🇮🇳 DPDPA Compliance

Methodology

1. 01

   Discovery & Scoping

   Business model, data flows, vendor landscape, and regulatory exposure. Decide whether you're a Data Fiduciary, Significant Data Fiduciary, or Data Processor under DPDPA.

2. 02

   Gap Assessment

   Map current state against DPDPA 2023 obligations — Sections 4 through 15 and the Digital Personal Data Protection Rules. Quantify the gap with a compliance matrix.

3. 03

   ROPA & Data Mapping

   Build a Record of Processing Activities, map data flows across systems and sub-processors, identify data retention requirements, and surface cross-border transfer risks.

4. 04

   DPIA

   Where processing is high-risk — profiling, automated decision-making, large volumes of children's, health or financial data — we run a Data Protection Impact Assessment aligned with ISO 27701. It is mandatory every 12 months for Significant Data Fiduciaries (Section 10(2)(c), Rule 13(1)) and good practice for everyone else.

5. 05

   Consent Architecture

   Design consent UX, notice UX, withdrawal flows, and grievance mechanisms that satisfy Section 6(1) and hold up under Data Protection Board scrutiny.

6. 06

   Implementation Support

   Technical and process controls — breach response playbooks, Data Principal rights workflows, vendor DPAs, and internal training rolled out across your teams.

7. 07

   Audit Readiness

   Evidence collection, internal audit, and mock regulator inquiry response so you're ready when the Data Protection Board calls.

What You Get

• ✓ DPDPA Readiness Assessment Report (gap matrix mapped to all applicable DPDPA sections)
• ✓ Records of Processing Activities (ROPA) populated for your business
• ✓ Data Protection Impact Assessment (where triggered)
• ✓ Consent Architecture Design Document
• ✓ Breach Response Playbook for both Rule 7 clocks: intimation without delay to affected Data Principals and the Board (Rule 7(1), 7(2)(a)), then the detailed Board report within 72 hours (Rule 7(2)(b))
• ✓ Data Principal Rights Response SOPs — access, correction, erasure, nomination, grievance
• ✓ Board and Leadership Briefing Deck
• ✓ 6-month implementation roadmap with RACI and KPIs

Frequently Asked

Does DPDPA apply to my company if we're not based in India?

Yes. If you process personal data of Data Principals within India for offering goods or services, you are in scope regardless of where you are headquartered. The Act has extraterritorial reach similar to GDPR.

What's the difference between a Data Fiduciary and a Significant Data Fiduciary (SDF)?

The government designates SDFs based on volume and sensitivity of data, risk to sovereignty, impact on electoral democracy, and public order. SDFs have additional obligations — mandatory DPIA, independent data auditor, and a named Data Protection Officer resident in India.

We're already GDPR-compliant. How much work is DPDPA for us?

GDPR compliance gives you 60–70% of DPDPA work done. The gaps are India-specific: consent manager integration, Data Protection Board grievance workflow, cross-border transfer rules under Section 16 (transfers are allowed except to countries the Central Government restricts by notification), and Indian-resident DPO requirements for SDFs.

How long does readiness take?

8–16 weeks for most mid-sized organizations. Faster if GDPR-ready with mature privacy infrastructure; longer if starting from scratch. We size the engagement honestly after a free 30-minute scoping call.