026: not confirmed ## Verifiable consent first The Fiduciary must obtain verifiable consent of the parent or lawful guardian before processing any personal data of a child. The same applies to a person with disability who has a lawful guardian. A child is anyone under 18. Rules 10 and 11 set how that consent is checked. Sources: Act s.9(1) Act s.2(f) Rules r.2(1)(d) ## Checking the parent (Rule 10) The Fiduciary must use appropriate technical and organisational measures and due diligence to check that the person claiming to be the parent is an identifiable adult, meaning 18 or over. It can rely on reliable identity and age details it already holds, or details the person provides voluntarily. Those details can come directly, or through a virtual token mapped to them and issued by an authorised entity. That entity may be a body entrusted by law or government, or a person it appoints. Details verified through a Digital Locker service provider also qualify. The Rules' examples cover parents who are existing users and parents new to the platform. Sources: Rules r.10 ## Checking a lawful guardian (Rule 11) For a person with disability, the Fiduciary must check that the guardian was appointed under the applicable guardianship law. The appointment may be by a court or by a designated authority under the Rights of Persons with Disabilities Act, 2016. It may also be by a local level committee under the National Trust Act, 1999. Sources: Rules r.11 ## What is never allowed A Fiduciary must not process data in a way likely to cause any detrimental effect on a child's well-being. It must not track or behaviourally monitor children, or target advertising at them. Breaching the additional duties on children can attract a penalty of up to Rs 200 crore. Sources: Act s.9(2) Act s.9(3) Act Schedule item 3 ## Exemptions (Rule 12, Fourth Schedule) Rule 12 lifts the verifiable consent duty and the tracking and advertising bar, but not the well-being duty, for listed cases. Part A lists classes, each for a limited purpose. They are clinical and mental health establishments and healthcare professionals, allied healthcare professionals, educational institutions, creches and day care centres, and school transport providers. Part B lists purposes: legal functions in a child's interest, State subsidies and benefits, and an email-only user account. It also covers tracking real-time location for safety, keeping harmful content and ads away from a child, and confirming a user is not a child. Each is limited to what is necessary. Sources: Act s.9(4) Rules r.12 Rules Fourth Schedule ## Key points - A child is anyone under 18. - Get verifiable consent from a parent or lawful guardian first. - Check the parent is an identifiable adult; tokens and Digital Locker help. - No tracking, behavioural monitoring or targeted ads at children. - Fourth Schedule exemptions never lift the well-being duty. ## In practice A checklist for your organisation. - Ask for age before creating any account. - Offer parents verification using held details or a Digital Locker token. - Switch off ad targeting and behavioural profiling for child accounts. - Record which Fourth Schedule exemption applies, if you rely on one. ## Check what you learned 5 questions. Choose an answer to see why it is right. 0 of 5 answered 1. Question 1 of 5 ### Whose consent is needed before a child's personal data is processed? - The school's - The child's own - The Board's - The parent or lawful guardian's, by verifiable consent Show the answer **D. The parent or lawful guardian's, by verifiable consent** Section 9(1) requires verifiable consent of the parent or lawful guardian before processing any personal data of a child. Act s.9(1) 2. Question 2 of 5 ### Under Rule 10, what must the Fiduciary check about the person who says she is the parent? - That she is an identifiable adult - Nothing - That she has a bank account - That she lives in the same city Show the answer **A. That she is an identifiable adult** Rule 10(1) requires due diligence to check that the individual identifying herself as the parent is an adult who is identifiable. Rules r.10(1) 3. Question 3 of 5 ### Which is prohibited under section 9(3)? - Targeted advertising directed at children - Showing a privacy notice - Answering a grievance - Sending a child's parent a receipt Show the answer **A. Targeted advertising directed at children** Section 9(3) bars tracking or behavioural monitoring of children and targeted advertising directed at children. Act s.9(3) 4. Question 4 of 5 ### A school monitors pupils' behaviour for its educational activities. What applies? - Part A of the Fourth Schedule exempts it from s.9(1) and s.9(3), limited to that purpose - It is always banned - It needs Board approval first - The Act does not apply to schools Show the answer **A. Part A of the Fourth Schedule exempts it from s.9(1) and s.9(3), limited to that purpose** Rule 12(1) and Fourth Schedule Part A item 3 lift s.9(1) and s.9(3) for educational institutions, restricted to tracking for educational activities or safety. Rules r.12, Fourth Schedule Part A 5. Question 5 of 5 ### Under Rule 11, who can appoint a lawful guardian of a person with disability? - A court, a designated authority or a local level committee - Any relative - A Consent Manager - The Data Fiduciary Show the answer **A. A court, a designated authority or a local level committee** Rule 11(1) requires checking that the guardian is appointed by a court of law, a designated authority or a local level committee. Rules r.11(1) Try again[Next lesson: Significant Data Fiduciaries](https://foctta.com/learn/significant-data-fiduciaries) ## Official sources for this lesson - [The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) - [Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), MeitY, 13 November 2025 (with Schedules)](https://egazette.gov.in/WriteReadData/2025/267650.pdf) - [G.S.R. 843(E), 13 November 2025: dates on which provisions of the DPDP Act come into force](https://egazette.gov.in/WriteReadData/2025/267647.pdf) A plain-English summary of the DPDP Act 2023 and DPDP Rules 2025, checked on 28 September 2026. It is not legal advice. Words in this lesson are explained in the [DPDP dictionary](https://foctta.com/glossary). [← Lesson 6 **Duties of a Data Fiduciary**](https://foctta.com/learn/fiduciary-duties) [Lesson 8 → **Significant Data Fiduciaries**](https://foctta.com/learn/significant-data-fiduciaries) **In this lesson** 1. Where things stand 2. Verifiable consent first 3. Checking the parent (Rule 10) 4. Checking a lawful guardian (Rule 11) 5. What is never allowed 6. Exemptions (Rule 12, Fourth Schedule) 7. Key points 8. In practice 9. Quiz Take the quiz ======== # Lesson 5: Consent in detail, Consent Managers | Learn DPDP | FOCTTA > The qualities of valid consent, withdrawal and its effects, who must prove consent, and how registered Consent Managers work. Web page: https://foctta.com/learn/consent-and-consent-managers This Markdown copy has the same content as the web page. Built 2026-10-14. --- 1. [Home](https://foctta.com/) 2. [Learn DPDP](https://foctta.com/learn) 3. Lesson 5 Lesson 5 of 12 · 7 min read # Consent in detail, Consent Managers The qualities of valid consent, withdrawal and its effects, who must prove consent, and how registered Consent Managers work. Jump to the quiz ## Where things stand - Not yet in force. Section 6(1) to (8) and (10) start eighteen months after 13 November 2025, around May 2027. Checked 28 Sep 2026 Source: G.S.R. 843(E) para (c) - Consent Manager registration (section 6(9) and Rule 4) starts one year after 13 November 2025, in November 2026. No one can be registered before then. Checked 28 Sep 2026 Source: G.S.R. 843(E) para (b); Rules r.1(3) - No Board registration process or list of registered Consent Managers was located. Rule 4(1) leaves the application particulars for the Board to publish. Checked 28 Sep 2026 Source: Search of meity.gov.in and eGazette, 28 Sep 2026: not confirmed ## The qualities of valid consent Consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action. It must be limited to the data needed for the specified purpose. In the Act's example, a telemedicine app cannot rely on consent to read the phone's contact list, because telemedicine does not need it. Sources: Act s.6(1) ## Invalid parts of consent Any part of a consent that infringes the Act, the Rules or another law is invalid to that extent. In the Act's example, an insurer asks a buyer to waive her right to complain to the Board. That part of the consent is invalid. Sources: Act s.6(2) ## Withdrawal and what follows Where consent is the basis, the person may withdraw at any time, and withdrawing must be as easy as giving. Withdrawal does not make earlier processing unlawful, and she bears its consequences: a shop may stop taking her new orders but must still deliver goods already paid for. After withdrawal, the Fiduciary must, within a reasonable time, stop processing and make its Processors stop too, unless the Act or another law requires or authorises processing without consent. It must also erase the data, unless a law requires it to be kept (lesson 6). Sources: Act s.6(4) Act s.6(5) Act s.6(6) Act s.8(7) ## Proving consent If consent is questioned in a proceeding, the Data Fiduciary must prove that it gave a notice and that consent was given in line with the Act and Rules. In practice this means keeping a record of each notice version and each consent event. Sources: Act s.6(10) ## Consent Managers A person may give, manage, review or withdraw consent through a Consent Manager. Under Rule 4, an applicant meeting Part A of the First Schedule applies to the Board. The Board may inquire, then register it and publish its details, or reject it with reasons. Part A conditions include being a company incorporated in India, with a net worth of at least Rs 2 crore and sound finances and management. It also needs independent certification that its interoperable platform meets the Board's standards. The Board may suspend or cancel a registration after a hearing. Part B duties include being unable to read the data it passes on, and keeping records of consents, notices and sharing for at least seven years. It must not sub-contract its obligations. It must act in a fiduciary capacity, avoid conflicts of interest, and get Board approval before any change of control. Sources: Act s.6(7) Act s.6(9) Rules r.4 Rules First Schedule ## Key points - Consent must be free, specific, informed, unconditional and unambiguous. - Invalid clauses fall away to the extent they break the law. - Withdrawing must be as easy as giving. - The Fiduciary carries the burden of proving notice and consent. - Consent Managers: Indian company, Rs 2 crore net worth, Board registration. ## In practice A checklist for your organisation. - Use unticked boxes or clear buttons; never assume consent from silence. - Put the withdraw option where the consent was first given. - Send withdrawal signals to every Processor and record the stop date. - Store each consent with the notice version the person saw. - Before relying on a Consent Manager, check the Board's published register. ## Check what you learned 5 questions. Choose an answer to see why it is right. 0 of 5 answered 1. Question 1 of 5 ### Which words describe valid consent in section 6(1)? - Verbal only - Free, specific, informed, unconditional and unambiguous - Written and notarised - Implied, general and bundled Show the answer **B. Free, specific, informed, unconditional and unambiguous** Section 6(1) requires consent to be free, specific, informed, unconditional and unambiguous with a clear affirmative action. Act s.6(1) 2. Question 2 of 5 ### An insurance consent form includes a waiver of the right to complain to the Board. What is the effect? - The waiver part is invalid - The Board must approve it - The whole consent is void - The waiver is valid if signed Show the answer **A. The waiver part is invalid** Section 6(2) makes the infringing part invalid; the Act's insurer illustration says the waiver of the right to complain is invalid. Act s.6(2) 3. Question 3 of 5 ### How easy must withdrawal of consent be? - Only possible through the Board - Comparable to the ease of giving consent - Only possible by letter - Harder than giving consent Show the answer **B. Comparable to the ease of giving consent** Section 6(4) requires the ease of withdrawing to be comparable to the ease with which consent was given. Act s.6(4) 4. Question 4 of 5 ### What minimum net worth must a Consent Manager applicant have? - Rs 50 lakh - Rs 2 crore - Rs 10 crore - Rs 100 crore Show the answer **B. Rs 2 crore** Part A of the First Schedule requires the applicant's net worth to be not less than two crore rupees. Rules First Schedule Part A item 4 5. Question 5 of 5 ### For how long, at minimum, must a Consent Manager keep its record of consents? - Ten years - Three years - Seven years - One year Show the answer **C. Seven years** Part B, item 4(c) of the First Schedule requires the record to be kept for at least seven years, or longer if agreed or required by law. Rules First Schedule Part B item 4(c) Try again[Next lesson: Duties of a Data Fiduciary](https://foctta.com/learn/fiduciary-duties) ## Official sources for this lesson - [The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) - [Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), MeitY, 13 November 2025 (with Schedules)](https://egazette.gov.in/WriteReadData/2025/267650.pdf) - [G.S.R. 843(E), 13 November 2025: dates on which provisions of the DPDP Act come into force](https://egazette.gov.in/WriteReadData/2025/267647.pdf) A