The DPDP Stack
Five-Layer Instrument Architecture: Act, Rules, Commencement, Corrigenda, and Board Adjudications
DPDP is not a single static legal document; it operates as an interdependent five-layer normative stack. Layer 1 (The DPDP Act 2023) establishes primary statutory duties and penalty maxima. Layer 2 (The DPDP Rules) specifies operational mechanics, notice requirements, and breach parameters. Layer 3 (Commencement Notifications) regulates when specific sections become enforceable across 3 discrete tranches. Layer 4 (Ministry Corrigenda) rectifies official gazette texts and dates. Layer 5 (DPBI Adjudications & Standard Operating Procedures) sets binding precedent and inquiry procedures.
The DPDP Stack
DPBI Guidelines & Adjudications
Binding procedural codes, inquiry standards, voluntary undertakings approval, and penalty calculations.
Ministry Corrigenda & Clarifications
Gazetted rectifications to rule text, dates, and transitional drafting cross-references.
Commencement Notifications (Tranches 1–3)
Staged enforcement schedule: 13 Nov 2025 (Board setup) -> 13 Nov 2026 (Rule 4) -> 13 May 2027 (Substantive Cliff).
Subordinate DPDP Rules (Rules 1–24)
Prescribes notice templates (r.3), retention periods (r.5), breach notification forms (r.7), VPC criteria (r.8), and CM standards (r.11).
Primary DPDP Act, 2023 (Act No. 22 of 2023)
Core statutory definitions (s.2), ground rules for processing (s.4-7), fiduciary duties (s.8-10), principal rights (s.11-14), and penalty schedule (s.33).
💡 Core Architectural Insights & Takeaways
Key technical and regulatory takeaways established by this architecture diagram.
📜 Statutory Grounding & Legal Perimeter
Primary Act and subordinate Rule provisions establishing the enforceable legal mandate for this diagram.
🏗️ Target Architecture & Impacted Systems
Enterprise nodes and store topologies impacted by this architectural pattern.
Public client boundary & untrusted intake surface for notices and consent capture
Immutable consent event store and Policy Decision Point issuing authority tokens
Isolated test environment ensuring recovered backups pass tombstone replay
⚙️ Associated Operational Controls
Control Master Matrix obligations enforcing the standards illustrated in this infographic.
🛠️ Implementation Guidance & Traps
Recommended technical sequencing and operational failure modes to avoid.
Recommended Implementation Sequence
- Anchor the enterprise legal register to specific Gazette notification hashes and dates.
- Map each system data flow to both primary statutory limbs and subordinate rule provisions.
- Set up an automated Gazette surveillance pipeline to capture Layer 4 corrigenda and Layer 5 Board circulars.
- Distinguish institutional readiness from substantive compliance obligations.
Enterprise Traps & Failure Modes
- ⚠️ Assuming the entire DPDP Act is immediately live upon presidential assent.
- ⚠️ Relying on unofficial blog posts or draft bills instead of the Gazette publication baseline.
- ⚠️ Treating Board recruitment advertisements as operational adjudication channels.
📁 Verifiable Evidence Artifacts Vault
Required evidentiary workpapers for regulatory inspections and SDF audits.