01
Digital & SaaS Companies
Platforms, apps, marketplaces, SaaS products and internet businesses processing user data at scale.
India DPDP Act & Rules Compliance
Your data practices are becoming a board-level compliance risk.
India’s Digital Personal Data Protection framework is moving into operational compliance.
We help organisations discover personal data, identify compliance gaps, redesign consent and notices, establish rights workflows, strengthen security governance, and build an auditable DPDP compliance programme.
Practical implementation support across legal, process, technology and governance.
Who Needs DPDP Readiness?
If your organisation handles digital personal data, this belongs on your risk agenda.
DPDP readiness is relevant wherever customer, employee, vendor, user or partner personal data enters digital systems and business processes.
02
Financial Services & Fintech
Businesses handling identity, KYC, payment, transaction, risk, support and behavioural data.
03
Healthcare & Healthtech
Organisations processing patient, appointment, diagnostic, health service and workforce information.
04
Retail, D2C & E-commerce
Customer accounts, orders, marketing, loyalty, analytics and customer-support data create a large privacy footprint.
05
GCCs, IT & BPO
Complex data flows, client systems, employees, vendors and cross-border operating models demand governance.
06
Any Data-Driven Enterprise
If you collect names, emails, phone numbers, identifiers, profiles or employee records digitally, readiness matters.
The Cost of “We’ll Do It Later”
₹250 Cr
Potential maximum penalty for specified security-safeguard failures under the Act.
Why organisations cannot treat this as a policy-only exercise
Regulation exposes operational gaps.
Unknown data = unknown riskTeams often cannot answer where personal data lives, why it is held or who can access it.
Consent can break at scaleLegacy signup, marketing and product journeys may not map cleanly to notice and consent requirements.
Deletion is harder than it soundsBackups, CRM tools, analytics, spreadsheets and vendors can turn one deletion request into a multi-system problem.
A breach becomes a compliance testSecurity controls, incident response, records and communication processes must work when pressure is highest.
Our Services
From “Are we exposed?” to an operating compliance programme.
Our work combines governance, process design, documentation and technology implementation so compliance is usable by the business.
1
DPDP Readiness & Gap Assessment
Assess current practices against applicable DPDP obligations, identify gaps, rank remediation priorities and create an accountable action plan.
2
Personal Data Inventory & Data Mapping
Identify personal data categories, systems, owners, purposes, data flows, processors/vendors, retention periods and key risks.
3
Privacy Notices & Consent Design
Design clearer notice and consent journeys across websites, apps, onboarding, marketing and product workflows.
4
Data Principal Rights Workflows
Design intake, identity verification, routing, fulfilment, tracking, escalation and evidence for rights requests and grievances.
5
Retention & Deletion Governance
Define retention logic, deletion triggers, system responsibilities, exception handling and evidence of lifecycle controls.
6
Breach Readiness & Security Governance
Review reasonable safeguards, incident response, breach workflows, escalation roles, vendor dependencies and documentation.
7
Vendor & Processor Risk
Map third parties processing personal data, assess control gaps, update contracts and create a repeatable vendor privacy process.
8
Policies, Training & Governance
Build practical privacy policies, roles, committees, training, management reporting and evidence for ongoing compliance.
Solutions Roadmap
A four-stage path from uncertainty to defensible compliance.
Instead of starting with documents, we start with your actual data, processes and systems—then build controls around how the business operates.
01
Discover
Map data, systems, teams, vendors, purposes and existing privacy practices.
02
Assess
Run a DPDP gap assessment and prioritise regulatory, security and operational exposure.
03
Remediate
Implement notices, consent, rights workflows, retention, policies, contracts and security actions.
04
Operate
Track requests, evidence compliance, test controls, train teams and continuously improve.
Regulatory Timeline: Plan Against Notified Rules
13 Nov 2025
Specified foundational provisions of the DPDP Rules commenced on publication.
13 Nov 2026
Rule 4 concerning Consent Manager registration and obligations comes into force one year after publication.
13 May 2027
Rules 3, 5–16, 22 and 23 come into force eighteen months after publication, bringing major operational requirements into effect.
What You Receive
Concrete outputs your legal, security, product and leadership teams can use.
Deliverable 01
Executive Risk Report
- Readiness scorecard & benchmark
- Top compliance & regulatory gaps
- Risk-prioritised remediation plan
Deliverable 02
Compliance Control Pack
- Personal data inventory & mapping
- Processing register (RoPA equivalent)
- Retention & deletion framework
- Complete policy & governance set
Deliverable 03
Operational Workflows
- Consent & notice user journeys
- Data Principal rights-request process
- Breach escalation & incident response
- Vendor & third-party review workflow
DPDP Readiness & Consultation
Don’t discover your privacy gaps during an incident or regulatory escalation.
Start with a focused DPDP readiness assessment and turn your highest-risk gaps into a practical implementation roadmap.