plain-English summary of the DPDP Act 2023 and DPDP Rules 2025, checked on 28 September 2026. It is not legal advice. Words in this lesson are explained in the [DPDP dictionary](https://foctta.com/glossary). [← Lesson 4 **The notice before consent**](https://foctta.com/learn/notice) [Lesson 6 → **Duties of a Data Fiduciary**](https://foctta.com/learn/fiduciary-duties) **In this lesson** 1. Where things stand 2. The qualities of valid consent 3. Invalid parts of consent 4. Withdrawal and what follows 5. Proving consent 6. Consent Managers 7. Key points 8. In practice 9. Quiz Take the quiz ======== # Lesson 10: Sending data outside India | Learn DPDP | FOCTTA > Transfers abroad are allowed unless the Government restricts a country, with extra conditions possible under Rule 15 and for SDFs. Web page: https://foctta.com/learn/cross-border This Markdown copy has the same content as the web page. Built 2026-10-14. --- 1. [Home](https://foctta.com/) 2. [Learn DPDP](https://foctta.com/learn) 3. Lesson 10 Lesson 10 of 12 · 4 min read # Sending data outside India Transfers abroad are allowed unless the Government restricts a country, with extra conditions possible under Rule 15 and for SDFs. Jump to the quiz ## Where things stand - Not yet in force. Sections 16 and 17 and Rules 13 and 15 start eighteen months after 13 November 2025, around May 2027. Checked 28 Sep 2026 Source: G.S.R. 843(E) para (c); Rules r.1(4) - No country had been notified under section 16(1), and no Rule 15 order was located. Checked 28 Sep 2026 Source: Search of eGazette and meity.gov.in, 28 Sep 2026: not confirmed ## The default: allowed unless restricted Section 16(1) lets the Central Government, by notification, restrict transfers of personal data for processing to countries or territories it notifies. Section 16 does not itself bar transfers to places that are not notified, and the Act names no restricted country. Sources: Act s.16(1) ## Stricter sector laws still apply Section 16 does not weaken any other Indian law that gives higher protection, or restricts transfers more tightly, for any data, Fiduciary or class. So a sector rule that requires some data to stay in India continues to apply alongside DPDP. Sources: Act s.16(2) ## Rule 15: foreign State access Rule 15 allows transfers subject to requirements the Central Government may set by general or special order. Those requirements concern making personal data available to a foreign State, or to any person, entity or agency under a foreign State's control. The Rules do not themselves list those requirements. Sources: Rules r.15 ## SDFs and data localisation Rule 13(4) goes further for SDFs: personal data the Government specifies, on a committee's recommendation, and the traffic data about its flow, must not be transferred outside India. Which data is covered depends on that later specification. Sources: Rules r.13(4) ## Processing foreigners' data in India Most duties do not apply where a person in India processes personal data of people outside India under a contract with someone outside India, as in outsourcing. Security safeguards and overall responsibility still apply, as for every section 17(1) exemption. Sources: Act s.17(1)(d) ## Key points - Transfers abroad are allowed unless the Government restricts a country. - Stricter sector rules on transfers continue to apply. - Rule 15 allows Government orders on foreign State access. - SDFs may have to keep specified data in India. - Outsourced processing of foreigners' data is largely exempt. ## In practice A checklist for your organisation. - List every country where your data, or vendors' copies, are stored. - Check sector regulators' localisation rules for your data types. - Add a contract clause letting you move data if a country is restricted. - Watch the Gazette for section 16 and Rule 15 notifications. ## Check what you learned 4 questions. Choose an answer to see why it is right. 0 of 4 answered 1. Question 1 of 4 ### Under section 16, when is a transfer abroad restricted? - When the destination is a country or territory notified by the Central Government - Only for SDFs - Always - Never Show the answer **A. When the destination is a country or territory notified by the Central Government** Section 16(1) lets the Central Government, by notification, restrict transfers to such country or territory outside India as may be notified. Act s.16(1) 2. Question 2 of 4 ### A sector law requires some data to stay in India. Does section 16 override it? - Only for banks - No, stricter laws continue to apply - Yes - Only after five years Show the answer **B. No, stricter laws continue to apply** Section 16(2) keeps in place any law giving a higher degree of protection for, or restriction on, transfer of personal data outside India. Act s.16(2) 3. Question 3 of 4 ### What does Rule 13(4) require of a Significant Data Fiduciary? - Delete all foreign data - Nothing - Store all data abroad - Keep personal data specified by the Government, and its traffic data, inside India Show the answer **D. Keep personal data specified by the Government, and its traffic data, inside India** Rule 13(4) requires that personal data specified by the Government on a committee's recommendation, and its traffic data, is not transferred outside India. Rules r.13(4) 4. Question 4 of 4 ### An Indian firm processes data of people in Europe under a contract with a European company. Which provision applies? - Section 9 on children - The exemption in section 17(1)(d) - No exemption exists - Rule 10 Show the answer **B. The exemption in section 17(1)(d)** Section 17(1)(d) exempts processing of personal data of Data Principals outside India under a contract with a person outside India, except s.8(1) and s.8(5). Act s.17(1)(d) Try again[Next lesson: Board, penalties and appeals](https://foctta.com/learn/board-penalties-appeals) ## Official sources for this lesson - [The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) - [Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), MeitY, 13 November 2025 (with Schedules)](https://egazette.gov.in/WriteReadData/2025/267650.pdf) - [G.S.R. 843(E), 13 November 2025: dates on which provisions of the DPDP Act come into force](https://egazette.gov.in/WriteReadData/2025/267647.pdf) A plain-English summary of the DPDP Act 2023 and DPDP Rules 2025, checked on 28 September 2026. It is not legal advice. Words in this lesson are explained in the [DPDP dictionary](https://foctta.com/glossary). [← Lesson 9 **Rights and duties of people**](https://foctta.com/learn/rights-and-duties) [Lesson 11 → **Board, penalties and appeals**](https://foctta.com/learn/board-penalties-appeals) **In this lesson** 1. Where things stand 2. The default: allowed unless restricted 3. Stricter sector laws still apply 4. Rule 15: foreign State access 5. SDFs and data localisation 6. Processing foreigners' data in India 7. Key points 8. In practice 9. Quiz Take the quiz ======== # Lesson 6: Duties of a Data Fiduciary | Learn DPDP | FOCTTA > What every Data Fiduciary must do: accurate data, security safeguards, breach notices, erasure, a published contact and a grievance channel. Web page: https://foctta.com/learn/fiduciary-duties This Markdown copy has the same content as the web page. Built 2026-10-14. --- 1. [Home](https://foctta.com/) 2. [Learn DPDP](https://foctta.com/learn) 3. Lesson 6 Lesson 6 of 12 · 8 min read # Duties of a Data Fiduciary What every Data Fiduciary must do: accurate data, security safeguards, breach notices, erasure, a published contact and a grievance channel. Jump to the quiz ## Where things stand - Not yet in force. Section 8 and Rules 6, 7, 8 and 9 start eighteen months after 13 November 2025, around May 2027. Checked 28 Sep 2026 Source: G.S.R. 843(E) para (c); Rules r.1(4) ## Accountability and accuracy The Fiduciary is responsible for everything processed by it or for it, whatever a contract says. It must put appropriate technical and organisational measures in place. Where data will be used for a decision about the person, or shared with another Fiduciary, it must be complete, accurate and consistent. Sources: Act s.8(1) Act s.8(3) Act s.8(4) ## Security safeguards (Rule 6) Section 8(5) requires reasonable security safeguards to prevent a personal data breach, including over Processors. Rule 6 sets the minimum: encryption, obfuscation, masking or virtual tokens; access control; and logs, monitoring and review to detect and investigate unauthorised access. It also requires measures such as backups so processing can continue after a compromise. Logs and personal data needed to detect, investigate and recover from a compromise must be kept for one year, unless another law requires otherwise. Processor contracts must provide for security safeguards. Failing to take reasonable security safeguards carries the Act's highest penalty: up to Rs 250 crore. Sources: Act s.8(5) Rules r.6 Act Schedule item 1 ## Breach notice (Rule 7) A personal data breach is any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access, that compromises confidentiality, integrity or availability. On becoming aware of any breach, the Fiduciary must tell each affected person without delay, through her user account or registered contact details. The message must be concise, clear and plain. It covers what happened and when, the likely consequences for her, mitigation measures, steps she can take to protect herself, and a business contact who can answer her questions. The Board must be told without delay, with the nature, extent, timing, location and likely impact. Within 72 hours of becoming aware, or longer if the Board allows on a written request, a detailed report follows. It covers facts and causes, mitigation, findings on who caused it, remedial steps and the notices sent to people. Failing to give the Board or affected people notice of a breach can attract a penalty of up to Rs 200 crore. Sources: Act s.2(u) Act s.8(6) Rules r.7 Act Schedule item 2 ## Erasure and retention (Rule 8) Unless a law requires retention, the Fiduciary must erase personal data at the earlier of two points. One is when consent is withdrawn; the other is as soon as it is reasonable to assume the purpose is no longer served. It must make its Processors erase it too. The Act's example: a bank keeps identity records ten years after closure because banking law requires it. The Third Schedule fixes when the purpose is treated as no longer served for three classes. They are e-commerce entities with at least 2 crore registered users in India, online gaming intermediaries with at least 50 lakh, and social media intermediaries with at least 2 crore. The period is three years without contact or use of rights. Access to the user account, and to stored virtual tokens that can be used for money, goods or services, are carved out. At least 48 hours before erasure under Rule 8, the person must be told her data will be erased unless she logs in, makes contact or exercises her rights. Separately, every Fiduciary must keep personal data, traffic data and processing logs for at least one year from the processing, for the Seventh Schedule purposes. After that it must erase them unless another law needs them. The Rules' example: an e-book shop keeps order and delivery logs for a year even if the buyer deletes her account. Sources: Act s.8(7) Act s.8(8) Rules r.8 Rules Third Schedule ## A published contact and a grievance channel Every Fiduciary must prominently publish, on its website or app, the business contact of its DPO if it has one. If not, it publishes the contact of a person who can answer questions about its processing. It must mention this contact in every reply to a rights request. It must also set up an effective grievance redressal mechanism. Sources: Act s.8(9) Act s.8(10) Rules r.9 ## Key points - Rule 6 sets minimum safeguards, including encryption, access control and logs. - Tell people and the Board without delay; full report within 72 hours. - Erase when the purpose ends or consent goes, unless law requires keeping. - Keep processing logs for at least one year. - Publish a contact person and run a grievance channel. ## In practice A checklist for your organisation. - Encrypt or mask personal data at rest and control who can reach it. - Keep access logs for at least one year and review them. - Rehearse a breach runbook with a 72-hour Board report template. - Set retention rules per purpose, with a stated legal reason for holds. - Publish your DPO or contact person on the website and in every reply. ## Check what you learned 5 questions. Choose an answer to see why it is right. 