Document Overlap
4.2%
← Content Overlap Report
A-042
→
First documentHandling Legacy Data Collected Before DPDP: A Board-Level PlanOpen original ↗
A-062
Second documentPurpose Limitation in Practice: How to Stop Teams fromOpen original ↗
Low overlap
Top paragraph overlap
23.4%Page comparison
Paragraph matches
Strongest non-zero match for each paragraph.
First paragraph300 words
Executive checklist and common questions on DPDP legacy data
DPDP sits alongside, not above, sectoral and general laws that impose record-keeping duties. If RBI, SEBI, IRDAI, TRAI, or tax statutes require you to retain certain records for a defined number of years, you generally must continue to hold that data even if a Data Principal withdraws consent or asks for erasure, to the extent necessary to meet those legal obligations. Under DPDP, this can operate as a lawful basis under the category of compliance with law or legitimate uses. However, that does not give you a free licence to use the same data for unrelated purposes, such as marketing or broad profiling, once consent is withdrawn or the original purpose has been served. The practical approach is to build and maintain a retention schedule that clearly maps each category of data to its governing laws and minimum retention periods, ensure that fields kept solely for statutory purposes are segregated and access-controlled, and delete or anonymise non-essential fields when they are no longer needed. Where sectoral regulators issue their own privacy or cyber guidelines, align your legacy data programme with those expectations as well, so that you can show both the Data Protection Board and your primary regulator that you have reconciled the two regimes in a thoughtful, documented way. [2] Digital Personal Data Protection Act, 2023 - Ministry of Electronics and Information Technology, Government of India DPDP Rules, 2025 Notified – A Citizen-Centric Framework for Privacy Protection and Responsible Data Use - Press Information Bureau, Government of India Decrypting India’s New Data Protection Law: Key Insights and Lessons Learned - Bird & Bird Top 10 operational impacts of India’s DPDPA – Individual rights - International Association of Privacy Professionals (IAPP) Summary of DSCI’s submission to MeitY on Draft Digital Personal Data Protection Rules, 2025 - Data Security Council of India
23.4%
Second paragraph142 words
Common questions about purpose limitation and stopping data reuse
Begin with a focused workshop between product, analytics, privacy, and legal leaders. Map your top five data-heavy journeys, draft an initial set of purposes in business language, and agree a lightweight reuse decision process for the next six months. This creates a foundation you can then formalise into a full catalogue, governance model, and technical controls. Regulation (EU) 2016/679 (General Data Protection Regulation), Article 5 – Principles relating to processing of personal data - European Union / EUR-Lex Privacy principles and OECD Privacy Guidelines - Organisation for Economic Co-operation and Development (OECD) Digital Personal Data Protection Act, 2023 (official text) - Ministry of Electronics and Information Technology, Government of India Digital Personal Data Protection Rules, 2025 - Wikipedia Key Highlights of the Digital Personal Data Protection Act, 2023 - Juris Legal Opinion 03/2013 on purpose limitation - Article 29 Data Protection Working Party (now EDPB)
First paragraph171 words
Executive checklist and common questions on DPDP legacy data
Legacy data is particularly exposed to several DPDP contraventions. Failure to provide proper notices for historic consents or to ensure that ongoing processing is covered by a valid lawful basis can amount to non-compliance with foundational obligations on notice and consent. Because legacy datasets are often large and widely replicated, they are common sources of security incidents; inadequate safeguards or delayed breach notification can attract separate penalties. If your systems cannot locate and act on a Data Principal’s access, correction, or erasure request across legacy archives, you risk violating their rights. Unmanaged data held by processors and vendors on your behalf can lead to vicarious exposure if contracts and controls are weak. The Act’s penalty schedule provides for significant rupee-denominated monetary penalties per type of contravention, with the Data Protection Board expected to consider factors such as the nature and gravity of the breach, the volume and sensitivity of data affected, the duration of non-compliance, and the steps you took to prevent and remedy harm. [1]
0.6%
Second paragraph32 words
From principle to board-level risk: why purpose limitation matters now
Regulatory exposure: GDPR, the OECD Privacy Guidelines, and the DPDP regime all converge on purpose limitation as a foundational principle. A failure here is rarely seen as a minor technical breach. [1]
First paragraph172 words
Executive checklist and common questions on DPDP legacy data
Current interpretations of the notified DPDP Rules indicate a general compliance window of around twelve months from notification for most obligations, with scope for phased commencement by sector, size, or risk profile. Within that window, Section 5(2) and the Rules expect Data Fiduciaries to provide DPDP-compliant notices to individuals whose data was collected earlier and whose consent is being carried forward. In practice, a medium to large enterprise will often need the full 12–18 months to inventory, classify, and remediate legacy datasets in a structured way. Missing the window does not mean that all your processing becomes automatically unlawful overnight, but it does increase your exposure: if you have not provided required notices, cannot demonstrate a lawful basis for ongoing use of legacy data, or are unable to respond to rights requests involving older datasets, you make it easier for the Data Protection Board to conclude that you have failed to meet your obligations, raising the likelihood of monetary penalties and binding directions to change or stop processing. [3]
0.6%
Second paragraph70 words
Common questions about purpose limitation and stopping data reuse
The DPDP Act and Rules move Indian organisations towards a more explicit, accountable model of data fiduciary responsibility. That includes clearer expectations around notices, consent, lawful purposes, record-keeping, and the ability to demonstrate how you control secondary uses of data. Many practices that were previously handled informally—such as broad reuse of customer data for targeting or cross-border analytics—now warrant more structured assessment, governance, and documentation. [3]