Frequently asked questions
Practical answers to common compliance questions
Use these answers as general guidance. Applicability, timelines and the right response can depend on your organization’s specific facts.
Compliance Legal
Clarity for confident action
DPDP Act
Data privacy questions
Applicability, governance, vendors, consent and response readiness.
Which organizations should assess DPDP applicability?
Organizations processing digital personal data in India, and certain processing connected with offering goods or services to Data Principals in India, should assess how the framework applies to their activities.
Does every organization need a privacy policy?
Organizations should provide appropriate notices and establish internal policies and controls proportionate to their processing, role and applicable obligations.
Is consent always required?
Consent is a central ground under the Act, alongside specified legitimate uses. The appropriate approach depends on the processing context and applicable provisions.
What is a Data Fiduciary?
A Data Fiduciary is a person who alone or with others determines the purpose and means of processing personal data.
Do vendors need to be reviewed?
Yes. Data Fiduciaries remain responsible for processing carried out on their behalf and should establish suitable due diligence, instructions, contractual terms and monitoring.
What should a breach plan contain?
It should define detection, escalation, assessment, containment, communication, notification where applicable, documentation and corrective action responsibilities.
Where should a DPDP programme begin?
Begin with data discovery, processing purposes, notices, consent practices, vendors, security, grievance arrangements and clear internal ownership.
Is a template privacy policy enough?
No. Public notices and internal policies should reflect actual data practices. A document that does not match operations can create confusion and weak accountability.
POSH Act
Workplace safety questions
Committee constitution, awareness, process and confidentiality.
When is an Internal Committee required?
A workplace with ten or more employees must constitute an Internal Committee in accordance with the Act. Organizational structure and workplace locations should also be reviewed.
Does the Internal Committee need an external member?
Yes. The committee must include an eligible external member with the association, familiarity or experience required by the Act.
Who should be the Presiding Officer?
The Presiding Officer should be a senior-level woman employee at the workplace, subject to the specific provisions that apply when such an employee is unavailable.
Can a complaint be made electronically?
Organizations should provide an accessible complaint route and handle complaints in accordance with the applicable procedure and timelines.
How often should awareness training be conducted?
Induction and periodic refresher programmes support prevention. Frequency should reflect workforce changes, risk and organizational needs.
Are proceedings confidential?
Yes. Strict confidentiality applies to specified information concerning complaints, identities, proceedings, recommendations and action taken.
What records should an employer maintain?
Employers should maintain appropriate committee, awareness and reporting records while protecting complaint-related confidentiality and limiting access.
Can managers handle a complaint informally?
Managers should not improvise or conduct a parallel inquiry. They should know how to respond sensitively, preserve confidentiality and promptly use the organization’s approved escalation route.
General information, not case-specific advice
These answers are designed to improve general understanding. A complaint, data incident, regulatory question or complex organizational structure may require confidential review of the facts before a course of action is selected.
Still have a question?
Share the general context and we will help identify an appropriate next step.