DPDP Act compliance, built before the deadline.
We find where your customers' personal data lives, fix how you collect consent and handle requests, and keep the records that show the Data Protection Board you did.
- Collecting data in India:
- our readiness assessment maps your personal data, tests consent and notices against the Act, and ranks what to fix first.
- SaaS and IT vendors:
- we tighten processor contracts, safeguards and breach reporting, so your clients' DPDP reviews go faster.
- Scope agreed in writing up front
- Personal data mapped across products, tools and vendors
- Consent, notices and rights workflows checked against the Act and Rules
- Evidence ready for customer reviews and Board inquiries
What is the DPDP Act, and who does it cover?
The Digital Personal Data Protection Act, 2023 is India's law on how organisations collect and use digital personal data. The DPDP Rules, 2025 set out how it works in practice. It applies to processing in India, and to organisations abroad that offer goods or services to people in India.
Who the person is
- Name
- Phone & email
- Address
- Government ID numbers
- Device IDs & IP addresses
- Account & login details
What you know about them
- Purchases & payments
- Location
- Usage & behaviour
- Health or financial details
- Photos & recordings
- Support conversations
Personal data
Digital personal data
Any data about an individual who can be identified by or from it, collected in digital form or digitised later.
Unlike GDPR, the Act has no separate “sensitive” category: all personal data gets the same protection.
The three core roles
Data Fiduciary
The organisation that decides why and how data is processed. It owes notice, valid consent, security, breach reporting and erasure.
Data Processor
A vendor that processes data on a fiduciary's behalf under a contract. The fiduciary stays accountable for it.
Data Principal
The individual. They can access, correct and erase their data, raise grievances and nominate someone to act for them.
Where personal data usually hides
- Production databases
- CRM & marketing
- Analytics & tracking
- Support tickets & chat
- Backups & exports
- HR & payroll
Analytics tools, CRM exports and support inboxes hold personal data too, and are the places most often left off the map. Discovery, the first phase, finds each of them.
Read the GDPR and DPDP Act guide: duties, rights and penalties side by sideIf you collect personal data from people in India, the Act applies.
Size is not an exemption. A startup with a sign-up form is a Data Fiduciary in the same way a bank is. Only the extra duties of a Significant Data Fiduciary depend on scale.
01 · The people
Data Principals
- Customers and users
- Employees
- Children, through a parent
- Leads and contacts
Receive a notice, give or withdraw consent, and exercise their rights.
02 · Your organization
Data Fiduciary
- Consumer apps & e-commerce
- Banking, fintech & insurance
- Healthcare & edtech
- SaaS, for its own users
Accountable to the Data Protection Board of India.
03 · Your vendors
Data Processors
- Cloud hosting
- CRM and email tools
- Payroll and support platforms
Work under a processor contract; you stay accountable for them.
If your product has a sign-up form, a payment page or a support inbox serving people in India, you are already a Data Fiduciary.
A Significant Data Fiduciary is designated by the government by volume and risk. It must appoint a Data Protection Officer in India, run periodic impact assessments and have an independent data audit.
How a DPDP compliance program works
Six phases, each with a named output. The DPDP readiness assessment covers the first two. The DPDP compliance program runs all six, ending with a mock Board inquiry.
- Discover
Data inventory & flow mapping
Find every system, vendor and process that touches personal data, and map how it moves, including cross-border flows.
- Products
- Internal tools
- Vendors
- Cross-border flows
- You get
- A data inventory, a data-flow map and a role register (fiduciary or processor).
- You provide
- System owners for a short interview each, and architecture docs.
- Assess
Gap & readiness assessment
Test each practice against the Act and Rules, and rank the gaps by penalty exposure.
- Notice and consent
- Rights handling
- Safeguards
- Vendor contracts
- You get
- A gap register and a risk-ranked remediation roadmap.
- You provide
- Access to current notices, policies and vendor contracts.
- Document
Notices, policies & contracts
Write plain-language notices, the privacy policy, retention schedules and processor agreements.
- Notices
- Privacy policy
- Retention schedule
- Processor clauses
- You get
- A notice set, policy suite, retention schedule and processor clauses.
- You provide
- Legal sign-off from your counsel on final wording.
- Implement
Consent, rights & safeguards
Put consent capture and withdrawal, a rights-request workflow and security safeguards in place.
- Consent records
- Rights workflow
- Grievance route
- Access & logging
- You get
- Working consent records, a rights and grievance workflow, and safeguards.
- You provide
- Engineering time for consent and request flows.
- Train
Teams & breach drills
Train product, support and engineering by role, and run a breach drill against the reporting clock.
- Role-based training
- Breach playbook
- Board notice drill
- Templates
- You get
- Training records and a breach-drill report.
- You provide
- Time from support, product and engineering leads.
- Validate
Mock inquiry
Check practice against policy, run a mock Board inquiry, and close the findings.
- Practice vs policy
- Mock inquiry
- Findings
- Review cycle
- You get
- A validation report and a closed findings log.
- You provide
- Leadership time for the mock inquiry review.
Agreed in writing once Discover is complete, based on how many systems, vendors and products hold personal data.
What you receive
Everything the program produces lands in one accountability file. Each item is paired with the question a client's reviewer or the Board would ask about it.
Each gap comes with the specific fix and the owner who'll run it. We verify each fix and update the register, so the evidence exists before anyone asks for it.