0 of 5 answered 1. Question 1 of 5 ### Within what time must the detailed breach report reach the Board, unless the Board allows longer? - 6 hours - 24 hours - 72 hours - 30 days Show the answer **C. 72 hours** Rule 7(2)(b) requires the detailed report within seventy-two hours of becoming aware of the breach, or a longer period the Board allows in writing. Rules r.7(2)(b) 2. Question 2 of 5 ### When must each affected Data Principal be told about a breach? - Without delay - Only if the Board says so - Within 72 hours - Within 30 days Show the answer **A. Without delay** Rule 7(1) requires intimation to each affected Data Principal without delay, on becoming aware of any personal data breach. Rules r.7(1) 3. Question 3 of 5 ### What is the maximum penalty for failing to take reasonable security safeguards? - Rs 50 crore - Rs 150 crore - Rs 200 crore - Rs 250 crore Show the answer **D. Rs 250 crore** Item 1 of the Schedule to the Act: breach of the section 8(5) security obligation may attract up to two hundred and fifty crore rupees. Act Schedule item 1 4. Question 4 of 5 ### Under Rule 8(2), how much warning must a large platform give before erasing an inactive user's data? - No warning - 7 days - At least 48 hours - 24 hours Show the answer **C. At least 48 hours** Rule 8(2) requires the Data Principal to be informed at least forty-eight hours before the erasure period ends. Rules r.8(2) 5. Question 5 of 5 ### For how long, at minimum, must processing logs be kept under Rule 8(3)? - Seven years - 180 days - 90 days - One year Show the answer **D. One year** Rule 8(3) requires personal data, traffic data and processing logs to be kept for a minimum period of one year from the date of processing. Rules r.8(3) Try again Next lesson: Children and persons with disability (https://foctta.com/learn/children-and-disability) ## Official sources for this lesson - [The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) - [Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), MeitY, 13 November 2025 (with Schedules)](https://egazette.gov.in/WriteReadData/2025/267650.pdf) - [G.S.R. 843(E), 13 November 2025: dates on which provisions of the DPDP Act come into force](https://egazette.gov.in/WriteReadData/2025/267647.pdf) A plain-English summary of the DPDP Act 2023 and DPDP Rules 2025, checked on 28 September 2026. It is not legal advice. Words in this lesson are explained in the [DPDP dictionary](https://foctta.com/glossary). [← Lesson 5 **Consent in detail, Consent Managers**](https://foctta.com/learn/consent-and-consent-managers) [Lesson 7 → **Children and persons with disability**](https://foctta.com/learn/children-and-disability) **In this lesson** 1. Where things stand 2. Accountability and accuracy 3. Security safeguards (Rule 6) 4. Breach notice (Rule 7) 5. Erasure and retention (Rule 8) 6. A published contact and a grievance channel 7. Key points 8. In practice 9. Quiz Take the quiz ======== # Lesson 3: Consent and legitimate uses | Learn DPDP | FOCTTA > Personal data may be processed only for a lawful purpose, with consent or under a legitimate use listed in section 7. Web page: https://foctta.com/learn/lawful-grounds This Markdown copy has the same content as the web page. Built 2026-10-14. --- 1. [Home](https://foctta.com/) 2. [Learn DPDP](https://foctta.com/learn) 3. Lesson 3 Lesson 3 of 12 · 5 min read # Consent and legitimate uses Personal data may be processed only for a lawful purpose, with consent or under a legitimate use listed in section 7. Jump to the quiz ## Where things stand - Not yet in force. Sections 4, 6 (except 6(9)) and 7 start eighteen months after 13 November 2025, around May 2027. Checked 28 Sep 2026 Source: G.S.R. 843(E) para (c) ## Two grounds and a lawful purpose Section 4 allows processing only for a lawful purpose, and only on one of two grounds. Either the Data Principal has given consent, or the processing is one of the 'certain legitimate uses' in section 7. A lawful purpose is any purpose not expressly forbidden by law. Sources: Act s.4 ## What consent must look like Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. It covers only the specified purpose and only the data needed for it. Lesson 5 covers consent in depth, including withdrawal and proof. Sources: Act s.6(1) ## The nine legitimate uses Section 7 lists nine uses that need no fresh consent. The first is where a person voluntarily gives data for a specified purpose and has not said she objects to its use. The Act's example: a shopper gives a pharmacy her number to receive a payment receipt by message. Three others concern the State: subsidies, benefits, licences and permits; State functions under law or for sovereignty and security; and legal duties to disclose information to the State. The rest cover complying with judgments or orders, medical emergencies, epidemics and public health threats, disasters or breakdown of public order, and employment. Sources: Act s.7 ## Employment as a legitimate use Employers may process data for employment purposes, or to safeguard themselves from loss or liability, for example preventing corporate espionage or protecting trade secrets, intellectual property and classified information. It also covers providing a service or benefit that an employee asks for. Sources: Act s.7(i) ## Choosing and recording the ground The rights to access, correction and erasure apply where the person gave consent, including under section 7(a). So the ground you choose affects what you owe later. Where consent is the ground and it is questioned, the Fiduciary must prove that notice and consent were given. Sources: Act s.11(1) Act s.12(1) Act s.6(10) ## Key points - Only two grounds exist: consent or a section 7 legitimate use. - A lawful purpose is one not expressly forbidden by law. - Section 7 lists nine specific legitimate uses. - Employment purposes are a listed legitimate use. - If consent is challenged, the Fiduciary must prove it. ## In practice A checklist for your organisation. - Map each processing purpose to consent or a named section 7 clause. - Record the chosen ground in your record of processing activities. - Keep evidence of every notice shown and every consent given. - Review employee data uses against the wording of section 7(i). ## Check what you learned 5 questions. Choose an answer to see why it is right. 0 of 5 answered 1. Question 1 of 5 ### How many grounds for processing does section 4 allow? - Two: consent or certain legitimate uses - No limit - Six grounds - One: consent Show the answer **A. Two: consent or certain legitimate uses** Section 4(1) allows processing for a lawful purpose for which the person has given consent, or for certain legitimate uses. Act s.4(1) 2. Question 2 of 5 ### What is a 'lawful purpose' under the Act? - Only commercial purposes - Any purpose approved by the Board - Only purposes listed in the Rules - Any purpose not expressly forbidden by law Show the answer **D. Any purpose not expressly forbidden by law** Section 4(2) defines a lawful purpose as any purpose which is not expressly forbidden by law. Act s.4(2) 3. Question 3 of 5 ### A shopper gives a pharmacy her mobile number and asks for a receipt by message. What lets the pharmacy use it? - The employment use - The legitimate use for data voluntarily provided for a specified purpose - Nothing; it must refuse - Board approval Show the answer **B. The legitimate use for data voluntarily provided for a specified purpose** Section 7(a) and its first illustration cover data a person voluntarily provides for a specified purpose, such as a pharmacy sending a payment receipt. Act s.7(a) 4. Question 4 of 5 ### Which of these is a legitimate use listed in section 7? - Targeted marketing - Building a mailing list - Responding to a medical emergency involving a threat to life - Selling data to partners Show the answer **C. Responding to a medical emergency involving a threat to life** Section 7(f) covers responding to a medical emergency involving a threat to the life or immediate threat to the health of any individual. Act s.7(f) 5. Question 5 of 5 ### Consent is questioned in a Board proceeding. Who must prove that notice and consent were given? - The Board - The Data Principal - The Consent Manager - The Data Fiduciary Show the answer **D. The Data Fiduciary** Section 6(10) obliges the Data Fiduciary to prove that a notice was given and consent was given in line with the Act and Rules. Act s.6(10) Try again[Next lesson: The notice before consent](https://foctta.com/learn/notice) ## Official sources for this lesson - [The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) - [G.S.R. 843(E), 13 November 2025: dates on which provisions of the DPDP Act come into force](https://egazette.gov.in/WriteReadData/2025/267647.pdf) A plain-English summary of the DPDP Act 2023 and DPDP Rules 2025, checked on 28 September 2026. It is not legal advice. Words in this lesson are explained in the [DPDP dictionary](https://foctta.com/glossary). [← Lesson 2 **Who is who in the law**](https://foctta.com/learn/the-roles) [Lesson 4 → **The notice before consent**](https://foctta.com/learn/notice) **In this lesson** 1. Where things stand 2. Two grounds and a lawful purpose 3. What consent must look like 4. The nine legitimate uses 5. Employment as a legitimate use 6. Choosing and recording the ground 7. Key points 8. In practice 9. Quiz Take the quiz ======== # Lesson 4: The notice before consent | Learn DPDP | FOCTTA > Before or with every consent request, the Fiduciary must give a clear notice. Rule 3 sets out what it must contain. Web page: https://foctta.com/learn/notice This Markdown copy has the same content as the web page. Built 2026-10-14. --- 1. [Home](https://foctta.com/) 2. [Learn DPDP](https://foctta.com/learn) 3. Lesson 4 Lesson 4 of 12 · 5 min read # The notice before consent Before or with every consent request, the Fiduciary must give a clear notice. Rule 3 sets out what it must contain. Jump to the quiz ## Where things stand - Not yet in force. Section 5 and Rule 3 start eighteen months after 13 November 2025, around May 2027. Checked 28 Sep 2026 Source: G.S.R. 843(E) para (c); Rules r.1(4) - Section 17(3) lets the Government exempt notified Fiduciaries, including startups, from section 5. No such notification was located. Checked 28 Sep 2026 Source: Search of eGazette and meity.gov.in, 28 Sep 2026: not confirmed ## When a notice is needed Every request for consent must be accompanied or preceded by a notice from the Data Fiduciary. The Act's example is a bank's video-based customer identification: the bank must describe the personal data and the purpose before or with its request for the data. Sources: Act s.5(1) ## What the Act says it must contain The notice must tell the person the personal data and the purpose, how to withdraw consent and use the grievance process, and how to complain to the Board. The person must be able to read it in English or any language in the Eighth Schedule to the Constitution. Sources: Act s.5(1) Act s.5(3) ## What Rule 3 adds Rule 3 says the notice must stand on its own, understandable without other information. In clear and plain language, it must give an itemised description of the personal data and the specified purpose. It must also give a specific description of the goods, services or uses the processing enables. The notice must also give the link to the website or app, and describe any other means, for three things. They are withdrawing consent as easily as it was given, exercising rights under the Act, and complaining to the Board. Sources: Rules r.3 ## Consent requests and older consents The consent request itself must use clear and plain language, offer English or an Eighth Schedule language, and give contact details of the DPO or another person authorised to respond. For consent given before commencement, the Fiduciary must send a notice as soon as reasonably practicable, and may keep processing until the person withdraws. Sources: Act s.6(3) Act s.5(2) ## Key points - Give the notice before or with every consent request. - Itemise the data; state the purpose and the goods or services. - Link to withdrawal, rights and Board complaints. - Offer English or an Eighth Schedule language. - Existing consents need a notice as soon as reasonably practicable. ## In practice A checklist for your organisation. - Write one standalone notice per purpose, itemising each data field. - Translate notices into the languages your customers use. - Put withdrawal, rights and complaint links in every notice. - Plan notices for customers who consented before commencement. ## Check what you learned 5 questions. Choose an answer to see why it is right. 