# DPDPA compliance, GDPR and CCPA, with RBI, SEBI and IRDAI clocks | FOCTTA > The DPDP Act 2023 and Rules 2025 section by section, GDPR and CCPA, and the sector regulator bundles FOCTTA ships today. Web page: https://foctta.com/regulations This Markdown copy has the same content as the web page. Built 2026-10-14. --- Regulations # Built on India's DPDP Act. Ready for GDPR and CCPA. One platform answers three privacy laws and India's sector regulators, each with its own clocks, notices and evidence. DPDP Act 2023 India's data protection law GDPR The EU's data protection law CCPA and CPRA California's consumer privacy law Sector regulators Banking, markets, insurance and cyber rules ## Pick a section. See what FOCTTA does for it. Each section of the DPDP Act sets a duty. Pick one to see what the law asks and how FOCTTA helps. Penalties up to ₹250 crore Notice S.5 Consent S.6 Legitimate uses S.7 Processors S.8(2) Breach S.8(6) Erasure S.8(7) Inactivity S.8(8) Children S.9 Extra duties S.10 Access S.11 Correction S.12 Grievance S.13 Nomination S.14 Cross-border S.16 Rights portal R.14 The Board S.27 S.5 · Notice **The Act asks:** An itemised notice before or with the consent request, with how to withdraw and complain. Versioned notices that cannot publish without the complaint route. Every consent stamped with the notice in force Served by country, language and brand Re-consent when the notice changes S.6 · Consent **The Act asks:** Free, specific, informed and unambiguous consent, and withdrawal as easy as giving it. A consent ledger that proves yes, proves no, and enforces withdrawal. One record per person, purpose and business unit Refusals recorded as evidence Withdrawal applied on every server at once S.7 · Legitimate uses **The Act asks:** Processing without consent only for the uses the Act lists. The lawful basis is on every record, and the DPIA reads it. Deemed consent and legitimate uses recorded as the basis Assessments conclude from the recorded basis, never a guess S.8(2) · Processors **The Act asks:** Processors engaged only under a valid contract. Sharing consent is refused without an active processing contract (DPA). Processor register with DPA status and expiry Alerts at 180, 90, 60, 30, 14 and 0 days DPA clause checklist S.8(6) · Personal data breach **The Act asks:** Inform the Board and each affected person of a breach. Parallel regulator clocks from the moment you know. CERT-In, RBI, SEBI 6h; IRDAI copy; Board from May 2027 Blast radius matched to your data map Board breach report and a drafted action plan S.8(7) · Erasure **The Act asks:** Erase when consent is withdrawn or the purpose is served, unless law requires retention. A legal decision tree for every system, with a certificate. Retention reasons from a catalogue of 11 laws Legal hold respected Processors confirm erasure by secure link S.8(8) · Erasing inactive accounts (Third Schedule) **The Act asks:** Erase after the prescribed inactivity, with a 48-hour notice first. The 48-hour notice by WhatsApp, SMS or email, then erasure. Dormant users found for the Third Schedule classes Legal hold respected S.9 · Children's data **The Act asks:** Verifiable guardian consent, and no tracking or targeted ads at children. Tracking blocked for children, even when they tap Accept All. Child-directed mode and an under-18 choice Guardian details required and encrypted Children's data makes a DPIA mandatory S.10 · Significant Data Fiduciary **The Act asks:** A DPO in India, independent audit, periodic DPIA and algorithmic due diligence. The extra duties of a Significant Data Fiduciary, as one governed chain. Annual DPIA with the Rule 13(3) step Auditor attestation and board sign-off Rule 13(2) submission bundle S.11 · Right to access **The Act asks:** A summary of the data, the processing and who it was shared with. An access package with India-aware redaction. No tipping off, Aadhaar and PAN masking ZIP with manifest, checksums and certificate S.12 · Correction and erasure **The Act asks:** Correct, complete, update or erase on request. Correction fanned out to every system, with rollback. Re-KYC routing for hard fields Correction certificate S.13 · Grievance redressal **The Act asks:** An effective grievance mechanism within the prescribed period. A 12-state workflow on the 90-day clock. Public form with 13 categories Warnings at 50, 75 and 90 percent Board escalation packet after redressal S.14 · Right to nominate **The Act asks:** Let a person nominate someone to act for them. Two-party confirmation and a cooling-off hold. One-time codes for both parties Waiver only by two different approvers S.16 · Cross-border transfer **The Act asks:** Transfers restricted only to countries the government notifies. Transfer country and safeguards on every vendor. Per-vendor transfer records