What DPDPA asks of an organisation your size
Every organisation that handles digital personal data has the same core duties. Size changes how much work it takes, and the largest data holders carry extra duties.
What applies to mid-market teams
- Clear notice and consent for each purpose
- A way for people to exercise their rights
- Reasonable security safeguards
- Breach notice to the Board and affected people
- Contracts that bind your processors
Where teams your size usually start
- First. Map your data
You can't fix what you can't see.
- Then. Fix consent
Notices and choices in your main journeys.
- Then. Review vendors
Your processors carry your risk.
Significant Data Fiduciaries
The government can name organisations as Significant Data Fiduciaries based on the volume and sensitivity of data they handle. They must appoint a DPO and run independent audits and impact assessments.
Side by side
| Startups and MSMEs | Mid-market | Large enterprises | |
|---|---|---|---|
| Typical first step | Data map and notices | Gap assessment | Programme across business units |
| Who owns it | A founder or ops lead | Compliance or IT head | DPO and privacy team |
| Where it gets hard | Time and know-how | Many tools, few owners | Legacy systems and scale |
| Extra duties | Possible exemptions, if notified | Core duties | SDF duties, if designated |
Questions
The Act lets the government exempt some classes of organisation, and it names startups as one it may consider. Check what is notified at the time, and assume the core duties apply until you confirm an exemption with your counsel.
The government names Significant Data Fiduciaries by notification, based on factors such as the volume and sensitivity of the data they handle. Check the notifications and ask your counsel. We can help you prepare either way.
With a map of the data you hold and a clear notice. Those are the first two steps most teams take.