Cover Your Highest-Penalty Exposure

DPDPA S.9 prohibits three categories of processing for children (under 18) without exception: (1) targeted advertising directed at children, (2) tracking or behavioural monitoring of children, and (3) processing that may have a detrimental effect on the wellbeing of the child. It also requires verifiable parental or guardian consent before any other processing of a child's personal data. DPDPA Shield enforces all four restrictions automatically on ChildAccount records.

The Central Government designates SDFs based on the volume and sensitivity of personal data processed, potential risk to national security or public order, risk of harm to data principals, and impact on sovereignty and integrity of India. There is no fixed threshold — designation is by government notification. Once designated, SDFs must appoint an Indian-resident DPO, conduct DPIAs, maintain an algorithm audit registry, and file periodic compliance reports.

A DPIA is a structured assessment of the privacy risks introduced by a new processing activity. Under DPDPA, DPIAs are mandatory for Significant Data Fiduciaries before deploying any new automated processing system. DPDPA Shield's 20-question DPIA wizard covers 5 categories — Scope & Scale, Data Sensitivity, Data Subject Rights, Security Controls, and Governance — and outputs a risk score (LOW/MEDIUM/HIGH/CRITICAL) plus a required controls checklist.

The Act provides no fixed timeline for SDF designation — notifications can be issued at any point after commencement. Companies processing large volumes of sensitive data (health, financial, children's data) should prepare SDF-level controls proactively. Retroactive designation with no grace period is the highest-risk scenario. DPDPA Shield's Enterprise modules are designed precisely for this preparedness posture.