India's privacy law, in plain English.

A data fiduciary must give every data principal a clear, standalone notice in English plus any of the 22 Eighth Schedule languages — before or at the time of collection. Must list legal entity, DPO, grievance officer, DPBI registration (for SDFs), rights portal URL, and withdrawal portal URL.

Consent must be free, specific, informed, unambiguous, and revocable. Pre-ticked boxes are invalid. Withdrawal must be as easy as grant. The fiduciary must be able to prove what was consented to, by whom, when, in which language.

Eight narrow sub-grounds (employment, public interest, medical emergency, pandemic, etc.) allow processing without consent. Activities under §7 never appear in privacy notices and are never consent-collected — but still subject to data minimisation and audit.

Maintain Record of Processing Activities (§8(4)), notify the DPBI within 72 hours of a breach (§8(6)), restrict processing to declared purposes. Significant Data Fiduciaries face heightened obligations under §10.

Verifiable parental / guardian consent required for anyone under 18. No tracking, behavioural monitoring, or targeted advertising to children. Vishwaas AI supports five guardian-verification strategies including DigiLocker.

Tenants designated as SDFs must complete DPIAs, appoint a DPO, audit annually, and meet additional obligations. Vishwaas AI gates these obligations on the is_sdf tenant flag.

Right to access (§11), correction + erasure (§12), grievance redressal (§13 — 30-day SLA, DPBI escalation), nomination (§14). All six rights orchestrated in one DPR module.

Transfer of personal data outside India only to countries notified by the Central Government. Vishwaas AI tracks adequacy status, flags non-adequate countries, and enforces DPIA gating for SDFs.

The fiduciary may reject rights requests under specified grounds (legal obligation, freedom of expression, public interest). Reasons must be documented; the principal may escalate.

Notice must be standalone, multilingual, and version-locked before publishing. The Vishwaas notice composer enforces a six-check publish gate.

7-year retention of consent records. Withdrawals must be possible at the same point and ease as grant. Vishwaas keeps an append-only hash-chained ledger.

48-hour pre-deletion notice with a retraction link before any erasure executes. Vishwaas enforces this with a scheduled_deletion_at ≥ pre_notice_sent_at + 47h constraint.