0 of 5 answered 1. Question 1 of 5 ### When must the notice reach the Data Principal? - Only if she asks for it - Before or together with the consent request - Within 30 days after consent - Once a year Show the answer **B. Before or together with the consent request** Section 5(1) requires every request for consent to be accompanied or preceded by a notice. Act s.5(1) 2. Question 2 of 5 ### How must the notice describe the personal data under Rule 3? - As one general category - It need not describe it - By a link to a policy only - As an itemised description Show the answer **D. As an itemised description** Rule 3(b)(i) requires, at the minimum, an itemised description of the personal data. Rules r.3(b) 3. Question 3 of 5 ### Which means must the notice describe under Rule 3(c)? - Means to withdraw consent, exercise rights and complain to the Board - Only a sales contact - The company's share price - None; a phone number is enough Show the answer **A. Means to withdraw consent, exercise rights and complain to the Board** Rule 3(c) requires a link and other means to withdraw consent, exercise rights under the Act and make a complaint to the Board. Rules r.3(c) 4. Question 4 of 5 ### In which languages must the person be able to access the notice? - Any language the company prefers - English only - Hindi only - English or any language in the Eighth Schedule to the Constitution Show the answer **D. English or any language in the Eighth Schedule to the Constitution** Section 5(3) requires the option to access the notice in English or any language specified in the Eighth Schedule to the Constitution. Act s.5(3) 5. Question 5 of 5 ### A customer consented before the Act commenced. What must the Fiduciary do? - Give her a notice as soon as reasonably practicable - Nothing at all - Delete her data at once - Ask the Board for permission Show the answer **A. Give her a notice as soon as reasonably practicable** Section 5(2)(a) requires a notice as soon as reasonably practicable; section 5(2)(b) allows processing to continue until she withdraws. Act s.5(2) Try again[Next lesson: Consent in detail, Consent Managers](https://foctta.com/learn/consent-and-consent-managers) ## Official sources for this lesson - [The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) - [Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), MeitY, 13 November 2025 (with Schedules)](https://egazette.gov.in/WriteReadData/2025/267650.pdf) - [G.S.R. 843(E), 13 November 2025: dates on which provisions of the DPDP Act come into force](https://egazette.gov.in/WriteReadData/2025/267647.pdf) A plain-English summary of the DPDP Act 2023 and DPDP Rules 2025, checked on 28 September 2026. It is not legal advice. Words in this lesson are explained in the [DPDP dictionary](https://foctta.com/glossary). [← Lesson 3 **Consent and legitimate uses**](https://foctta.com/learn/lawful-grounds) [Lesson 5 → **Consent in detail, Consent Managers**](https://foctta.com/learn/consent-and-consent-managers) **In this lesson** 1. Where things stand 2. When a notice is needed 3. What the Act says it must contain 4. What Rule 3 adds 5. Consent requests and older consents 6. Key points 7. In practice 8. Quiz Take the quiz ======== # Lesson 9: Rights and duties of people | Learn DPDP | FOCTTA > The four rights people have, how requests and grievances work under Rule 14, and the duties people owe in return. Web page: https://foctta.com/learn/rights-and-duties This Markdown copy has the same content as the web page. Built 2026-10-14. --- 1. [Home](https://foctta.com/) 2. [Learn DPDP](https://foctta.com/learn) 3. Lesson 9 Lesson 9 of 12 · 6 min read # Rights and duties of people The four rights people have, how requests and grievances work under Rule 14, and the duties people owe in return. Jump to the quiz ## Where things stand - Not yet in force. Sections 11 to 15 and Rule 14 start eighteen months after 13 November 2025, around May 2027. Checked 28 Sep 2026 Source: G.S.R. 843(E) para (c); Rules r.1(4) ## Right to access information A person can ask a Fiduciary she gave consent to, including under section 7(a), for a summary of her personal data and the processing done. She can also ask for the identities of all other Fiduciaries and Processors it was shared with, with a description of what was shared. The sharing details need not be given for sharing with a Fiduciary authorised by law to obtain the data, made on its written request. That exception covers sharing to prevent, detect or investigate offences or cyber incidents, or to prosecute or punish offences. Sources: Act s.11 ## Correction and erasure She can ask for her data to be corrected, completed, updated or erased. The Fiduciary must correct inaccurate or misleading data, complete incomplete data and update it. It must erase on request unless the data is still needed for the specified purpose or a law requires keeping it. Sources: Act s.12 ## Grievances: 90 days, and the first stop People have a right to readily available grievance redressal from a Fiduciary or Consent Manager. Rule 14(3) sets the response period at no more than 90 days, backed by measures that make the system effective. A person must exhaust this route before approaching the Board. Sources: Act s.13 Rules r.14(3) ## Nomination A person may nominate one or more individuals to exercise her rights if she dies or becomes incapable. Incapacity means being unable to exercise the rights because of unsoundness of mind or infirmity of body. Sources: Act s.14 Rules r.14(4) ## How requests are made (Rule 14) The Fiduciary, and a Consent Manager where relevant, must prominently publish how to make a request and which identifier it needs. Examples are a customer ID, application number, email address, mobile number or licence number. Every reply must include the contact person's details. Sources: Rules r.14(1) Rules r.14(2) Rules r.14(5) Rules r.9 ## Duties of Data Principals People also have duties: follow applicable laws, not impersonate anyone, and not suppress material information for State-issued identity documents. They must not file false or frivolous grievances or complaints, and must give only verifiably authentic information for correction or erasure. Breach can attract a penalty of up to Rs 10,000. The Board may also warn or impose costs on a complainant if it finds a complaint false or frivolous. Sources: Act s.15 Act s.28(12) Act Schedule item 5 ## Key points - Four rights: access, correction and erasure, grievance, nomination. - Grievances must be answered within 90 days at most. - People must use the Fiduciary's grievance route before the Board. - Publish how to make a request and which identifier you need. - Breaching people's duties can attract up to Rs 10,000. ## In practice A checklist for your organisation. - Publish a rights request page listing the identifiers you accept. - Track every grievance against a 90-day clock. - Keep a sharing register so access replies can name recipients. - Offer a nomination option in the customer account. - Include the contact person in every rights reply. ## Check what you learned 5 questions. Choose an answer to see why it is right. 0 of 5 answered 1. Question 1 of 5 ### What is the longest period the Rules allow for responding to a grievance? - 30 days - 45 days - 90 days - 180 days Show the answer **C. 90 days** Rule 14(3) requires grievances to be answered within a reasonable period not exceeding ninety days. Rules r.14(3) 2. Question 2 of 5 ### Before approaching the Board, what must a person do? - File a court case - Nothing - Exhaust the Fiduciary's grievance redressal - Hire a lawyer Show the answer **C. Exhaust the Fiduciary's grievance redressal** Section 13(3) requires the Data Principal to exhaust the grievance redressal opportunity before approaching the Board. Act s.13(3) 3. Question 3 of 5 ### When may a nominee exercise a person's rights? - At any time - In the event of her death or incapacity - Only for children - Only with Board approval Show the answer **B. In the event of her death or incapacity** Section 14(1) lets the nominee exercise the rights in the event of death or incapacity of the Data Principal. Act s.14(1) 4. Question 4 of 5 ### Which is an example of an 'identifier' under Rule 14(5)? - A customer acquisition form number - The Board's case number - The company's PAN - The DPO's name Show the answer **A. A customer acquisition form number** Rule 14(5) lists identifiers issued by the Fiduciary, including a customer acquisition form number, email address and mobile number. Rules r.14(5) 5. Question 5 of 5 ### What is the maximum penalty for a Data Principal who breaches her duties under section 15? - Rs 1,000 - Rs 10,000 - Rs 1 lakh - Rs 50 crore Show the answer **B. Rs 10,000** Item 5 of the Schedule: breach of the section 15 duties may attract up to ten thousand rupees. Act Schedule item 5 Try again[Next lesson: Sending data outside India](https://foctta.com/learn/cross-border) ## Official sources for this lesson - [The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) - [Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), MeitY, 13 November 2025 (with Schedules)](https://egazette.gov.in/WriteReadData/2025/267650.pdf) - [G.S.R. 843(E), 13 November 2025: dates on which provisions of the DPDP Act come into force](https://egazette.gov.in/WriteReadData/2025/267647.pdf) A plain-English summary of the DPDP Act 2023 and DPDP Rules 2025, checked on 28 September 2026. It is not legal advice. Words in this lesson are explained in the [DPDP dictionary](https://foctta.com/glossary). [← Lesson 8 **Significant Data Fiduciaries**](https://foctta.com/learn/significant-data-fiduciaries) [Lesson 10 → **Sending data outside India**](https://foctta.com/learn/cross-border) **In this lesson** 1. Where things stand 2. Right to access information 3. Correction and erasure 4. Grievances: 90 days, and the first stop 5. Nomination 6. How requests are made (Rule 14) 7. Duties of Data Principals 8. Key points 9. In practice 10. Quiz Take the quiz ======== # Lesson 8: Significant Data Fiduciaries | Learn DPDP | FOCTTA > Some Fiduciaries will be named Significant Data Fiduciaries, with extra duties: a DPO in India, an independent auditor, yearly DPIAs and audits. Web page: https://foctta.com/learn/significant-data-fiduciaries This Markdown copy has the same content as the web page. Built 2026-10-14. --- 1. [Home](https://foctta.com/) 2. [Learn DPDP](https://foctta.com/learn) 3. Lesson 8 Lesson 8 of 12 · 5 min read # Significant Data Fiduciaries Some Fiduciaries will be named Significant Data Fiduciaries, with extra duties: a DPO in India, an independent auditor, yearly DPIAs and audits. Jump to the quiz ## Where things stand - Not yet in force. Section 10 and Rule 13 start eighteen months after 13 November 2025, around May 2027. Checked 28 Sep 2026 Source: G.S.R. 843(E) para (c); Rules r.1(4) - No Data Fiduciary or class had been notified as a Significant Data Fiduciary in the sources checked. Checked 28 Sep 2026 Source: Search of eGazette and meity.gov.in, 28 Sep 2026: not confirmed ## How an SDF is named The Central Government may notify any Data Fiduciary or class as a Significant Data Fiduciary after assessing relevant factors. They include the volume and sensitivity of data, risk to people's rights, and impact on India's sovereignty and integrity. They also include risk to electoral democracy, security of the State and public order. Sources: Act s.10(1) ## The Data Protection Officer An SDF must appoint a Data Protection Officer who represents it under the Act and is based in India. The DPO is responsible to its board of directors or similar governing body, and is the point of contact for grievance redressal. Sources: Act s.10(2)(a) ## Auditor, DPIA and audit An SDF must appoint an independent data auditor to evaluate its compliance, and carry out periodic Data Protection Impact Assessments and audits. A DPIA describes people's rights and the purposes of processing, and assesses and manages the risk to those rights. Rule 13 makes these yearly: a DPIA and an audit once in every twelve months from the date of notification. The person carrying them out must give the Board a report of the significant observations. Sources: Act s.10(2)(b) Act s.10(2)(c) Rules r.13(1) Rules r.13(2) ## Algorithms and data that stays in India An SDF must use due diligence to check that its technical measures, including algorithmic software, are not likely to pose a risk to people's rights. It must also ensure that personal data the Government specifies, on a committee's recommendation, and its traffic data, are not transferred outside India. Sources: Rules r.13(3) Rules r.13(4) ## Penalty and exemption Breaching the additional SDF obligations under section 10 can attract a penalty of up to Rs 150 crore. The Government may also notify classes of Fiduciaries, including startups, to whom section 10 does not apply. Sources: Act Schedule item 4 Act s.17(3) ## Key points - SDFs are named by Government notification, not self-assessment. - The DPO must be based in India and answer to the board. - A DPIA and an audit every twelve months, reported to the Board. - Check that algorithms do not risk people's rights. - Specified data may have to stay in India. ## In practice A checklist for your organisation. - Assess whether your data volume or sensitivity could lead to SDF notification. - Draft a DPIA method that describes rights, purposes and risks. - Line up an independent data auditor before any notification. - Keep an inventory of algorithms that shape decisions about people. ## Check what you learned 4 questions. Choose an answer to see why it is right. 0 of 4 answered 1. Question 1 of 4 ### Who decides that an organisation is a Significant Data Fiduciary? - The Central Government, by notification - The organisation itself - Its auditor - The Board Show the answer **A. The Central Government, by notification** Section 10(1) lets the Central Government notify any Data Fiduciary or class as a Significant Data Fiduciary after assessing relevant factors. Act s.10(1) 2. Question 2 of 4 ### Where must an SDF's Data Protection Officer be based? - In India - Anywhere - At the Board's office - In the parent company's country Show the answer **A. In India** Section 10(2)(a)(ii) requires the DPO to be based in India. Act s.10(2)(a) 3. Question 3 of 4 ### How often must an SDF carry out a DPIA and an audit under Rule 13? - Once every three years - Only when the Board asks - Once in every twelve months - Only once Show the answer **C. Once in every twelve months** Rule 13(1) requires a DPIA and an audit once in every period of twelve months from the date of notification. Rules r.13(1) 4. Question 4 of 4 ### What is the maximum penalty for breaching the SDF obligations in section 10? - Rs 50 crore - Rs 150 crore - Rs 200 crore - Rs 250 crore Show the answer **B. Rs 150 crore** Item 4 of the Schedule: breach of the additional SDF obligations may attract up to one hundred and fifty crore rupees. Act Schedule item 4 Try again[Next lesson: Rights and duties of people](https://foctta.com/learn/rights-and-duties) ## Official sources for this lesson - [The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) - [Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), MeitY, 13 November 2025 (with Schedules)](https://egazette.gov.in/WriteReadData/2025/267650.pdf) - [G.S.R. 843(E), 13 November 2025: dates on which provisions of the DPDP Act come into force](https://egazette.gov.in/WriteReadData/2025/267647.pdf) A plain-English summary of the DPDP Act 2023 and DPDP Rules 2025, checked on 28 September 2026. It is not legal advice. Words in this lesson are explained in the [DPDP dictionary](https://foctta.com/glossary). [← Lesson 7 **Children and persons with disability**](https://foctta.com/learn/children-and-disability) [Lesson 9 → **Rights and duties of people**](https://foctta.com/learn/rights-and-duties) **In this lesson** 1. Where things stand 2. How an SDF is named 3. The Data Protection Officer 4. Auditor, DPIA and audit 5. Algorithms and data that stays in India 6. Penalty and exemption 7. Key points 8. In practice 9. Quiz Take the quiz ======== # Lesson 2: Who is who in the law | Learn DPDP | FOCTTA > The roles the law is built around: Data Fiduciary, Data Principal, Data Processor, Consent Manager and the Data Protection Board. Web page: https://foctta.com/learn/the-roles This Markdown copy has the same content as the web page. Built 2026-10-14. --- 1. [Home](https://foctta.com/) 2. [Learn DPDP](https://foctta.com/learn) 3. Lesson 2 Lesson 2 of 12 · 4 min read # Who is who in the law The roles the law is built around: Data Fiduciary, Data Principal, Data Processor, Consent Manager and the Data Protection Board. Jump to the quiz ## Where things stand - The definitions in section 2 have applied since 13 November 2025. The duties attached to each role start around May 2027; Consent Manager registration starts in November 2026. Checked 28 Sep 2026 Source: G.S.R. 843(E) paras (a) to (c) ## Data Fiduciary: the one who decides A Data Fiduciary is any person who, alone or with others, decides the purpose and means of processing personal data. 