Frequently asked questions
Short answers to the questions we hear most. Not on the list? Ask Niyam AI.
Does the DPDP Act apply to my business?
It applies if you process digital personal data in India, or outside India when you offer goods or services to people in India. Size does not exempt you, although the Government can notify relaxations for some start-ups.
What counts as personal data?
Any data about an individual who can be identified from it. Names, phone numbers, emails, addresses, device IDs and account data all count when they are in digital form.
When do I have to be compliant?
The Rules roll out in phases. Core duties such as notice, consent, safeguards and breach reporting become enforceable around mid-May 2027. Starting early is cheaper than fixing under pressure.
How big can the penalties be?
Up to ₹250 crore for failing to take reasonable security safeguards. Other breaches carry lower caps, listed on the Act explained page.
Do I need a Data Protection Officer?
Only Significant Data Fiduciaries must appoint one. Every fiduciary must publish contact details of a person who can answer questions about data processing.
Can I keep using my existing customer data?
Data collected earlier needs a fresh, compliant notice. You should explain what you hold and why, and let people withdraw consent.
What does the Niyam website scan check?
It reads public pages of your site and looks for a privacy policy, consent language, cookie and tracker behaviour, forms that collect personal data, rights and grievance information, and basic security signals.
Is the Niyam score a legal certificate?
No. It is a decision-support tool based on public signals and your own answers. It is not legal advice and not government approval.
Is my data safe with Niyam?
We collect only what we need to run your account and assessments. See our Privacy Policy for what we store and how to ask for correction or erasure.
Still unsure?
Ask in your own words and get a plain answer.