MYTHS / SOURCE-LED CORRECTIONS
Useful corrections, not certainty theatre.
Open any card for its provision, commencement date and official source trail. These are learning corrections, not advice on a specific organisation.
Myth“A new privacy policy is enough.”
“A new privacy policy is enough.”
RealityConsent-facing notice content, purpose, operations and evidence each need their own review.
- Effective date
- 13 May 2027
- Pinpoint
- Act ss. 5–6; Rule 3
Myth“All processing always needs a consent popup.”
“All processing always needs a consent popup.”
RealityThe Act recognises consent and certain legitimate uses; the answer depends on purpose and facts.
- Effective date
- 13 May 2027
- Pinpoint
- Act ss. 4 and 7
Myth“A large cloud vendor takes all responsibility.”
“A large cloud vendor takes all responsibility.”
RealityThe Data Fiduciary remains responsible and needs a valid contract and safeguards.
- Effective date
- 13 May 2027
- Pinpoint
- Act s. 8(1)–(2), 8(5)
Myth“Encryption makes a breach irrelevant.”
“Encryption makes a breach irrelevant.”
RealityEncryption is one safeguard; breach assessment and future communication duties remain separate.
- Effective date
- 13 May 2027
- Pinpoint
- Act s. 8(5)–(6); Rules 6–7
Myth“A checklist can certify compliance.”
“A checklist can certify compliance.”
RealityA checklist can organise evidence but cannot prove a fact-specific, continuing legal conclusion.
- Effective date
- 13 May 2027
- Pinpoint
- Editorial boundary; Act framework
Myth“GDPR compliance automatically equals DPDP compliance.”
“GDPR compliance automatically equals DPDP compliance.”
RealityControls may transfer; the Indian text, scope, status and evidence still need a separate map.
- Effective date
- 13 May 2027
- Pinpoint
- Act s. 1; G.S.R. 843(E)
Myth“Every consent platform is a registered Consent Manager.”
“Every consent platform is a registered Consent Manager.”
RealityRegistration with the Board and statutory conditions are distinct from ordinary product features.
- Effective date
- 13 Nov 2026
- Pinpoint
- Act s. 6(9); Rule 4 and First Schedule
Myth“Deletion means removing only the production database row.”
“Deletion means removing only the production database row.”
RealityProcessors, linked systems, legal retention and restorations from backup all need handling.
- Effective date
- 13 May 2027
- Pinpoint
- Act ss. 8(7) and 12(3); Rule 8
Myth“All final Rules were operative on notification day.”
“All final Rules were operative on notification day.”
RealityRules 1, 2 and 17–21 were immediate; Rule 4 and the remaining listed Rules start later.
- Effective date
- 13 Nov 2025
- Pinpoint
- Rule 1(2)–(4); G.S.R. 846(E) as corrected
Myth“Children’s-data design begins and ends with a date-of-birth field.”
“Children’s-data design begins and ends with a date-of-birth field.”
RealityVerifiable parental consent, due diligence, prohibitions and exemption conditions need design attention.
- Effective date
- 13 May 2027
- Pinpoint
- Act s. 9; Rules 10 and 12
Myth“A DPO title automatically proves qualification.”
“A DPO title automatically proves qualification.”
RealityThe Act states SDF-specific role conditions, not a general government qualification; support and competence remain governance questions.
- Effective date
- 13 May 2027
- Pinpoint
- Act s. 10(2)(a)
Myth“An AI-generated privacy notice is reliable without source review.”
“An AI-generated privacy notice is reliable without source review.”
RealityGenerated text can omit facts, status and pinpoints; a human must verify it against actual processing and official sources.
- Effective date
- 13 May 2027
- Pinpoint
- Editorial method; Act ss. 5–6