Practical DPDP Act compliance, from first audit to everyday operations.
India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 change how every business collects, uses and protects personal data. We help you comply — and prove it.
What the DPDP Act means for your business
If you collect names, phone numbers, emails, location, payment or any other data about people in India — online or digitised from paper — the Act applies to you, whatever your size.
Who is covered
Every organisation processing digital personal data in India, and foreign businesses offering goods or services to people in India.
Lawful basis
Free, specific, informed and unambiguous consent — or one of the limited "legitimate uses" in Section 7. There is no broad legitimate-interests ground.
Your duties
Clear notices, security safeguards, breach notification, rights handling within 90 days, erasure when the purpose ends, and accountability for processors.
Penalties
Up to ₹250 crore for failing to protect data, ₹200 crore for breach-notification or children's-data failures, and up to ₹50 crore for other breaches.
The phased timeline
- Aug 2023DPDP Act receives Presidential assent
- Nov 2025DPDP Rules notified; Data Protection Board provisions in force
- Nov 2026Consent Manager framework takes effect (+12 months)
- ~May 2027Core obligations enforceable: notice, consent, security, breach, rights (+18 months)
An end-to-end DPDP compliance programme
Six workstreams that cover every obligation a Data Fiduciary faces — delivered together or one at a time.
Gap assessment & data mapping
We map every system, vendor and data flow, then score you against each section of the Act and Rules.
- Data inventory & records of processing
- Legal basis for each purpose
- Prioritised risk & remediation plan
Notices & consent
Rewritten notices in plain language and consent capture that meets the Section 6 standard — and can be proven.
- Itemised, multilingual notices
- Granular, logged consent
- One-click withdrawal everywhere
Data Principal rights
A request workflow for access, correction, erasure, nomination and grievances that meets your published timeline.
- Verified intake & routing
- Processor erasure instructions
- ≤ 90-day grievance SLA tracking
Breach readiness
A tested plan to notify affected people without delay and send the Data Protection Board a detailed report within 72 hours.
- Incident response plan & roles
- Board & individual notice templates
- Tabletop exercises
Children's data
Everyone under 18 is a child under the Act. We design age assurance and verifiable parental consent under Rule 10.
- Age-assurance approach
- Parent verification flows
- Tracking & targeted-ad switch-off
Retention & erasure
Keep what the law requires — such as one year of processing logs — and delete the rest on schedule.
- Retention schedule by data type
- Inactivity-based erasure rules
- Backup & processor coverage
Know the privacy risk before you sign, buy or launch.
The Act makes you responsible for what your processors do with personal data, and penalties attach to the Data Fiduciary. Our due-diligence reviews give you clear, evidence-backed answers.
Vendor & processor review
Security questionnaires, contract gaps and DPDP-ready processing addenda for cloud, SaaS, payroll and marketing vendors.
Investor & M&A diligence
Privacy risk reports on target companies — data sources, consent evidence, breach history and exposure.
Significant Data Fiduciary readiness
Annual DPIA and audit, an India-based DPO and algorithmic due diligence for organisations that may be notified as SDFs.
Cross-border transfer review
Where your data travels, sector localisation rules (such as RBI payment data) and readiness for government restrictions.
Advice your teams can actually use
Plain-English guidance for founders, product, engineering, marketing and support teams — not just a legal memo.
Policies & templates
Privacy policy, notices, consent text, processor addenda and internal data-handling policies.
Team training
Role-based sessions for product, engineering, marketing, HR and customer support.
DPO on demand
A named privacy lead for questions, reviews of new features and grievance escalations.
Board briefings
Quarterly compliance status, risk register and decisions — written down for accountability.
- 1The DPDP Act, 2023 explained: a plain-English guide for Indian businesses6 min read
- 2Consent under the DPDP Act: notices, withdrawal and Consent Managers6 min read
- 3Data Principal rights under the DPDP Act — and how to operationalise them5 min read
- 4Personal data breaches under DPDP: your 72-hour response playbook5 min read
- 5Children's data under the DPDP Act: verifiable parental consent explained5 min read
- 6DPDP penalties, the Data Protection Board and your compliance roadmap5 min read
How we take you from gap to compliant.
A five-phase method that fits into your release cycles, with clear owners and evidence at every step.
Discover
Interviews, system scan and a full data inventory.
Assess
Gap analysis against the Act and Rules, with a risk score.
