India’s Digital Personal Data Protection Act, 2023 (No. 22 of 2023) received Presidential assent on 11 August 2023. The DPDP Rules, 2025 were notified on 13 November 2025 (G.S.R. 846(E)). The Data Protection Board of India was established the same day. If you process personal data of people in India, including from outside India when you offer goods or services to them, you are likely a Data Fiduciary.
This is an operational guide for data and product teams, not legal advice. Confirm obligations with counsel. Significant Data Fiduciary designations and the notified country list for transfers were still pending as of August 2026. Full operational compliance has been discussed on a 2026–2027 runway. Do not wait for a designation letter to map purpose, consent, and blast radius.
Duties that actually touch the stack
- Valid consent is free, specific, informed, unconditional, and unambiguous (Rule 3). Pre-ticked boxes and dark patterns fail.
- Notice before collection: what data, what purpose, how to withdraw. Available in Eighth Schedule languages on request.
- Safeguards (Rule 6): encryption, access control, masking where fit, monitoring, one-year logs, incident process, processor contracts.
- Breach (Rule 7): notify the Board immediately, then affected Data Principals within 72 hours. Failure to notify can draw penalties up to ₹200 crore. A personal data breach itself can draw up to ₹250 crore.
- Erasure when the purpose is over, consent is withdrawn, or the sector retention clock in the Third Schedule runs out. Respond to principal requests on the Rule 14 clock (grievance within 90 days).
- Children (Section 9): verifiable parental consent under 18. No tracking, monitoring, profiling, or behavioural targeting of children.
Close is not an exemption
Invoice lines, collection notes, and customer IDs inside ARR and NRR models are personal data when they identify a person in India. “It is only finance” is not an exemption. Legitimate use for legal proceedings (Section 7) covers a tax notice or a named dispute. It does not cover every marketing-adjacent explore that landed in the warehouse because someone joined fct_invoices to a campaign table.
Books vs collections vs board pack
Split purpose on the objects. Billing fulfilment and statutory books can keep what the Companies Act, GST, and Income-tax rules require. Collections can keep a dispute file while the case is live. The board pack does not need a raw email or PAN on every slide. Mask at the pack. If a principal asks for erasure, the legal-hold path stays; the recs and collections outreach path stops.
The RBI clock vs the DPDP clock
Where Finance sits next to a regulated lender or payments entity, RBI KYC norms typically keep identity records for at least five years after the relationship ends. DPDP wants erasure when the purpose is over. Those clocks can both be true. Name them. KYC and books follow the longer statutory hold. Campaign keys and free-text collector notes do not inherit a five-year free pass.
Who can see the close
Same grant on Looker, the pack, and Company Brain chat. A contractor who can download customer_id from an “exec extract” is in the blast radius. If you cannot list who saw that column last quarter, you cannot notify principals in 72 hours and you cannot prove Rule 6 access control.
Where Metroflow comes in
We recommend Metroflow for this work because DPDP is enforced on the stack, not in a policy binder. Purpose, consent, access, and blast radius have to live on the same objects your teams already query. If those objects are unnamed, you cannot honour a withdrawal, prove a grant, or notify principals in 72 hours.
On the close path that means customer keys on ARR and NRR are tagged, granted, and walkable from the pack back to billing. Statutory holds stay named. Campaign joins do not inherit a five-year free pass.
- Why it fits. A metadata-only graph. Named owners. The same RBAC on humans and agents. Lineage you can export for the Board and for counsel.
- How it helps. Tag purpose on the metric and the identity. Walk erasure to warehouse models and downstream packs. Open breach blast radius from one query. Keep the warehouse, dbt, and BI you already run.
Continue on the Finance use cases page, or try the live demo.