DPDP Daily

About DPDP Daily

India's data protection law, decoded - one practical episode every day. I take the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 out of the statute book and into real life: what the law demands, what businesses get wrong, what regulators will check, and what you can now demand as a citizen. From large enterprises to kirana stores, from consent managers to the ₹250 crore penalty, this is compliance without the jargon, from the author of the DPDP Act Compliance Handbook: From Law to Ground Reality. New episodes daily. Educational content, not legal advice.

Publisher

Harmeet S. Kapoor

Category

education

Language

en

Explicit

No

First episode

21 Jul 2026

Latest episode

10 Sept 2026

Latest episodes

50 episodes in the feed.

1. 

   10 Sept 2026

   Six Hours and Seventy-Two: Two Breach Regulators, One SOP

   It's 2 a.m. and your monitoring has confirmed the worst: unauthorised access, customer data touched. Somewhere in the fog, two stopwatches have already started — and they're not synchronised. One belongs to CERT-In, whose directions expect specified incidents reported within six hours of noticing. The other belongs to the Data Protection Board: initial intimation without delay, the detailed report inside seventy-two hours. Different regulators, different statutes, different triggers, different forms — and one exhausted team that must satisfy both without contradicting itself. The fiftieth episode assembles everything this series has built about breaches into the one document that survives 2 a.m. First, the honest Venn: CERT-In polices cyber incidents — the technical event, personal data or not — serving national situational awareness; the Board polices personal data breaches — defined broadly enough to catch the misdirected salary spreadsheet with no intrusion at all. The ransomware hit sits in both circles; classification is the SOP's first job, run once, for both regimes simultaneously. Then the five components. The unified triage: four questions, one form, fifteen minutes, every downstream obligation knowing whether it's live — because at 2 a.m., nobody should interpret statutory definitions from memory. The parallel tracks, staffed and templated: the six-hour CERT-In filing pre-filled and bookmarked, the Board's two-stage intimation, the citizen notices rolling. The single source of truth: one timestamped incident log feeding every document in every track, because two regulators holding contradictory accounts of your timeline is a self-inflicted credibility wound no crisis needs. The supporting obligations that interlock — CERT-In's log expectations and Rule 6's one-year trail served by one architecture, with system clocks synchronised so your timestamps mean something. And the drill, upgraded to the full dual-regulator scenario, scored on the metric that matters: did every document tell the same story? Closing with the reframe that makes the dual burden bearable — both regulators want the same three things: fast honest notice, real facts, and evidence you were prepared. Build the muscle once. DPDP Daily takes India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 out of the statute book and into real life — for compliance officers, lawyers, founders, small business owners and citizens. One practical episode every day, no jargon. I'm Harmeet Singh Kapoor, author of the DPDP Act Compliance Handbook: From Law to Ground Reality. Keywords: CERT-In six hours, 72 hour breach report, dual breach reporting, CERT-In directions, Data Protection Board intimation, breach SOP, incident response India, unified triage, breach drill, cyber incident reporting. Connect with me: 💼 LinkedIn: https://www.linkedin.com/in/hskapoor/ (https://www.linkedin.com/in/hskapoor/) 📄 Facebook: https://www.facebook.com/satarkintelligence (https://www.facebook.com/satarkintelligence) ▶️ YouTube: https://www.youtube.com/@DPDPdaily (https://www.youtube.com/@DPDPdaily) 🎙️ Apple Podcasts: https://podcasts.apple.com/us/podcast/dpdp-daily/id6793257111 (https://podcasts.apple.com/us/podcast/dpdp-daily/id6793257111) 🎵 Amazon Music: https://music.amazon.com/podcasts/05adb457-b70a-429b-b4bd-4f27c5b2b32d/dpdp-daily (https://music.amazon.com/podcasts/05adb457-b70a-429b-b4bd-4f27c5b2b32d/dpdp-daily) 𝕏 X: https://x.com/TheOtherKapoor (https://x.com/TheOtherKapoor) One practical DPDP insight every morning on LinkedIn, Facebook and X — and the DPDP Act Compliance Handbook: From Law to Ground Reality coming soon. This episode is educational commentary, not legal advice. The DPDP framework is in phased implementation and positions described may evolve through notifications, Board publications and judicial interpretation. For decisions affecting your organisation or your rights, consult a qualified professional with your specific facts.

