Who needs a Data Protection Officer (DPO) under the DPDPA 2023?

Appointment of a DPO is mandatory for entities designated as Significant Data Fiduciaries (SDFs) under the Digital Personal Data Protection Act, 2023. Other Data Fiduciaries — including most MSMEs that process sensitive personal data at scale — are strongly encouraged to designate a person performing equivalent functions to manage compliance, grievances and regulator interface.

What does DPO-as-a-Service include for an Indian MSME?

DRMLAW's DPO-as-a-Service appoints an external Data Protection Officer with board-level reporting. The engagement covers data mapping and Records of Processing (RoPA), gap assessments, DPIAs, privacy notices and consent architecture, Data Principal request management, vendor & third-party risk management, staff training, breach response and supervisory authority representation.

Why outsource the DPO role instead of appointing an internal staff member?

Internal legal counsel, CTOs or HR managers who directly decide how personal data is used to drive the business often face a conflict of interest when also designated as DPO. An external DPO guarantees unbiased monitoring and an independent line of defence at the board level — frequently a prerequisite for regulator credibility.

Is digital evidence admissible in Indian courts?

Yes, subject to compliance with Section 65B of the Indian Evidence Act, 1872 and the corresponding provisions of the Bharatiya Sakshya Adhiniyam, 2023. A certificate authenticating the integrity of the electronic record is required. DRMLAW maintains trial-tested templates aligned with current Supreme Court jurisprudence including Arjun Panditrao.

Where does DRMLAW practise?

DRMLAW is headquartered in Kolkata with a presence in Bengaluru, with primary appearances before the Hon'ble High Court at Calcutta and the Supreme Court of India. Pan-India representation is provided through an associated counsel network for matters in other High Courts and tribunals.

DPDPA Compliance Self-Assessment · Indian Real Estate · DRMLAW

Q1 · §6 · Consent

1 / 10

When your sales team collects a home buyer's Aadhaar, PAN, income proof, or co-applicant documents at the time of booking or expression of interest — how is consent obtained?

§6 — Consent must be freely given, specific, informed, unambiguous.

Q2 · §5 · Privacy Notice

2 / 10

Does your organisation provide home buyers and prospective buyers with a written privacy notice — at or before the point of data collection — that specifies what data is collected, why, how long it is kept, and with whom it is shared?

§5 — Must give notice at/before collection covering data category, purpose, rights.

Q3 · §8(1) · Purpose Limitation

3 / 10

Your CRM contains leads collected from property expos, online portals (99acres, MagicBricks, Housing.com), digital campaigns, and broker referrals. How does your organisation use this data beyond the initial enquiry?

§8(1) — No use other than the specified purpose for which consent was obtained.

Q4 · §8(2) · Processor Contracts

4 / 10

Your organisation works with home loan DSAs, referral brokers, channel partners, payment gateway operators, and digital marketing agencies — all of whom handle buyer personal data on your behalf. Do you have written Data Processing Agreements (DPAs) with each of them?

§8(2) — Must ensure data processors are bound by contract.

Q5 · §8(7) + §8(5) · Erasure & Security

5 / 10

When a prospective buyer does not proceed, or when a booking is cancelled, or after property registration is complete — what happens to their Aadhaar, PAN, income certificates, bank statements, and other KYC documents stored in your systems?

§8(7) — Erasure after purpose served; §8(5) — Security safeguards required.

Q6 · §8(6) · Breach Notification

6 / 10

Under DPDPA §8(6), a personal data breach must be notified to the Data Protection Board of India within 72 hours. Does your organisation have a breach detection and escalation protocol that can meet this obligation?

§8(6) — Must notify Data Protection Board within 72 hours.

Q7 · §4 · Multi-State Ops

7 / 10

Your organisation operates real estate projects across multiple states (e.g., West Bengal, Maharashtra, Karnataka, Tamil Nadu, Telangana). Home buyer KYC is collected locally at project sales offices in each state. How is DPDPA compliance managed across these dispersed operations?

§4 — Act applies to any processing in India; requires a unified framework.

Q8 · §4 + §7 · RERA Portal

8 / 10

Under RERA, your organisation submits project information, promoter details, and in some states, buyer data to state RERA portals (MahaRERA, WBRERA, KRERA, etc.). Has your organisation assessed the DPDPA implications of these mandatory regulatory data submissions?

§4 + §7 — Relationship between RERA and DPDPA is not yet judicially settled.

Q9 · §11–13 · Principal Rights

9 / 10

Under DPDPA §11–13, home buyers have the right to access their own personal data held by you, to correct inaccuracies, and to request erasure of their data. Does your organisation have a mechanism to handle such requests within the legally required timeframe?

§11–13 — Rights to access, correct, erase, and grievance redressal.

Q10 · §8 · CRM & Architecture

10 / 10

Your CRM and IT systems form the operational backbone of your DPDPA compliance — or non-compliance. Which statement best describes your current CRM and data architecture in relation to DPDPA requirements?

§8 + Privacy-by-Design — Requires metadata, purpose tags, and audit logs.