The DPDP Act and an agent acting for you

Imagine it's mid-2027, after the Act's main duties have started. A trader in Jaipur has an assistant app on her phone. On the 18th of one month she tells it to file her monthly GST return and to book her a health check-up at a hospital near her shop. It does both before she finishes her tea.

A few weeks later the hospital gets a letter from her. She'd like to know who has handled her health details since the booking. Where did they go, and who touched them?

The hospital opens its booking records. There's a request, timestamped, from an app. It names no company, and nobody at the front desk can say which software acted.

That's the whole problem, in one letter.

Who plays which part

The Digital Personal Data Protection Act, 2023 hands out a few roles. We'll go through them with the trader.

The data principal is, in the Act's words, the individual to whom the personal data relates (section 2(j)). That's the trader, for her own details.

A data fiduciary is any person who, alone or with others, decides the purpose and means of processing personal data (section 2(i)). The hospital is one, for her booking. The assistant app's company is probably another, since it decides how her details are used to do her errands. That second one is our reading, and a lawyer might see it differently.

A data processor is any person who processes personal data on behalf of a fiduciary (section 2(k)). Say the assistant's company stores its activity logs with a cloud provider. The provider is its processor. Section 8(2) says a fiduciary may bring in a processor only under a valid contract.

A consent manager is a person registered with the Data Protection Board who acts as a single point of contact for the principal to give, manage and review her consent, and to take it back, through an interoperable platform (section 2(g), and section 6(7) to (9)). It's optional. If the trader had used one, it would sit between her and the hospital. She didn't, so there isn't one.

Notice the word that repeats: person. Section 2(s) says what a person includes. The list names individuals, Hindu undivided families, companies, firms, associations, the State, and any other artificial juristic person. Software isn't on it.

The part that fits none of them

So where's the agent? As we read it, it isn't a data principal, because it isn't the individual. It isn't a fiduciary, a processor or a consent manager either. It's software, and the Act hands out its roles to persons.

What happens in practice is that the role goes to whoever runs it. When the agent carries her details to the hospital, the processing is done by the assistant's company, and that company is answerable for it. The agent is the tool and the company is the party.

Which means a chain of authority is sitting behind that one timestamped request. She told the company's app to act. The company's software acted. The hospital received it.

The picture shows authority narrowing at each step. She hands part of what she can do to the company, and the company hands a smaller part to its agent. A record of that handing-over is what the hospital doesn't have.

What the letter turns on

Back to the hospital desk. Section 11(1) lets a principal who has given consent to a fiduciary ask for a summary of the personal data being processed and the activities done with it, and for the identities of all the other fiduciaries and processors it was shared with. Section 8(1) makes a fiduciary responsible for processing done on its behalf by a processor, whatever any agreement says.

The Act doesn't mention agents, and it doesn't say anyone must keep a record of delegation. We're reading across. To answer her, the hospital has to know which company sent the request, and which person that company said it was acting for. If its only log says "an app", the honest reply is that it doesn't know.

The Rules point the same way, though not in these words. Rule 6(1)(c) requires visibility on the accessing of personal data through appropriate logs, monitoring and review, and Rule 6(1)(e) adds that, for that purpose, such logs and personal data are to be kept for a year unless another law says otherwise. What a good log holds is up to the fiduciary. We'd say a good one names who acted and for whom.

There's a contrast worth drawing. For a consent manager the Rules go further. Part B of the First Schedule makes it keep a record of consents given, denied or taken back, of the notices that came with the requests, and of what was shared with whom, and to keep that record for at least seven years. An agent's operator has no such duty. A shared record of who acted for whom would give a hospital something similar to lean on. That's our argument for why it matters, not a legal requirement.

If you're curious how this looks from the office's side, Who is the relying party, and what should it check? goes through it. For what an identity record holds in the first place, there's What is agent identity?.

When any of this applies

Not yet. Notification G.S.R. 843(E) of 13 November 2025, published in the Gazette, brings sections 3 to 17, apart from section 6(9), into force eighteen months after publication. Those sections include consent, the fiduciary's duties in section 8 and the rights in sections 11 to 13. Counting from 13 November 2025, that comes to about 13 May 2027.

Section 6(9), on registering consent managers, comes a year after the notification, so about 13 November 2026. Rule 4 does the same. Under Rule 1 of the Rules, Rules 5 to 16, including Rule 6 on logs and Rule 14 on rights requests, follow the eighteen-month date. The government's own summary calls it an 18-month phased compliance timeline. We read it on 12 October 2026.

So the trader's letter is a thought experiment about next year. The roles and definitions are already law. Most of the duties aren't running yet.

What we don't know

We don't know whether a consent given by software on a person's behalf counts as her consent. Section 6 speaks of a clear affirmative action by the principal herself. An assistant that taps "agree" for her might satisfy that, or might not. Nobody has told us, and we haven't found a ruling.

We don't know how the Data Protection Board will treat an agent's operator. Our reading, that the company running the agent takes the role, seems natural to us. The Board may see it differently, and so may a court.

We don't know whether a company that runs agents could register as a consent manager, or whether it should. That's a question for lawyers, and for the Board when registration opens.

And we haven't tested any of this against a real dispute, because there hasn't been one that we know of. The example is invented from start to finish.

One thing we'd like to hear from you. If you run a hospital desk, a tax office or a bank, what would you want your log to say when a request arrives from an agent?