Lesson 50 of 50 for advisers · Client data and the DPDP Act · 4 min read · Reviewed 13 Nov 2026
Yes. The Act has no small-business exemption; the government may exempt classes such as startups from some duties but hasn’t. A distributor or adviser holding client data is a data fiduciary. Most duties, including notice, security, breach reporting and erasure, apply from 13 May 2027, 18 months after the Rules were notified on 13 Nov 2025.
The Rules were notified on 13 Nov 2025. Consent managers start on 13 Nov 2026, and most duties on 13 May 2027.
A notice must stand on its own, list the data item by item, state the purpose, and show how to withdraw consent as easily as it was given.
Minimum safeguards include encryption or masking, access control, logs kept a year, backups and security terms in contracts with service providers.
A breach is told to each affected person and the Data Protection Board without delay, with a detailed report to the Board within 72 hours.
Key idea: Erase data once consent is withdrawn or the purpose is served, unless a law requires keeping it, and answer grievances within 90 days.
Try the short quiz on this page to check what stuck.
Up to ₹250 crore for failing to take security safeguards.
Up to ₹200 crore for failing to notify.
MeitY consulted on it in early 2026; no amendment had been notified by 13 Nov 2026.
For learning only, not investment advice. Built in India by a team that tracks its own money on Reva.