'Person' is wide: an individual, a Hindu undivided family, a company, a firm, an association, the State and other artificial juristic persons. Most duties in the Act fall on the Fiduciary. Sources: Act s.2(i) Act s.2(s) ## Data Principal: the person the data is about The Data Principal is the individual the personal data relates to. For a child, meaning anyone under 18, the term includes the parents or lawful guardian. For a person with disability, it includes her lawful guardian acting on her behalf. The Act uses 'she' for every individual, whatever their gender. Sources: Act s.2(j) Act s.2(f) Act s.2(y) ## Data Processor: the one who acts for you A Data Processor processes personal data on behalf of a Data Fiduciary, such as a cloud host, payroll firm or call centre. A Fiduciary may use one only under a valid contract, and it stays responsible for what the Processor does, whatever the contract says. Sources: Act s.2(k) Act s.8(1) Act s.8(2) ## Consent Manager: a registered go-between A Consent Manager is registered with the Board. It is a single point of contact through which a person can give, manage, review and withdraw consent on an accessible, transparent and interoperable platform. It is accountable to the Data Principal and acts on her behalf. Sources: Act s.2(g) Act s.6(8) ## The Board, SDFs and DPOs The Data Protection Board of India inquires into breaches and imposes penalties (lesson 11). The Government can notify some Fiduciaries as Significant Data Fiduciaries, with extra duties. A Data Protection Officer is the individual a Significant Data Fiduciary appoints under section 10(2)(a). Sources: Act s.2(c) Act s.2(z) Act s.2(l) Act s.27(1) ## Key points - The Data Fiduciary decides why and how data is processed. - The Data Principal is the person; for a child, parents too. - Processors act under a valid contract; the Fiduciary stays responsible. - Consent Managers are registered with the Board and accountable to people. - Significant Data Fiduciaries are named by Government notification. ## In practice A checklist for your organisation. - For each system, record whether you act as Fiduciary or Processor. - Sign a written contract with every vendor that processes personal data. - Identify customer groups that include children or lawful guardians. - Name one person to answer questions about your processing. ## Check what you learned 5 questions. Choose an answer to see why it is right. 0 of 5 answered 1. Question 1 of 5 ### A cloud provider stores customer data only on a bank's instructions. What is the cloud provider? - Data Principal - Data Fiduciary - Data Processor - Consent Manager Show the answer **C. Data Processor** Section 2(k) defines a Data Processor as any person who processes personal data on behalf of a Data Fiduciary. Act s.2(k) 2. Question 2 of 5 ### Who counts as a child under the Act? - Anyone under 13 - Anyone under 16 - Anyone under 18 - Anyone under 21 Show the answer **C. Anyone under 18** Section 2(f) defines a child as an individual who has not completed the age of eighteen years. Act s.2(f) 3. Question 3 of 5 ### A bank's contract says its payroll vendor alone is responsible for data protection. Who is responsible under the Act? - The Board - The bank, irrespective of the contract - Only the vendor - Neither of them Show the answer **B. The bank, irrespective of the contract** Section 8(1) makes the Data Fiduciary responsible, irrespective of any agreement to the contrary, including for processing by its Data Processor. Act s.8(1) 4. Question 4 of 5 ### What must a Consent Manager be? - A company based abroad - A government department - A bank - Registered with the Data Protection Board Show the answer **D. Registered with the Data Protection Board** Section 2(g) defines a Consent Manager as a person registered with the Board who acts as a single point of contact for consent. Act s.2(g) 5. Question 5 of 5 ### Under the Act's definition, who appoints a Data Protection Officer? - The Board - Every business - The Data Principal - A Significant Data Fiduciary Show the answer **D. A Significant Data Fiduciary** Section 2(l) defines a DPO as an individual appointed by the Significant Data Fiduciary under section 10(2)(a). Act s.2(l) Try again[Next lesson: Consent and legitimate uses](https://foctta.com/learn/lawful-grounds) ## Official sources for this lesson - [The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) - [G.S.R. 843(E), 13 November 2025: dates on which provisions of the DPDP Act come into force](https://egazette.gov.in/WriteReadData/2025/267647.pdf) A plain-English summary of the DPDP Act 2023 and DPDP Rules 2025, checked on 28 September 2026. It is not legal advice. Words in this lesson are explained in the [DPDP dictionary](https://foctta.com/glossary). [← Lesson 1 **What the DPDP Act covers**](https://foctta.com/learn/what-the-act-covers) [Lesson 3 → **Consent and legitimate uses**](https://foctta.com/learn/lawful-grounds) **In this lesson** 1. Where things stand 2. Data Fiduciary: the one who decides 3. Data Principal: the person the data is about 4. Data Processor: the one who acts for you 5. Consent Manager: a registered go-between 6. The Board, SDFs and DPOs 7. Key points 8. In practice 9. Quiz Take the quiz ======== # Lesson 12: Timelines and getting ready | Learn DPDP | FOCTTA > When each part of the Act and Rules starts, the position on 28 September 2026, and how sector clocks run alongside DPDP. Web page: https://foctta.com/learn/timelines-and-readiness This Markdown copy has the same content as the web page. Built 2026-10-14. --- 1. [Home](https://foctta.com/) 2. [Learn DPDP](https://foctta.com/learn) 3. Lesson 12 Lesson 12 of 12 · 7 min read # Timelines and getting ready When each part of the Act and Rules starts, the position on 28 September 2026, and how sector clocks run alongside DPDP. Jump to the quiz ## Where things stand - See 'Latest status (28 Sep 2026)' in this lesson. Checked 28 Sep 2026 Source: Primary sources listed in that section ## Three commencement dates G.S.R. 843(E) brought the Act into force in stages. From 13 November 2025: the definitions, the Board provisions (sections 18 to 26), sections 35 and 38 to 43, and sub-sections (1) and (3) of section 44. One year later, in November 2026: Consent Manager registration (section 6(9)) and the Board's power over registration breaches (section 27(1)(d)). Eighteen months after, around May 2027: everything else. That includes notice, consent, legitimate uses, Fiduciary duties, children, SDFs, rights and duties of people, and cross-border transfers. It also includes exemptions, most Board powers, penalties and appeals, and the omission of IT Act section 43A. Sources: G.S.R. 843(E) ## The Rules follow the same pattern Rule 1 matches this. Rules 1, 2 and 17 to 21, on the Board, applied from publication, and Rule 4, on Consent Managers, applies one year after. Rules 3, 5 to 16, 22 and 23 apply eighteen months after. A December 2025 corrigendum, G.S.R. 892(E), corrected only wording and typing errors. Sources: Rules r.1 G.S.R. 892(E) ## Latest status (28 Sep 2026) No amendment to the Act or the Rules was located in the Gazette or on MeitY's site; the only later instrument found is the G.S.R. 892(E) corrigendum. MeitY reportedly consulted in January 2026 on cutting 18 months to 12. No notification doing so was located, so the May 2027 date stands. The Board exists in law, but on 6 May 2026 MeitY was still inviting applications for its Chairperson and four Members. No appointment was confirmed from a primary source by 28 September 2026. Its powers to hear complaints and impose penalties start around May 2027. No Consent Manager can be registered before Rule 4 starts in November 2026, and no Board registration process was located. No Significant Data Fiduciary, section 16 country restriction, Rule 15 order, startup exemption or official MeitY FAQ was located either. Treat each as not yet issued, and recheck. Sources: G.S.R. 892(E) MeitY circular 6 May 2026 ## Sector clocks run alongside DPDP Sector rules already apply and will keep applying. CERT-In's 2022 Directions require listed cyber incidents, including data breaches and leaks, to be reported within 6 hours of noticing them. RBI's July 2026 Directions require banks and other covered entities to report cyber incidents on its DAKSH portal within 6 hours of detection. SEBI's CSCRF requires a 6-hour notice to SEBI and CERT-In for serious incidents, with portal details within 24 hours. IRDAI asks insurers to report to CERT-In within 6 hours with a copy to IRDAI. The DPDP Board duty differs: without delay, then a detailed report within 72 hours, from around May 2027. Sources: CERT-In Directions 2022 RBI Cyber Directions 2026 SEBI CSCRF 2024 IRDAI Guidelines 2026 Rules r.7 ## Getting ready: a sensible order Most of this work takes months, so start early. Map where personal data sits and why, choose the lawful ground for each purpose, and draft Rule 3 notices and consent records. Set retention and erasure rules, and build breach, rights and grievance processes. Review Processor contracts, and check whether children's data or SDF duties apply. ## Key points - Board provisions since 13 November 2025; most duties around May 2027. - Consent Manager registration starts in November 2026. - No amendment or 12-month cut was located by 28 September 2026. - Board posts were still being advertised in May 2026. - CERT-In, RBI, SEBI and IRDAI 6-hour clocks apply already. ## In practice A checklist for your organisation. - Build a compliance plan that finishes well before May 2027. - Run DPDP breach steps alongside your 6-hour sector reports. - Check the Gazette and MeitY monthly for new notifications. - Keep dated evidence of each control you put in place. ## Check what you learned 5 questions. Choose an answer to see why it is right. 0 of 5 answered 1. Question 1 of 5 ### How long after publication do most duties, such as notice and breach reporting, come into force? - 6 months - 12 months - 18 months - 24 months Show the answer **C. 18 months** G.S.R. 843(E) para (c) and Rule 1(4) bring the main duties into force eighteen months after publication. G.S.R. 843(E); Rules r.1(4) 2. Question 2 of 5 ### Which provisions came into force on publication, 13 November 2025? - The duties on children's data - The rights of Data Principals - The breach notice duty - The Board provisions, sections 18 to 26 Show the answer **D. The Board provisions, sections 18 to 26** G.S.R. 843(E) para (a) brought sections 18 to 26, among others, into force from the date of publication. G.S.R. 843(E) 3. Question 3 of 5 ### When does Rule 4 on Consent Managers come into force? - On publication - One year after publication - Eighteen months after publication - Five years after publication Show the answer **B. One year after publication** Rule 1(3) brings Rule 4 into force one year after publication. Rules r.1(3) 4. Question 4 of 5 ### Under CERT-In's 2022 Directions, within how many hours must a listed cyber incident be reported? - 2 hours - 6 hours - 24 hours - 72 hours Show the answer **B. 6 hours** CERT-In Directions No. 20(3)/2022-CERT-In require reporting within 6 hours of noticing listed incidents, including data breaches and leaks. CERT-In Directions 2022 5. Question 5 of 5 ### Where is the Data Protection Board's head office? - Bengaluru - National Capital Region - Mumbai - Chennai Show the answer **B. National Capital Region** G.S.R. 844(E) para 2 places the head office of the Data Protection Board of India in the National Capital Region. G.S.R. 844(E) Try again[Take the final assessment for your certificate](https://foctta.com/learn/certificate) ## Official sources for this lesson - [Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), MeitY, 13 November 2025 (with Schedules)](https://egazette.gov.in/WriteReadData/2025/267650.pdf) - [G.S.R. 843(E), 13 November 2025: dates on which provisions of the DPDP Act come into force](https://egazette.gov.in/WriteReadData/2025/267647.pdf) - [G.S.R. 844(E), 13 November 2025: establishment of the Data Protection Board of