Every company, society, trust, LLP and professional practice that touches an Indian's personal data is a Data Fiduciary under the DPDP Act — whether or not it ever meant to be. JurisTatva builds the notices, consent architecture, registers, policies and SOPs that turn that exposure into a documented, defensible compliance file.
It asks whether you determine the purpose and means of processing digital personal data in India. A "person" under Sec. 2(s) includes companies, societies, trusts, LLPs, sole proprietors and unincorporated associations alike — for-profit or not.
Resolutions, registers, notices, consent forms, policies, agreements and SOPs — every "shall"-type obligation in the Act mapped to a specific deliverable, not a slide.
Each stage closes with a reviewable deliverable, not a status update — so your compliance file grows in fixed, verifiable increments.
The Data Protection Board of India can impose these amounts directly — without displacing a Data Principal's right to separately pursue civil remedies.
Penalty bands reflect the Schedule to the DPDP Act, 2023. Timelines follow prevailing practice under the Act and Rules and should be confirmed for your specific facts.
A short diagnostic call maps your data flows against the DPDP checklist and tells you precisely where your exposure sits — before we quote a single rupee of fee.
Any person — including a company, LLP, society, trust or sole proprietor — that determines the purpose and means of processing digital personal data in India is a Data Fiduciary under Section 2(i), regardless of whether it is for-profit or not-for-profit.
A Data Fiduciary must notify the Data Protection Board of India and each affected Data Principal without delay, with a detailed report generally expected within 72 hours of becoming aware of the breach.
The Data Protection Board can impose penalties of up to ₹250 crore for failing to take reasonable security safeguards, with separate bands of up to ₹200 crore (breach notification and children's data) and up to ₹50 crore for other categories of non-compliance.
Entities generally build their grievance-redressal SOP around a 90-day outer limit for resolving a Data Principal's rights request or grievance.
A defensible compliance file typically includes a data-mapping register, consent notices and logs, a master privacy policy, retention and breach policies, vendor DPAs, and SOPs for breach, grievance and rights-request handling — JurisTatva's framework organises 44 such instruments across 7 layers.
Yes. A "person" under Section 2(s) includes companies, societies, trusts, LLPs, sole proprietors and unincorporated associations alike. A not-for-profit or society structure gives no exemption where the entity processes digital personal data in India.
A diagnostic call tells you precisely which of the 44 instruments apply to your data flows.
A corporate and regulatory advisory company dedicated to helping businesses navigate India's complex legal and compliance landscape with clarity, precision, and professional excellence.
© 2026 All Rights Reserved by JurisTatva Advisors Private Limited.