2. 

   9 Sept 2026

   DPDP Meets the IT Act: What Died, What Survives, What Polices You Now

   When the DPDP Act arrived, it walked into the house the IT Act built and removed exactly one load-bearing wall: Section 43A and the SPDI Rules hanging from it — the framework this show once called worse than nothing. Gone, deliberately. But the rest of the house stands: the criminal offences that jail identity thieves, the disclosure offence that reaches faithless employees, the intermediary framework with its own grievance officers and clocks, CERT-In with its six-hour demands, the blocking power. This episode maps the boundary. First, the funeral and its two consequences: the old compensation route closed, its replacement being the DPDP architecture episode 30 examined; and the SPDI vocabulary dead in practice — with the first homework being the find-and-replace audit purging "sensitive personal data or information" and its ghosts from your templates, vendor clauses and policies. Then the survivors: identity theft, personation, privacy-violation and hacking-family offences — and the one every employer should teach in induction: the disclosure offence criminalising the employee who sells the customer database. The central map this creates: the DPDP framework disciplines organisations through civil-regulatory machinery; the IT Act punishes individuals and conduct through criminal law — and one incident can walk both roads, giving you a breach report on Rule 7's clocks and an accused in a criminal complaint, with evidence-preservation layered onto the response drill. Then the two-hats problem: the same platform as intermediary under the IT framework for content and Data Fiduciary under DPDP for personal data — two grievance systems, two clocks, often two nameplates on one desk — and the routing table that sends each complaint down its proper statutory track. CERT-In previewed as tomorrow's star. And the closing synthesis for the front of your interlaw binder: the DPDP framework as the operating system, the IT Act as the criminal and infrastructural law around it, meeting at defined seams — mapped, or discovered at the exact moment surprise is most expensive. DPDP Daily takes India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 out of the statute book and into real life — for compliance officers, lawyers, founders, small business owners and citizens. One practical episode every day, no jargon. I'm Harmeet Singh Kapoor, author of the DPDP Act Compliance Handbook: From Law to Ground Reality. Keywords: DPDP IT Act, Section 43A omitted, SPDI Rules superseded, Section 72A disclosure, identity theft IT Act, intermediary rules, grievance officer, IT Act offences, criminal data protection India, interlaw compliance. Connect with me: 💼 LinkedIn: https://www.linkedin.com/in/hskapoor/ (https://www.linkedin.com/in/hskapoor/) 📄 Facebook: https://www.facebook.com/satarkintelligence (https://www.facebook.com/satarkintelligence) ▶️ YouTube: https://www.youtube.com/@DPDPdaily (https://www.youtube.com/@DPDPdaily) 🎙️ Apple Podcasts: https://podcasts.apple.com/us/podcast/dpdp-daily/id6793257111 (https://podcasts.apple.com/us/podcast/dpdp-daily/id6793257111) 🎵 Amazon Music: https://music.amazon.com/podcasts/05adb457-b70a-429b-b4bd-4f27c5b2b32d/dpdp-daily (https://music.amazon.com/podcasts/05adb457-b70a-429b-b4bd-4f27c5b2b32d/dpdp-daily) 𝕏 X: https://x.com/TheOtherKapoor (https://x.com/TheOtherKapoor) One practical DPDP insight every morning on LinkedIn, Facebook and X — and the DPDP Act Compliance Handbook: From Law to Ground Reality coming soon. This episode is educational commentary, not legal advice. The DPDP framework is in phased implementation and positions described may evolve through notifications, Board publications and judicial interpretation. For decisions affecting your organisation or your rights, consult a qualified professional with your specific facts.