India](https://egazette.gov.in/WriteReadData/2025/267648.pdf) - [G.S.R. 892(E), 10 December 2025: corrigenda to the DPDP Rules, 2025](https://egazette.gov.in/WriteReadData/2025/268455.pdf) - [MeitY F. No. 2(1)/2026-Pers.I, 6 May 2026: appointment to the posts of Chairperson and Members, Data Protection Board of India](https://www.meity.gov.in/static/uploads/2026/05/cd481c027470b420b4cb85fb40a91c53.pdf) - [MeitY advertisement: filling up the posts of Chairman and Members in the Data Protection Board of India (2026)](https://www.meity.gov.in/static/uploads/2026/05/53b1bcf01cab9a0adde463e73fbc3417.pdf) - [CERT-In Directions No. 20(3)/2022-CERT-In under s.70B(6) of the IT Act, 28 April 2022 (sector note)](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) - [RBI Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions for commercial banks, RBI/DoS/2026-27/410, 31 July 2026 (sector note)](https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=13643) - [SEBI Cybersecurity and Cyber Resilience Framework, SEBI/HO/ITD-1/ITD\_CSC\_EXT/P/CIR/2024/113, 20 August 2024 (sector note)](https://www.sebi.gov.in/sebi_data/attachdocs/aug-2024/1724326790365.pdf) - [IRDAI Information and Cyber Security Guidelines 2026, Version 2.0 (sector note; text read from a MediaNama-hosted copy)](https://www.medianama.com/wp-content/uploads/2026/04/IRDAI-Information-Cyber-Security-Guidelines-2026.pdf) A plain-English summary of the DPDP Act 2023 and DPDP Rules 2025, checked on 28 September 2026. It is not legal advice. Words in this lesson are explained in the [DPDP dictionary](https://foctta.com/glossary). [← Lesson 11 **Board, penalties and appeals**](https://foctta.com/learn/board-penalties-appeals) Course finished → Take the final assessment and get your certificate (https://foctta.com/learn/certificate) **In this lesson** 1. Where things stand 2. Three commencement dates 3. The Rules follow the same pattern 4. Latest status (28 Sep 2026) 5. Sector clocks run alongside DPDP 6. Getting ready: a sensible order 7. Key points 8. In practice 9. Quiz Take the quiz ======== # Lesson 1: What the DPDP Act covers | Learn DPDP | FOCTTA > What the Digital Personal Data Protection Act does, which data and organisations it covers, and what it leaves out. Web page: https://foctta.com/learn/what-the-act-covers This Markdown copy has the same content as the web page. Built 2026-10-14. --- 1. [Home](https://foctta.com/) 2. [Learn DPDP](https://foctta.com/learn) 3. Lesson 1 Lesson 1 of 12 · 5 min read # What the DPDP Act covers What the Digital Personal Data Protection Act does, which data and organisations it covers, and what it leaves out. Jump to the quiz ## Where things stand - Sections 1(2) and 2 have applied since 13 November 2025. Section 3 (scope) and section 17 (exemptions) start around May 2027. Checked 28 Sep 2026 Source: G.S.R. 843(E) paras (a) and (c) - No notification exempting startups or other classes under section 17(3), or under section 17(5), was located. Checked 28 Sep 2026 Source: Search of eGazette and meity.gov.in, 28 Sep 2026: not confirmed ## A law for digital personal data The Digital Personal Data Protection Act, 2023 is Act No. 22 of 2023. The President assented on 11 August 2023. It governs how digital personal data is processed, recognising both a person's right to protect her data and the need to process it for lawful purposes. The Act has 44 sections and one Schedule of penalties. The detail sits in the Digital Personal Data Protection Rules, 2025, notified by MeitY as G.S.R. 846(E) on 13 November 2025. Most of the Act and Rules are not yet in force; lesson 12 gives the dates. Sources: Act preamble Act s.1 ## Personal data and processing Personal data is any data about an individual who is identifiable by or in relation to that data. Digital personal data is personal data in digital form. Processing is any wholly or partly automated operation on it, from collection and storage to use, sharing and erasure. Sources: Act s.2(t) Act s.2(n) Act s.2(x) ## Where the Act applies Inside India, the Act applies to digital personal data collected in digital form, and to data collected on paper and digitised later. Outside India, it applies when processing is connected to offering goods or services to people in India, such as a foreign app with Indian users. Two things are outside it. The first is data an individual processes for a personal or domestic purpose. The second is personal data made public by the person it relates to, or by someone legally required to publish it. The Act's own example is a blogger who shares her details on social media. Sources: Act s.3 ## Exemptions, at a high level Section 17(1) switches off most duties for listed cases. They are: enforcing legal rights or claims, courts and regulators doing their functions, preventing or investigating offences, approved mergers, and tracing a loan defaulter's assets. Even then, the Fiduciary stays responsible for compliance and must keep reasonable security safeguards. The Government may also notify State bodies for security and public order, and certain Fiduciaries, including startups, to be excused from some duties. Research, archiving and statistics are exempt only if no decision about a specific person is taken and the Second Schedule standards are met. Sources: Act s.17 Rules r.16 ## How it sits with other laws The Act adds to other Indian laws rather than replacing them. If a provision truly conflicts with another law, the DPDP provision prevails to that extent. When section 44(2) starts, around May 2027, it omits section 43A of the Information Technology Act, 2000. Sources: Act s.38 Act s.44(2) G.S.R. 843(E) ## Key points - Covers digital personal data, including paper records digitised later. - Reaches foreign firms offering goods or services to people in India. - Personal or domestic use and lawfully public data fall outside. - Exempt processing still needs security safeguards and accountability. - Adds to other laws; prevails only in a real conflict. ## In practice A checklist for your organisation. - List every system holding personal data, including scanned paper files. - Check whether group companies abroad serve people in India. - Record any section 17 exemption you rely on, with its reason. - Keep security controls in place even for exempt processing. ## Check what you learned 5 questions. Choose an answer to see why it is right. 0 of 5 answered 1. Question 1 of 5 ### A company scans old paper application forms into its document system. Does the Act apply to the scanned data? - No, because it was collected on paper - Yes, data collected on paper and digitised later is covered - Only after five years - Only if the forms were signed Show the answer **B. Yes, data collected on paper and digitised later is covered** Section 3(a)(ii) applies the Act to personal data collected in non-digital form and digitised subsequently. Act s.3(a) 2. Question 2 of 5 ### A company based abroad offers an app to users in India. When does the Act reach its processing outside India? - Only for government data - When the processing is connected to offering goods or services to people in India - Never - Only if it has an office in India Show the answer **B. When the processing is connected to offering goods or services to people in India** Section 3(b) extends the Act to processing outside India connected to offering goods or services to Data Principals in India. Act s.3(b) 3. Question 3 of 5 ### Which of these is outside the Act? - A hospital's patient records - A bank's customer database - An employer's payroll system - An individual keeping contacts for a personal or domestic purpose Show the answer **D. An individual keeping contacts for a personal or domestic purpose** Section 3(c)(i) excludes personal data processed by an individual for any personal or domestic purpose. Act s.3(c) 4. Question 4 of 5 ### Under section 17(1), which duties still apply to processing that is otherwise exempt? - Only the notice duty - Only breach reporting - Overall responsibility and reasonable security safeguards (s.8(1) and s.8(5)) - None at all Show the answer **C. Overall responsibility and reasonable security safeguards (s.8(1) and s.8(5))** Section 17(1) switches off Chapter II except sub-sections (1) and (5) of section 8: responsibility for compliance and reasonable security safeguards. Act s.17(1) 5. Question 5 of 5 ### A DPDP provision conflicts with a provision of another law. What happens? - Both provisions become void - The other law always wins - The DPDP provision prevails to the extent of the conflict - The parties choose Show the answer **C. The DPDP provision prevails to the extent of the conflict** Section 38(2) says the DPDP provision prevails to the extent of the conflict; section 38(1) otherwise keeps other laws in place. Act s.38 Try again[Next lesson: Who is who in the law](https://foctta.com/learn/the-roles) ## Official sources for this lesson - [The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) - [Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), MeitY, 13 November 2025 (with Schedules)](https://egazette.gov.in/WriteReadData/2025/267650.pdf) - [G.S.R. 843(E), 13 November 2025: dates on which provisions of the DPDP Act come into force](https://egazette.gov.in/WriteReadData/2025/267647.pdf) A plain-English summary of the DPDP Act 2023 and DPDP Rules 2025, checked on 28 September 2026. It is not legal advice. Words in this lesson are explained in the [DPDP dictionary](https://foctta.com/glossary). [← The course **All 12 lessons**](https://foctta.com/learn) [Lesson 2 → **Who is who in the law**](https://foctta.com/learn/the-roles) **In this lesson** 1. Where things stand 2. A law for digital personal data 3. Personal data and processing 4. Where the Act applies 5. Exemptions, at a high level 6. How it sits with other laws 7. Key points 8. In practice 9. Quiz Take the quiz ======== # Accessibility Statement | FOCTTA > FOCTTA's accessibility commitment: WCAG 2.2 AA, IS 17802, RPWD Act 2016, and DPDPA 2023 Section 5(3). Web page: https://foctta.com/legal/accessibility This Markdown copy has the same content as the web page. Built 2026-10-14. --- Legal # Accessibility Statement Last updated: April 2026 ## Our Commitment to Accessibility FOCTTA is committed to making our platform accessible to everyone, including persons with disabilities. We recognise that digital access is a **fundamental right** under Article 21 of the Constitution of India, as affirmed by the Supreme Court in *Pragya Prasun & Ors. v. Union of India* (30 April 2025). Privacy compliance tooling should be usable by everyone - Data Protection Officers, compliance analysts, auditors, and the data principals they serve. ## Standards We Follow FOCTTA is designed to conform to the following accessibility standards: - **WCAG 2.2 Level AA** - Web Content Accessibility Guidelines published by the W3C - **IS 17802 (Part 1:2021 and Part 2:2022)** - Indian Standard for Accessibility of ICT Products and Services, enforceable under the RPWD Amendment Rules 2023 - **Rights of Persons with Disabilities Act, 2016 (RPWD Act)** - Sections 40 and 46, accessibility obligations for ICT products - **SEBI Digital Accessibility Circular dated 31 July 2025** - applicable to our regulated-entity customers - **European Accessibility Act (EAA), Directive (EU) 2019/882** - enforced from 28 June 2025 - **DPDPA 2023, Section 5(3)** - a person can choose to read a privacy notice in English or any of the 22 languages of the Eighth Schedule ## Audit and Conformance FOCTTA's accessibility is evaluated through a combination of automated tooling (axe-core, Lighthouse, WAVE) run continuously in our CI/CD pipeline, and manual keyboard-only and screen-reader testing as part of every release cycle. Independent IAAP-certified audit is scheduled as part of our SEBI compliance cycle. A detailed **Accessibility Conformance Report (ACR/VPAT)** is available on request for enterprise procurement teams. ## Shared Responsibility for Customer-Configured Widgets Where customers (Data Fiduciaries under the DPDPA, 2023) configure customer-facing widgets - notices, preference centres, rights portals - with their own brand, copy, and language, the platform provides tooling to help the Data Fiduciary configure accessible defaults and keep a documented audit of any accessibility exception they elect to accept. This model respects Data Fiduciary autonomy while ensuring informed, documented decisions. ## Feedback and Complaints We welcome feedback on the accessibility of FOCTTA. If you encounter any accessibility barrier, please let us know: - **Email:** [accessibility@foctta.com](mailto:accessibility@foctta.com) - **Response time:** We aim to respond within 2 business days and resolve critical issues within 15 days Under the RPWD Act 2016 and the Supreme Court's 30 April 2025 ruling in *Pragya Prasun v. Union of India*, you have a right to report accessibility failures. You may also file a complaint with the Office of the Chief Commissioner for Persons with Disabilities (CCPD) at the Department of Empowerment of Persons with Disabilities, Government of India. ======== # Cookie Policy | FOCTTA > FOCTTA Cookie Policy. Details about the cookies we use, their purposes, and how to manage your cookie preferences. Web page: https://foctta.com/legal/cookies This Markdown copy has the same content as the web page. Built 2026-10-14. --- Legal # Cookie Policy Last updated: March 2026 ## 1\. What Are Cookies Cookies are small text files that are stored on your device when you visit a website. They are widely used to make websites work efficiently, provide a better user experience, and supply information