DPDP penalties, the Data Protection Board and your compliance roadmap
The penalty schedule up to ₹250 crore, how the Data Protection Board works, Significant Data Fiduciary duties, cross-border transfers and a five-phase roadmap.
Read article
The Dataflax Journal
Clear answers on data, AI and India's DPDP Act.
Practical, plain-English guides for founders, data teams and compliance leads — from consent and breach response to AI-ready datasets and retrieval.
Start here
The DPDP Act, 2023 explained: a plain-English guide for Indian businesses
Who India's Digital Personal Data Protection Act applies to, the roles and terms it introduces, the core obligations and the phas…
What we write about
Three areas we cover most.
Data & AI
Building datasets, pipelines, and RAG-ready knowledge for AI systems.
Privacy & Compliance
DPDP Act guidance, consent frameworks, and data governance practices.
Security & Pentesting
Vulnerability findings, hardening tips, and lessons from real engagements.
Looking for something specific? Browse all articles by topic.
Children's data under the DPDP Act: verifiable parental consent explained
Why the DPDP Act treats everyone under 18 as a child, how verifiable parental consent works under Rule 10, the tracking ban, and the Fourth Schedule exemptions.
Read article
Personal data breaches under DPDP: your 72-hour response playbook
What counts as a breach, what the 2025 Rules require you to tell the Data Protection Board and affected individuals, and how to run the first 72 hours.
Read article
Data Principal rights under the DPDP Act — and how to operationalise them
Access, correction, erasure, grievance redressal and nomination: what each right requires, the 90-day grievance ceiling, and a workflow that scales.
Read article
Consent under the DPDP Act: notices, withdrawal and Consent Managers
What "free, specific, informed, unconditional and unambiguous" consent means in practice, how to write a compliant notice, and how withdrawal and Consent Managers work.
Read articleThe DPDP Act, 2023 explained: a plain-English guide for Indian businesses
Who India's Digital Personal Data Protection Act applies to, the roles and terms it introduces, the core obligations and the phased timeline under the 2025 Rules.
Read article
What makes a dataset actually "AI-ready"?
Structure, labelling, coverage, leakage-free splits and provenance — the seven properties that decide whether your data helps a model or just adds noise.
Read article
Chunking strategy for retrieval-augmented generation
How chunk size, overlap, document structure and metadata shape retrieval quality in production RAG systems — and how to measure your choices.
Read article
Cleaning data at scale without losing signal
Profiling, standardisation, layered deduplication, survivorship and validation tests that raise data quality without quietly discarding the records you need.
Read articleHave a topic in mind?
We're always writing about what teams are asking us.
Reach out if there's a data, compliance, or security question you'd like us to cover.