1. 04 Your vendors hold your customers’ data tooThe storefront, the courier, the WhatsApp tool, the email app. Each one holds your customers’ data, and the Act still holds you responsible for it. 28 October 20263 min read

   A small online brand rarely keeps its customers’ data in one place. The order sits on the storefront. The address goes to the courier. The phone number goes to the WhatsApp tool, the email to the newsletter app, the payment to the gateway, and a copy of all of it ends up in a spreadsheet someone shared last Diwali. Count them, and the number is usually higher than anyone expected.

   The Act’s word for them

   When another company processes personal data on your behalf, the Act calls it a Data Processor. You, the business that decides why and how the data is used, are the Data Fiduciary. The difference matters because of what section 8 says next.

   You stay responsible

   • Section 8(1): you are responsible for complying with the Act for any processing done on your behalf by a Data Processor, whatever your agreement with them says.
   • Section 8(2): you may engage a Data Processor only under a valid contract.
   • Section 8(5): your duty to take reasonable security safeguards covers processing done by your Data Processors too. Rule 6(1)(f) asks for those safeguards to be written into the contract.
   • Section 8(7)(b): when the data has to be erased, you must make your Data Processors erase it as well.

   What this looks like in practice

   Most of these contracts already exist: they are the terms you clicked through when you signed up for each tool. The work is finding them, reading what they say about security and deletion, and noting where a tool stores data. Where you have no contract at all, such as a freelancer with access to your order sheet, that is the gap to close first.

   Do this week: list every tool and person that can see your customers’ data. Next to each, note whether you have a contract and where it is. One sheet, ten minutes a tool, and you will know where you stand.

   Read issue 04 on its own page

2. 03 Six hours, seventy-two hoursThe two clocks that start the moment you find a data breach, and what each one asks of you. 21 October 20263 min read

   Most companies will find out about a breach on an ordinary afternoon: a staff inbox taken over, a laptop left in a cab, a spreadsheet sent to the wrong client. What happens next is already timed.

   The first clock runs today

   Under the CERT-In Directions of April 2022, a body corporate must report a data breach, a data leak or unauthorised access to its systems to CERT-In within six hours of noticing it. This applies now, not in 2027. It also asks you to keep logs for 180 days, in India.

   The second clock starts on 13 May 2027

   Rule 7 of the DPDP Rules asks you to tell each affected person without delay, in plain language: what happened, what it could mean for them, what you have done, what they can do, and who to contact. The Data Protection Board must hear from you without delay too, followed within 72 hours by a full report: the facts, the cause, the fixes and the notices you sent.

   Why it matters

   The Board’s clock for the detailed report starts on reasonable suspicion, not on confirmation. Working out who to tell, and how, is not something to start on the afternoon it happens.

   Do this week: write down who calls whom, who writes to CERT-In, and where your logs live. A one-page plan, made in advance, is most of the work.

   Read issue 03 on its own page

3. 02 Consent is a button, not a sentenceWhy “by continuing you agree” will not survive the Act, and what valid consent looks like on a real page. 14 October 20263 min read

   Section 6 of the DPDP Act sets the bar: consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data needed for the purpose.

   What fails

   • Pre-ticked boxes, and banners that only offer “OK”.
   • “By continuing to browse, you agree.” Scrolling is not an affirmative action.
   • One consent for many unrelated purposes.
   • An “Accept” button that stands out while “Reject” hides in grey.

   What works

   • A notice first, in plain words, itemising the data and why you want it (section 5). People can ask for it in English or any language in the Eighth Schedule.
   • A separate choice for each purpose, off until someone switches it on.
   • Withdrawal as easy as giving it: the same two clicks, any time (section 6(4)).
   • A record of what each person agreed to, and when. If it is ever disputed, the burden of proof is on you (section 6(10)).

   This website asks the same way. Its one optional purpose stays off until you choose, and Privacy settings, at the foot of the page, undoes it in a click.

   Read issue 02 on its own page

Read every issue of The Brief