to site owners. Cookies can be "first-party" (set by the website you visit) or "third-party" (set by a service embedded in the website). We also use similar technologies such as `localStorage` and `sessionStorage` for the same purposes described in this policy. When we refer to "cookies" below, we include these related technologies. As a privacy compliance platform, we practice what we preach: we minimise cookie usage, clearly disclose every cookie we set, and give you control over non-essential cookies. ## 2\. How We Use Cookies We categorise our cookies into four types based on their purpose. Essential cookies cannot be disabled as they are required for the Service to function. ### 1 Essential Cookies These cookies are strictly necessary for the Service to operate. They enable core functionality such as authentication, security, and tenant isolation. The Service cannot function without them, and they cannot be disabled. Cookie Purpose Duration Type vc\_session Maintains your authenticated session across page loads Session First-party vc\_csrf Cross-Site Request Forgery protection token Session First-party vc\_tenant Identifies your tenant context for multi-tenant isolation Session First-party ### 2 Functional Cookies These cookies remember your preferences and settings to provide a more personalised experience. Disabling them will not prevent you from using the Service, but some features may not work as expected. Cookie Purpose Duration Type vc\_theme Stores your UI theme preference (dark/light) 1 year First-party vc\_sidebar Remembers sidebar collapse state 1 year First-party vc\_locale Stores your preferred language setting 1 year First-party vc\_tz Stores your timezone for correct deadline display 1 year First-party ### 3 Analytics Cookies These cookies help us understand how visitors interact with our website and platform. The data collected is aggregated and anonymised. You can opt out of analytics cookies without any impact on functionality. Cookie Purpose Duration Type \_ga Google Analytics: distinguishes unique visitors 2 years Third-party (Google) \_ga\_\* Google Analytics: maintains session state 2 years Third-party (Google) vc\_analytics Anonymous usage analytics for platform improvement 90 days First-party ### 4 Marketing Cookies These cookies are used to track the effectiveness of our marketing campaigns and referral programs. They are only set on the marketing website, not within the application. You can opt out of marketing cookies at any time. Cookie Purpose Duration Type vc\_ref Tracks referral source for attribution 30 days First-party vc\_campaign Tracks marketing campaign for attribution 30 days First-party ## 3\. Managing Your Cookie Preferences You have several options for managing cookies: ### 3.1 Cookie Consent Banner When you first visit our website, a cookie consent banner allows you to accept or reject non-essential cookies. You can change your preferences at any time by clicking the cookie settings link in the footer. ### 3.2 Browser Settings Most web browsers allow you to control cookies through their settings. You can: - View what cookies are set on your device - Delete individual or all cookies - Block third-party cookies - Block cookies from specific sites - Block all cookies (note: this will prevent the Service from functioning) Consult your browser's help documentation for specific instructions: - Chrome: Settings > Privacy and security > Cookies - Firefox: Settings > Privacy & Security > Cookies and Site Data - Safari: Preferences > Privacy > Manage Website Data - Edge: Settings > Cookies and site permissions ### 3.3 Google Analytics Opt-Out You can opt out of Google Analytics across all websites by installing the [Google Analytics Opt-out Browser Add-on](https://tools.google.com/dlpage/gaoptout). ## 4\. Our Cookie Scanner Product As a privacy compliance platform, FOCTTA includes a [Cookie Scanner](https://foctta.com/features/cookie-scanner) module that helps our customers achieve the same level of cookie transparency on their own websites. Our scanner: - Automatically detects and classifies cookies, localStorage, and trackers - Maintains an inventory of a large library of known cookies for auto-classification - Flags unknown cookies for manual review - Generates compliance reports per domain and regulation - Tracks cookie changes over time with scan history We use our own cookie scanner to audit our marketing site and platform, ensuring we practice the same standards we recommend to our customers. ## 5\. Changes to This Cookie Policy We may update this Cookie Policy from time to time to reflect changes in the cookies we use or for regulatory reasons. We will update the "Last updated" date at the top of this page. Material changes will be communicated through our cookie consent banner. ## 6\. Contact Us If you have questions about our use of cookies or this Cookie Policy, please contact us: FOCTTA Technologies Private Limited Data Protection Officer Email: [support@foctta.com](mailto:support@foctta.com) Phone: [+91 98051 89051](tel:+919805189051) ## Need cookie compliance for your site? Our Cookie Scanner module automatically detects, classifies, and monitors cookies across your domains. [Explore Cookie Scanner](https://foctta.com/features/cookie-scanner) [Privacy Policy](https://foctta.com/legal/privacy) ======== # Privacy Policy | FOCTTA > FOCTTA Privacy Policy. How we collect, use, store, and protect your personal data. Your rights under DPDPA, GDPR, and CCPA. Web page: https://foctta.com/legal/privacy This Markdown copy has the same content as the web page. Built 2026-10-14. --- Legal # Privacy Policy Last updated: March 2026 ## 1\. Introduction Foctta Technologies Private Limited ("Foctta", "we", "us", or "our") operates the FOCTTA privacy compliance platform, accessible at foctta.com and its associated services (collectively, the "Service"). This Privacy Policy describes how we collect, use, disclose, and protect your personal data when you visit our website, use our platform, or interact with us in any capacity. We are committed to protecting your privacy and handling your data with transparency | after all, privacy compliance is what we do. By using our Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use our Service. ## 2\. Data We Collect ### 2.1 Account Information When you create an account or are invited to the platform, we collect: - Full name and email address - Organization name and industry - Role and job title - Authentication credentials (managed via AWS Cognito) ### 2.2 Usage Data We automatically collect certain information when you use our Service: - IP address and approximate geographic location (country-level) - Browser type, operating system, and device information - Pages visited, features used, and timestamps of activity - API request metadata (endpoints called, response codes, latency) ### 2.3 Customer-Managed Data As a data processor, we store and process data that our customers ("Data Fiduciaries" under DPDPA, "Data Controllers" under GDPR) upload to the platform. This includes consent records, grievance/DSAR details, processing activity records, and audit logs. This data is owned and controlled by our customers. We process it solely on their instructions and in accordance with our Data Processing Agreement. ### 2.4 Communication Data When you contact us via email, contact forms, or support channels, we collect the content of your communications along with your name and contact details. ## 3\. How We Use Your Data We use your personal data for the following purposes: - **Service delivery:** To provide, maintain, and improve the FOCTTA platform and its features. - **Authentication and security:** To verify your identity, manage access controls, and protect against unauthorized access. - **Communication:** To send service notifications, security alerts, support responses, and product updates. - **Analytics:** To understand how our platform is used, identify performance issues, and improve user experience. - **Legal compliance:** To comply with applicable laws, regulations, and legal processes. - **Business operations:** To manage billing, enforce our terms of service, and prevent fraud or abuse. ## 4\. Lawful Basis for Processing We process your personal data under the following lawful bases: - **Contract performance:** Processing necessary to provide the Service you have subscribed to (GDPR Art. 6(1)(b); DPDPA S.7 deemed consent). - **Legitimate interest:** Analytics, security monitoring, and platform improvement (GDPR Art. 6(1)(f)). - **Consent:** Marketing communications and optional cookies (GDPR Art. 6(1)(a); DPDPA S.6). - **Legal obligation:** Data retention required by tax, accounting, or regulatory requirements (GDPR Art. 6(1)(c); DPDPA S.8). ## 5\. Data Sharing and Disclosure We do not sell your personal data. We share data only in the following circumstances: - **Service providers:** We use third-party providers for infrastructure (AWS), authentication (AWS Cognito), email delivery, and payment processing. These providers are bound by Data Processing Agreements. - **Legal requirements:** We may disclose data when required by law, court order, or government authority, including the Data Protection Board of India. - **Business transfers:** In the event of a merger, acquisition, or asset sale, your data may be transferred as part of the transaction, with prior notice. - **With your consent:** We may share data for purposes you have explicitly consented to. ## 6\. Data Security We implement robust security measures to protect your data: - Strong encryption at rest for all sensitive data - TLS 1.3 encryption for all data in transit - PostgreSQL Database-enforced tenant isolation for database-enforced tenant isolation - managed key rotation for credentials and secrets - Tamper-evident, append-only audit trail for tamper evidence - Role-Based Access Control (RBAC) with 5 predefined roles and 100+ permissions - Regular penetration testing and security assessments While we implement industry-leading security controls, no system is completely immune to threats. We promptly investigate and respond to any suspected security incidents. ## 7\. Data Retention We retain your data according to the following schedule: - **Account data:** For the duration of your account plus 90 days after closure. - **Audit logs:** 7 years in compliance with DPDPA and GDPR record-keeping requirements. Archived to WORM storage after 12 months. - **Usage analytics:** Aggregated and anonymised data retained indefinitely. Identifiable usage data retained for 24 months. - **Customer-managed data:** Retained according to your subscription terms and deleted within 30 days of account termination or upon request. - **Communication records:** Retained for 36 months for support quality and dispute resolution purposes. ## 8\. Your Rights ### 8.1 Under DPDPA (India) As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the right to: - Access a summary of your personal data and processing activities - Correct inaccurate or incomplete personal data - Erase your personal data (subject to legal retention requirements) - Nominate another individual to exercise your rights - Lodge a grievance with us or escalate to the Data Protection Board of India We will respond to DPDPA requests within 90 calendar days. ### 8.2 Under GDPR (EU/EEA) If you are in the European Economic Area, you have the right to: - Access your personal data (Art. 15) - Rectification of inaccurate data (Art. 16) - Erasure / right to be forgotten (Art. 17) - Restriction of processing (Art. 18) - Data portability (Art. 20) - Object to processing (Art. 21) - Withdraw consent at any time (Art. 7) - Lodge a complaint with your local supervisory authority We will respond to GDPR requests within 30 calendar days, extendable by 60 days for complex requests. ### 8.3 Under CCPA/CPRA (California) If you are a California resident, you have the right to: - Know what personal information is collected and how it is used - Delete your personal information - Opt-out of the sale of personal information (we do not sell your data) - Non-discrimination for exercising your rights - Correct inaccurate personal information - Limit the use of sensitive personal information We will respond to CCPA requests within 45 calendar days. ## 9\. Cookies and Tracking Technologies We use cookies and similar technologies to provide functionality, analyse usage, and improve your experience. For detailed information about the cookies we use and how to manage them, please see our [Cookie Policy](https://foctta.com/legal/cookies). ## 10\. International Data Transfers Your data may be transferred to and processed in countries outside your jurisdiction. We ensure appropriate safeguards are in place for all cross-border transfers: - Standard Contractual Clauses (SCCs) approved by the European Commission - Adequacy decisions where applicable - Data Processing Agreements with all sub-processors - Compliance with DPDPA cross-border transfer restrictions as prescribed by the Central Government ## 11\. Children's Privacy Our Service is designed for business use and is not directed to children under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately at [support@foctta.com](mailto:support@foctta.com) and we will promptly delete it. ## 12\. Changes to This Policy We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting a notice on our website or sending an email to your registered address at least 30 days before the changes take effect. We encourage you to review this Privacy Policy periodically. Your continued use of the Service after the effective date of any changes