There is no official DPDP certification. You get a documented program and the evidence behind it. ISO 27701 can add a certifiable privacy standard on top.
01, Discover phase: Data inventory & flow map
Every system, vendor and cross-border flow, with your role for each.
02, Assess phase: Gap register & roadmap
Gaps ranked by penalty exposure, with owners.
03, Document phase: Privacy notices
Plain-language notices, in English and other scheduled languages where needed.
04, Document phase: Retention & erasure schedule
Retention per purpose, and how erasure happens.
05, Document phase: Processor contract clauses
Clauses for security, breach notice and deletion.
06, Implement phase: Consent records
Consent capture and withdrawal records per purpose.
07, Implement phase: Rights & grievance workflow
Intake, identity checks and published response times.
08, Train phase: Breach response plan
Board and Data Principal notice templates, and a drill report.
09, Validate phase: Validation report
Mock inquiry results and a closed findings log.
Illustrative example, not client data
What one line of the data inventory looks like
- System
- Customer sign-up and accounts
- Data
- Name, mobile number, email, city
- Purpose
- Creating and running the account
- Basis
- Consent, captured at sign-up
- Shared with
- Cloud host and SMS vendor (processors)
- Retention
- Until account closure, then erased
Four common DPDP misconceptions
Each one is common, and each one makes the work later more expensive.
Assumption 01
Assumption: We're too small for the DPDP Act.
What the DPDP Act actually means
The core duties apply at any size. Only the extra Significant Data Fiduciary duties depend on scale.
Assumption 02
Assumption: Our GDPR program already covers it.
What the DPDP Act actually means
It covers a lot, but the Act has its own consent rules, an under-18 child threshold and fixed penalties. Map the differences first.
Assumption 03
Assumption: We don't hold sensitive data, so we're out.
What the DPDP Act actually means
The Act has no sensitive-data trigger. Names and phone numbers are enough.
Assumption 04
Assumption: It's a one-time project.
What the DPDP Act actually means
Notices, vendors and retention change with the product, and the records must stay current.
Heard one of these from your team? A DPDP readiness assessment shows where you really stand.
Get a DPDP readiness assessmentWhat you can hold us to.
We don't publish client logos or case studies; we keep our clients' data practices private. These are the commitments we make instead.
Our commitments
Experienced practitioners lead
Every engagement is led by experienced practitioners.
Peer review
Every deliverable is peer-reviewed before it reaches you.
Written scope and change control
You know what is covered, and what happens if scope changes, before work starts.
Alongside your counsel
We build the program; legal opinions stay with your lawyers.
Want to speak to a client? Ask for a reference while we scope your work and we'll arrange it directly.
Ask for a referenceDPDP Act questions buyers ask
What is the DPDP Act?
India's law on collecting and using digital personal data.
The Digital Personal Data Protection Act, 2023 sets out how organisations may collect and use digital personal data. The DPDP Rules, 2025 add the operating detail: notices, breach reporting, retention and consent managers.
India's data law, and how it meets the others.
Every DPDP guide we publish: the Act and its roles, the duties and penalties, the practical work of getting ready, and how the law meets GDPR, SOC 2 and ISO 27001.
The Act and its roles08
- The DPDP Act, 2023 in plain wordsWho it covers, the key terms, and how the law is laid out.
- Data fiduciary, processor or consent manager?The three roles the Act names, and which one you are.
- What a data fiduciary must doThe duties, from notice to security to erasure.
- Data principal rights, and running requestsThe rights people hold, and a workflow that answers them.
- Valid consent and noticesWhat a notice says and what makes consent count.
- Consent managersWhat a consent manager does, and when you would use one.
- Children's data and parental consentVerifiable consent, the limits on tracking, and the exemptions.
- Processing without consentThe legitimate uses and the exemptions, and their limits.
Duties and enforcement05
- Sending personal data out of IndiaHow the Act treats transfers abroad, and where other laws bite.
- Personal data breaches under the DPDP ActWho must be told, what they are told, and your records.
- Significant data fiduciariesThe extra duties: DPO, audits and impact assessments.
- The Data Protection Board and penaltiesHow enforcement works and the ceilings the Act sets.
- The DPDP Rules, 2025What the Rules add to the Act, and how they phase in.
Getting ready06
- Data mapping and the processing recordThe inventory every other DPDP task depends on.
- A DPDP implementation roadmapThe phases from data map to evidence, in a sensible order.
- A DPDP compliance checklistA working list to test your programme against.
- Retention and erasureWhen data must go, and how to prove that it did.
- Reasonable security safeguards, in practiceWhat the duty asks, and how ISO 27001 and SOC 2 evidence it.
- Grievance redressal and the contact pointWho people write to, and how complaints are handled.
By sector and neighbouring law03
DPDP & GDPR03
Know where your personal data stands.
Book a call
Tell us your products, where your users are, and the vendors that touch personal data.
Agree the scope
We respond within 24 hours, then agree the scope with you in writing.
Your DPDP readiness assessment
One map of your data, one ranked list of what to fix.
- Collecting data in India:
- our readiness assessment maps your personal data, tests consent and notices against the Act, and ranks what to fix first.
- SaaS and IT vendors:
- we tighten processor contracts, safeguards and breach reporting, so your clients' DPDP reviews go faster.
We are not a law firm. Legal opinions on contested points come from your counsel; we work alongside them.