Remediate
Notices, consent, contracts and safeguards fixed in priority order.
Operationalise
Rights, breach and retention procedures running day to day.
Assure
Testing, internal audit and a board-ready evidence pack.
Documented procedures & evidence pack
Every engagement ends with written, version-controlled procedures your teams own.
- Records of processing (data inventory)
- Privacy notice & consent text
- Consent log specification
- Rights-request SOP & response templates
- Breach response plan & Board report template
- Retention & erasure schedule
- Processor addendum & vendor register
- Training deck & attendance records
Tools that keep compliance running
We configure proven tools on your stack — or set up lightweight ones — so compliance doesn't depend on spreadsheets and memory.
Consent banner & preference centre
Granular choices, multilingual text and withdrawal as easy as consent.
Consent log
Who agreed to which notice version, for what purpose, when and where.
Rights request portal
Verified requests with tracking, deadlines and audit trail.
Data inventory register
Systems, data types, purposes, retention and vendors in one place.
Breach register & 72-hour tracker
Incident log with the clock, owners and Board-report fields.
Retention scheduler
Automated erasure reminders and legal-hold flags.
Vendor register
Processors, contracts, sub-processors and review dates.
Consent Manager readiness
Accept consent signals from registered Consent Managers.
Prove your safeguards are reasonable.
The biggest DPDP penalty — up to ₹250 crore — is for failing to take reasonable security safeguards. Testing finds the gaps before attackers or the Board do.
Automated vulnerability scanning
Scheduled scans of websites, APIs and servers for OWASP Top 10 issues, outdated software, weak TLS and misconfigured headers.
Manual penetration testing (VAPT)
Certified testers simulate real attacks on web apps, APIs and mobile apps, then hand you a prioritised fix list and a free re-test.
Cloud & access review
Storage buckets, IAM roles, logging and backups checked against the safeguards named in the DPDP Rules.
| Safeguard in the DPDP Rules | What we test | Evidence you get |
|---|---|---|
| Encryption, masking or tokenisation | Data at rest and in transit, key handling | Findings report with fixes |
| Access controls | Roles, admin panels, password & MFA policy | Access review sign-off |
| Monitoring & logs | Log coverage, alerting, 1-year retention | Logging gap list |
| Continuity & backups | Backup integrity and restore test | Restore test record |
| Processor safeguards | Vendor security questionnaires | Vendor risk register |
| Breach detection | Simulated incident & 72-hour drill | Tabletop exercise report |
Choose how much help you need.
Every package starts with a free 30-minute readiness call and a fixed quote.
| What's included | Readiness Assessment | ImplementationMost popular | Managed Compliance |
|---|---|---|---|
| Data inventory & gap report | Included | Included | Included |
| Prioritised remediation plan | Included | Included | Included |
| Notices, consent & policies rewritten | Not included | Included | Included |
| Rights & breach procedures | Not included | Included | Included |
| Privacy tools set up | Not included | Add-on | Included |
| Vulnerability scan | Add-on | One-time | Quarterly |
| Penetration test | Not included | Add-on | Annual |
| DPO on demand & training | Not included | Not included | Included |
| Typical timeline | 2–3 weeks | 6–12 weeks | Ongoing |
DPDP Act questions.
Quick answers to what founders and compliance leads ask us most.
When do we need to be compliant?
The Data Protection Board is already in place. Consent Manager provisions apply from about November 2026, and the core obligations — notice, consent, security, breach notification and rights — from about May 2027. Most organisations need 6–12 months to get ready.
Does the Act apply to small businesses?
Yes. There is no size threshold — if you process digital personal data of people in India, the Act applies. Some government-notified exemptions exist, but they are narrow.
We already follow GDPR. Are we covered?
You have a head start, but not full coverage. The DPDP Act has no legitimate-interests basis, treats everyone under 18 as a child, and has its own notice, breach and grievance rules.
Do we need a Data Protection Officer?
Only Significant Data Fiduciaries must appoint an India-based DPO. Every other Data Fiduciary must still publish a contact person who can answer questions about processing.
How long does a readiness assessment take?
Usually two to three weeks, depending on how many systems and vendors handle personal data.
Is this legal advice?
We provide compliance consulting and technical implementation. For formal legal opinions we work alongside your counsel or recommend partner law firms.
Find out where you stand on the DPDP Act in 30 minutes.
We'll review your data flows, highlight the biggest risks and give you a fixed-price plan.