DPDP ACT, 2023 · COMPLIANCE BRIEF
India's New Data Privacy Law and Online Dispute Resolution Platforms
India's Digital Personal Data Protection Act, 2023 (DPDP Act) came into effect in late 2023 as India's first comprehensive privacy law. The Act governs how "data fiduciaries" (platforms and services that control data processing) handle personal data. Notably, it explicitly covers legal-tech and dispute-resolution platforms.
In practice, this means any online arbitrator or mediation service (like Sandhee) must integrate strict privacy and security measures. The Act requires clear, informed consent before collecting data, detailed privacy notices, and the ability for individuals to withdraw consent at any time. For example, consent must be "free, specific, informed, [and] unambiguous" and data collection should be limited only to what's needed for the stated purpose. Data Principals (users) gain new rights: they can access, correct or delete their data and object to or withdraw consent, all as swiftly as they gave it.
Key Obligations for Data Platforms
The DPDP Act places several core duties on any digital platform that processes personal data:
Valid Consent & Notice
Platforms must obtain affirmative consent before using data. Notices must itemize exactly which data is collected and for what purposes. Consent cannot be buried in fine print or bundled with unrelated uses. Consent may be withdrawn anytime and the platform must cease processing withdrawn data unless another law permits retention. Sandhee's privacy policy explicitly reflects this: it informs users that under the DPDP Act they have the right to “access, correct or delete” their information and “withdraw consent” at any time.
Data Minimization & Purpose Limitation
Data fiduciaries must only collect data strictly necessary for the user's requested service. For example, Sandhee would only store case documents and participant details essential to a dispute; anything beyond that would violate the Act's minimization rule. Processing must align with the purpose for which consent was given and cannot stray into unrelated uses.
Security Safeguards
The Act mandates “reasonable security safeguards” (e.g., encryption, access controls, monitoring, anonymization, etc.) to protect data. Any breach of confidentiality or integrity must be reported immediately to the new Data Protection Board and affected users. In other words, platforms like Sandhee must build strong technical protections. For instance, Sandhee's platform already emphasizes encryption – it advertises that all case documents and communications are exchanged via an “encrypted platform” and that virtual hearings use secure video conferencing. This matches the Act's demand for end-to-end data security.
Significant Data Fiduciaries (SDF) Rules
Large platforms designated as SDFs face extra duties: they must appoint an India-based Data Protection Officer, conduct regular audits and impact assessments and possibly localize certain sensitive data. It's not yet public whether Sandhee will be tagged an SDF, but if it grows big enough it will need these additional compliance measures.
Collectively, these rules create a privacy-by-design framework: platforms must bake in consent management, data minimization and user rights from the ground up.
Implications for Online Dispute Resolution Platforms
ODR platforms like Sandhee face unique privacy challenges. By moving dispute resolution online, these services collect highly sensitive data (personal testimony, financial records, medical information, etc.). Unlike traditional in-person arbitration (which relies on norms of confidentiality), digital ODR systems record metadata and evidence on servers. This increases the risk of data exposure unless protected.
The DPDP Act makes clear that all parties involved in an ODR case – the platform, arbitrators, and even mediators – must follow its rules. In effect, an arbitrator using Sandhee's portal is a data fiduciary: before processing any personal data, the arbitrator must obtain valid consent (usually through the platform's user agreement), limit processing to the case itself, and ensure confidentiality. Sandhee's own design appears to support this: it routes all evidence exchange through its encrypted portal and emphasizes that “all proceedings, documents and awards are completely private and secure”.
Cross-Border Data
The DPDP Act permits data transfers out of India only to approved jurisdictions — so an overseas arbitrator downloading Sandhee case files must rely on permitted transfer mechanisms or local storage.
Many Indian parties use international arbitrators via ODR. Sandhee claims to serve users in India and abroad, so it must ensure compliance for any data that leaves the country. Such cross-border rules add complexity to international ODR.
In summary, the Act enforces accountability and transparency in online justice systems. Platforms must adopt privacy-by-design measures: secure encryption, limited retention, and clear user controls. As one analysis warns, most existing ODR tools 'often lack solid data lifecycle governance' and do not currently meet these standards. The DPDP Act pushes them to change.
Sandhee's Privacy Measures in Action
Sandhee's platform illustrates how an ODR service can align with DPDP requirements. Its marketing and policies put a premium on confidentiality. Sandhee's website prominently notes it is “Secure & Confidential” and states that it offers a 100% digital arbitration process with all proceedings kept private. In practical terms, this means Sandhee uses encrypted document exchange and videoconferencing to keep data safe. For instance, when parties upload evidence or claims on Sandhee, those files travel over encrypted channels and are stored securely on Sandhee's servers – fulfilling the Act's encryption mandate.
User Rights, Operationalized
Sandhee also has established processes reflecting user rights. Its privacy policy explicitly tells users that under the DPDP Act they can “access, correct, or delete” their personal information and may “withdraw consent” at any time. Users can contact Sandhee to exercise these rights and Sandhee pledges to respond within the legal timeline.
Data Minimization in Practice
By limiting data retention and emphasizing confidentiality, Sandhee appears to practice data minimization. Case materials and communication are kept only for the duration needed to resolve the dispute. If a case is closed, Sandhee can erase or archive those records in accordance with the Act.
Compliance by Design
Sandhee's platform identifies itself as fully compliant with the Arbitration Act and hints at data protection: its site footer repeats “Secure & Confidential – All proceedings private”. While Sandhee has not publicly released any internal audit reports, its public documentation indicates a commitment to the same privacy principles that the DPDP Act enshrines.
Overall, Sandhee's approach – encrypted case management, private virtual hearings, clear privacy policies – aligns well with DPDP mandates. It essentially treats data security and user consent not as optional, but as core features of its service. This positions Sandhee to meet the new legal requirements and to build trust with parties who increasingly demand both speedy online resolutions and strong data protection.
Keep Reading
More From Resources
Security You Can Trust: Inside Sandhee's Protection Framework
Six layers of protection built into the platform, from the first document uploaded to the final award delivered.
Read More→
Industries We Serve: How ODR Adapts Across Sectors
From banking to MSMEs, how Sandhee's platform adapts to the dispute patterns of every sector.
Read More→
Arbitration Rules: Sandhee's Procedural Framework Explained
A closer look at the rules governing arbitration conducted on the Sandhee platform.
Read More→