constitutes acceptance of the updated policy. ## 13\. Contact Us If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us: FOCTTA Technologies Private Limited Data Protection Officer Email: [support@foctta.com](mailto:support@foctta.com) Phone: [+91 98051 89051](tel:+919805189051) For DPDPA grievances, you may also escalate to the Data Protection Board of India if you are unsatisfied with our response within the statutory timeframe. ## Questions about your data? We take your privacy seriously. Reach out to our Data Protection Officer for any concerns. [Contact Us](https://foctta.com/contact) [Security Architecture](https://foctta.com/security) ======== # Terms of Service | FOCTTA > FOCTTA Terms of Service. The terms and conditions governing your use of the FOCTTA privacy compliance platform. Web page: https://foctta.com/legal/terms This Markdown copy has the same content as the web page. Built 2026-10-14. --- Legal # Terms of Service Last updated: March 2026 ## 1\. Acceptance of Terms These Terms of Service ("Terms") constitute a legally binding agreement between you ("Customer", "you", or "your") and FOCTTA Technologies Private Limited ("FOCTTA", "we", "us", or "our") governing your access to and use of the FOCTTA privacy compliance platform, including all associated services, APIs, SDKs, and documentation (collectively, the "Service"). By creating an account, accessing the Service, or clicking "I Agree", you acknowledge that you have read, understood, and agree to be bound by these Terms. If you are accepting these Terms on behalf of an organization, you represent and warrant that you have the authority to bind that organization. If you do not agree to these Terms, you must not access or use the Service. ## 2\. Definitions - **"Customer Data"** means all data uploaded, submitted, or generated by you or your end users through the Service, including consent records, DSAR requests, processing activities, audit logs, and configuration settings. - **"Subscription"** means your selected service tier (Starter, Professional, or Enterprise) and associated usage limits. - **"Users"** means individuals authorized by you to access the Service under your account, each assigned one of the five RBAC roles. - **"API"** means the FOCTTA REST API, SDKs, and webhook endpoints provided as part of the Service. - **"Tenant"** means your isolated organizational environment within the FOCTTA platform, enforced by database-level Database-enforced tenant isolation. ## 3\. Account Terms **3.1 Registration.** You must provide accurate, complete, and current information during registration. You are responsible for maintaining the accuracy of your account information. **3.2 Account Security.** You are responsible for safeguarding your account credentials, API keys, and webhook secrets. You must notify us immediately at [support@foctta.com](mailto:support@foctta.com) if you become aware of any unauthorized access. **3.3 User Management.** You are responsible for managing Users within your Tenant, including assigning appropriate roles (DPO, Compliance Analyst, Legal Reviewer, IT Admin, Read-Only Auditor) and revoking access when no longer needed. **3.4 Age Requirement.** You must be at least 18 years of age to use the Service. The Service is designed for business use and is not intended for consumers or minors. ## 4\. Service Description and Usage **4.1 Platform Access.** Subject to these Terms and payment of applicable fees, we grant you a non-exclusive, non-transferable, revocable right to access and use the Service during the Subscription term for your internal business purposes. **4.2 API Usage.** You may integrate with the Service via our API subject to documented rate limits (10,000 req/min for consent checks, 1,000 req/min for mutations, 5 req/min for bulk operations per tenant). We reserve the right to throttle or suspend API access if usage exceeds these limits or threatens platform stability. **4.3 Acceptable Use.** You agree not to: (a) reverse engineer, decompile, or disassemble the Service; (b) use the Service to process data in violation of applicable privacy laws; (c) attempt to circumvent tenant isolation, tenant-isolation policies, or RBAC controls; (d) use the Service for any illegal purpose; (e) resell or sublicense the Service without prior written consent; (f) interfere with or disrupt the integrity or performance of the Service. **4.4 Subscription Tiers.** Features are gated by Subscription tier. A/B testing requires Professional or higher. Custom webhooks require Enterprise. Feature availability may change with reasonable notice. ## 5\. Payment Terms **5.1 Fees.** You agree to pay all fees associated with your Subscription tier as described in the applicable order form or pricing page. All fees are quoted in Indian Rupees (INR) or United States Dollars (USD) as specified. **5.2 Billing Cycle.** Subscriptions are billed monthly or annually in advance. Annual subscriptions receive a discount as published on our pricing page. **5.3 Taxes.** All fees are exclusive of applicable taxes, including GST (India), VAT (EU), and sales tax (US). You are responsible for all applicable taxes except those based on our net income. **5.4 Late Payment.** Invoices are due within 30 days. Overdue amounts may accrue interest at the lesser of 1.5% per month or the maximum rate permitted by law. We reserve the right to suspend Service access for accounts overdue by more than 15 days. **5.5 Refunds.** Annual subscriptions may be refunded on a pro-rata basis within the first 30 days. Monthly subscriptions are non-refundable. Refunds are processed within 14 business days. ## 6\. Data Ownership and Privacy **6.1 Your Data.** You retain all rights, title, and interest in your Customer Data. We do not claim ownership of any data you upload to the Service. You grant us a limited license to process your Customer Data solely for the purpose of providing the Service. **6.2 Data Processing.** We process Customer Data as a data processor (GDPR) / data processor (DPDPA) / service provider (CCPA) on your behalf. Our processing is governed by the Data Processing Agreement incorporated by reference into these Terms. **6.3 Tenant Isolation.** Your Customer Data is isolated from other customers at the database level via PostgreSQL Database-enforced tenant isolation. No customer can access another customer's data through any means. **6.4 Data Portability.** You may export your Customer Data at any time via the platform's export features (CSV, JSON, PDF). Upon Subscription termination, we will make your data available for export for 30 days before deletion. **6.5 Privacy Policy.** Our collection and use of personal data is described in our [Privacy Policy](https://foctta.com/legal/privacy), which is incorporated by reference. ## 7\. Intellectual Property **7.1 Our Property.** The Service, including all software, APIs, documentation, designs, algorithms, and underlying technology, is and remains the exclusive property of FOCTTA. These Terms do not grant you any intellectual property rights in the Service except the limited usage rights described herein. **7.2 Feedback.** If you provide suggestions, feature requests, or other feedback regarding the Service ("Feedback"), you grant us a perpetual, irrevocable, royalty-free license to use, modify, and incorporate such Feedback into the Service without attribution or compensation. **7.3 Trademarks.** "FOCTTA" and associated logos are trademarks of FOCTTA Technologies Private Limited. You may not use our trademarks without prior written permission, except as reasonably necessary to identify the Service in your own documentation. ## 8\. Warranties and Disclaimers **8.1 Service Warranty.** We warrant that the Service will perform materially in accordance with our published documentation during your Subscription term. If the Service fails to conform, your exclusive remedy is for us to use commercially reasonable efforts to correct the non-conformity. **8.2 Uptime Commitment.** We target 99.9% uptime for the Service, measured monthly. Scheduled maintenance windows are excluded from uptime calculations and will be communicated at least 48 hours in advance. **8.3 Disclaimer.** EXCEPT AS EXPRESSLY SET FORTH HEREIN, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE". WE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR COMPLETELY SECURE. **8.4 No Legal Advice.** The Service is a compliance management tool. It does not constitute legal advice. You are responsible for determining the applicability of privacy laws to your operations and should consult qualified legal counsel. ## 9\. Limitation of Liability **9.1 Cap.** TO THE MAXIMUM EXTENT PERMITTED BY LAW, OUR TOTAL AGGREGATE LIABILITY FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE SHALL NOT EXCEED THE AMOUNT YOU PAID US IN THE 12 MONTHS PRECEDING THE CLAIM. **9.2 Exclusion.** IN NO EVENT SHALL WE BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING LOSS OF PROFITS, DATA, REVENUE, GOODWILL, OR BUSINESS OPPORTUNITY, REGARDLESS OF THE CAUSE OF ACTION OR THEORY OF LIABILITY. **9.3 Exceptions.** The limitations in this section do not apply to: (a) your breach of Section 4.3 (Acceptable Use); (b) your payment obligations; (c) either party's indemnification obligations; (d) liability that cannot be excluded under applicable law. ## 10\. Indemnification **10.1 Your Indemnification.** You agree to indemnify and hold FOCTTA harmless from any claims, damages, losses, and expenses (including reasonable legal fees) arising from: (a) your use of the Service in violation of these Terms; (b) your Customer Data; (c) your violation of any applicable law or regulation; (d) your breach of any third-party rights. **10.2 Our Indemnification.** We will indemnify and defend you from third-party claims alleging that the Service infringes any patent, copyright, or trademark, provided you give us prompt notice and reasonable cooperation in the defense. ## 11\. Termination **11.1 By You.** You may terminate your Subscription at any time by contacting us or through the account settings. For annual subscriptions, termination takes effect at the end of the current billing period. **11.2 By Us.** We may suspend or terminate your access if: (a) you breach these Terms and fail to cure within 30 days of notice; (b) your account is overdue by more than 30 days; (c) you engage in activity that threatens the security or integrity of the Service; (d) required by law or regulatory authority. **11.3 Effect of Termination.** Upon termination: (a) your access to the Service is revoked; (b) your Customer Data remains available for export for 30 days; (c) after the 30-day grace period, your Customer Data is permanently deleted from our systems; (d) audit log archives in WORM storage are retained for 7 years per regulatory requirements. **11.4 Survival.** Sections 6 (Data Ownership), 7 (Intellectual Property), 8 (Disclaimers), 9 (Limitation of Liability), 10 (Indemnification), and 13 (Governing Law) survive termination. ## 12\. Modifications to Terms We may modify these Terms from time to time. We will provide at least 30 days' notice of material changes by email or in-app notification. Your continued use of the Service after the effective date constitutes acceptance of the modified Terms. If you do not agree to the modified Terms, you must discontinue use before the effective date. ## 13\. Governing Law and Dispute Resolution **13.1 Governing Law.** These Terms are governed by the laws of India, without regard to conflict of law principles. For customers in the European Economic Area, mandatory consumer protection laws of your country of residence apply. **13.2 Arbitration.** Any dispute arising from these Terms shall be resolved by binding arbitration administered under the Arbitration and Conciliation Act, 1996 (India). The seat of arbitration shall be Bangalore, India. The language of arbitration shall be English. **13.3 Injunctive Relief.** Nothing in this section prevents either party from seeking injunctive or other equitable relief in any court of competent jurisdiction to prevent the actual or threatened infringement of intellectual property rights or breach of confidentiality obligations. ## 14\. General Provisions **14.1 Entire Agreement.** These Terms, together with the Privacy Policy, Cookie Policy, and any applicable order form, constitute the entire agreement between you and FOCTTA regarding the Service. **14.2 Severability.** If any provision of these Terms is found to be unenforceable, the remaining provisions continue in full force and effect. **14.3 Waiver.** Our failure to enforce any right or provision does not constitute a waiver of that right or provision. **14.4 Assignment.** You may not assign these Terms without our prior written consent. We may assign these Terms in connection with a merger, acquisition, or sale of all or substantially all of our assets. **14.5 Force Majeure.** Neither party shall be liable for any failure or delay caused by circumstances beyond its reasonable control, including natural disasters, war, terrorism, pandemic, government action, or infrastructure failures. **14.6 Notices.** All legal notices must be sent to [legal@foctta.com](mailto:legal@foctta.com) or to the email address associated with your account. ## 15\. Contact FOCTTA Technologies Private Limited Legal Department Email: [legal@foctta.com](mailto:legal@foctta.com) Phone: [+91 98051 89051](tel:+919805189051) ## Have questions about our terms? Our team is here to help clarify any aspect of our terms and conditions. [Contact Us](https://foctta.com/contact) [Privacy Policy](https://foctta.com/legal/privacy)