3. 

   8 Sept 2026

   The Number Itself: What UIDAI's Rulebook Still Controls

   Open any old office cupboard in India and you'll find them: photocopies of Aadhaar cards. In HR files, in landlord folders, in hotel registers, in loan applications — the twelve digits of a billion people, duplicated across the country's paperwork like confetti. Every one of those photocopies sits under a rulebook most of the people holding them have never read. Because whatever the DPDP framework says about personal data generally, the Aadhaar number answers to its own standing law — and the DPDP Act did not repeal a word of it. This episode is the containment manual, in five parts. Storage: the vault architecture — Aadhaar numbers in a dedicated, access-controlled Aadhaar Data Vault, reference keys in operational systems, never numbers; no logs, no exports, no backups outside containment — and the first diligence question for any organisation claiming maturity: show me the vault, and show me a production system holding keys instead of numbers. Display: the masking rules — first eight digits concealed, last four visible — and the remediation path for legacy paper: inventory, digitise-and-mask what a nameable law requires, destroy the rest, record the destruction. Publication: the flat ban, and the mortifying ways it gets broken — the scholarship list, the beneficiary spreadsheet, the test data pushed public — with the boring, absolute controls that prevent it. The citizen-side features every support desk must understand: Virtual ID accepted wherever Aadhaar is, biometric locking as a feature rather than a fault, and offline verification — the QR, the paperless XML — as the mode every employer, landlord and verifier without ecosystem status should be steering toward instead of photocopies. And the teeth: the Aadhaar Act's own offences and penalties, imprisonment included — because conduct around Aadhaar can be a DPDP breach heading to the Board and an Aadhaar Act offence heading somewhere far less commercial, simultaneously. Closing with the four standing questions that turn five parts into one page — and the alternative: radioactive confetti in office cupboards, until the day it matters. DPDP Daily takes India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 out of the statute book and into real life — for compliance officers, lawyers, founders, small business owners and citizens. One practical episode every day, no jargon. I'm Harmeet Singh Kapoor, author of the DPDP Act Compliance Handbook: From Law to Ground Reality. Keywords: Aadhaar Data Vault, Aadhaar masking rules, Aadhaar number storage, UIDAI regulations, Virtual ID, biometric locking, offline verification Aadhaar, Aadhaar publication ban, Aadhaar Act penalties, Aadhaar compliance. Connect with me: 💼 LinkedIn: https://www.linkedin.com/in/hskapoor/ (https://www.linkedin.com/in/hskapoor/) 📄 Facebook: https://www.facebook.com/satarkintelligence (https://www.facebook.com/satarkintelligence) ▶️ YouTube: https://www.youtube.com/@DPDPdaily (https://www.youtube.com/@DPDPdaily) 🎙️ Apple Podcasts: https://podcasts.apple.com/us/podcast/dpdp-daily/id6793257111 (https://podcasts.apple.com/us/podcast/dpdp-daily/id6793257111) 🎵 Amazon Music: https://music.amazon.com/podcasts/05adb457-b70a-429b-b4bd-4f27c5b2b32d/dpdp-daily (https://music.amazon.com/podcasts/05adb457-b70a-429b-b4bd-4f27c5b2b32d/dpdp-daily) 𝕏 X: https://x.com/TheOtherKapoor (https://x.com/TheOtherKapoor) One practical DPDP insight every morning on LinkedIn, Facebook and X — and the DPDP Act Compliance Handbook: From Law to Ground Reality coming soon. This episode is educational commentary, not legal advice. The DPDP framework is in phased implementation and positions described may evolve through notifications, Board publications and judicial interpretation. For decisions affecting your organisation or your rights, consult a qualified professional with your specific facts.

Reach and audience

Public platform figures. Ratings count people who left a rating, not total listeners.

Spotify

5.0 / 5

1 ratings

Contact DPDP Daily

Guest appearances

Does not typically book guests

Based on episode analysis; this does not confirm that the show is currently accepting guests.