A cross-border register in the evidence pack, with Discovery (DSPM) R.14 · Publishing how to exercise rights **The Act asks:** Publish how to exercise rights and which identifiers are needed. A rights portal builder per business unit. Identifier sets under Rule 14(5) Identity floors that rise for BFSI and children S.27 · Complaints to the Board **The Act asks:** A person may complain to the Data Protection Board. The Board complaint link on every banner and notice. Tamper-evident escalation packet The person records their Board filing reference **The DPDP timeline** 13 Nov 2025 **Rules notified** The Data Protection Board and definitions came into force. **Nov 2026 Consent Manager rules**: Rules begin for companies registered to manage people's consents. Consent Manager provisions start under Rule 4. The Board has not yet published how to apply. May 2027 **Main obligations** Notice, consent, security, breach reporting and rights apply. EU · GDPR ## GDPR for your EU customers. The same console that runs your DPDP programme answers people in the EU, with GDPR clocks, notices and clauses. Fines up to €20 million or 4% of worldwide annual turnover. Notices by location EU visitors see the GDPR notice in their language. **30-day request clock Staff-entered**: Answer EU people's data requests within 30 days. With the 60-day extension, and warnings at 50, 75 and 90 percent, on requests your team logs. Processor contract checks 12 contract clauses tracked for each vendor. GDPR Art. 28 · DPA 72-hour breach clock The GDPR breach deadline, next to the Indian clocks. **Legal grounds for use GDPR lawful bases**: Record the legal ground for each use of data. Consent, contract, legal obligation, vital interest, public task and legitimate interest. Risk assessment templates Ready-made GDPR and multi-law risk assessments. DPIA · TIA **Signed GDPR evidence pack Pilot**: A signed bundle of proof for GDPR audits. With FOCTTA Discovery (DSPM). US · CCPA ## CCPA and CPRA for your California customers. Switch CCPA on when you serve California. Notices, service-provider clauses and request clocks sit in the same console as your DPDP programme. Civil penalties per violation, higher for intentional violations. Notices by location US visitors see the CCPA notice. Service provider contracts 8 contract clauses tracked for each service provider. CCPA **45-day request clock Staff-entered**: Answer California data requests within 45 days. With the 45-day extension, on requests your team logs. **Signed CCPA evidence pack Pilot**: A signed bundle of proof for CCPA audits. With FOCTTA Discovery (DSPM). India · Sector ## India's sector regulators, built in. Breach clocks, retention rules and content packs for the regulators your board answers to, and 17 more regulator bundles ready to apply. From May 2027 these run alongside the DPDP Board duty. **Banking regulator RBI**: A 6-hour clock for cyber incident reports to RBI. 6-hour cyber incident clock on DAKSH (2026 Directions), credit-information correction compensation and BFSI identity floors. **Securities regulator SEBI CSCRF Evidence pack with Discovery (DSPM)**: 6-hour notice, then a portal report at 24 hours. 6-hour notice and 24-hour portal report, a signed CSCRF evidence pack and a DR and BCP log. **Insurance regulator IRDAI**: 6-hour CERT-In report, with a copy to IRDAI. 6-hour CERT-In report copied to IRDAI, and IRDAI record-retention reasons. National cyber agency 6-hour reporting clock and a ready report bundle. CERT-In **Record-keeping laws PMLA · Companies Act · tax**: Records these laws require are kept, not erased. Retention reasons in the erasure catalogue, and STR details kept out of access packages (no tipping off). **Broadcast and accessibility TRAI · MIB · RPwD**: Broadcast overlays and a colour contrast check. Broadcasting overlays and a WCAG AA contrast check that supports RPwD s.46 duties. **Banking and markets bundles Regulator bundle**: Ready rule sets for banks and market firms. RBI 2026 cybersecurity Directions (DAKSH), SEBI CSCRF and SEBI BRSR Core. **Cyber and critical sectors Regulator bundle**: Rule sets for cyber reporting, critical systems and power. The CERT-In 6-hour direction, NCIIPC critical information infrastructure and the CEA power sector cyber rules. **Identity, health and gaming Regulator bundle**: Rule sets for Aadhaar, health data and gaming. UIDAI Aadhaar offline eKYC, the ABDM health information exchange and the MeitY online gaming rules. **Money, trade and sanctions Regulator bundle**: Money-laundering, foreign exchange and sanctions rules. FIU-IND suspicious transaction reporting, FEMA, FCRA, DGFT, STPI and SEZ, PNGRB and sanctions screening. ## Main DPDP obligations start in May 2027. [Check how ready you are](https://foctta.com/readiness) [Book a demo](https://foctta.com/company)