DPDP Act 2023
DPDP compliance that operates, not just documents.
India's Digital Personal Data Protection Act requires more than a privacy policy. We help you map personal data, establish lawful purposes, run consent and rights, govern vendors, and respond to incidents with evidence.
What changes under DPDP
The DPDP Act 2023 sets obligations around how digital personal data is collected, used, shared, retained and deleted. For most organisations, the practical shift is from a document-led approach to an operating model: you need to know where personal data is, why you hold it, who can access it, how long you keep it, and what happens when something goes wrong.
The programme below is deliberately practical. It is designed to produce artefacts your team can run and evidence you can show — not a stack of policies that nobody opens.
The programme
01 · Data discovery and record of processing
We map personal data across applications, databases, backups, spreadsheets, support tools and vendors. The output is a record of processing with data categories, purposes, systems, owners, locations and retention.
02 · Purpose, notice and consent
We define the lawful purpose for each processing activity, rewrite notices in clear language, and design consent capture that is specific, informed, unconditional and revocable. Where consent is not the basis, we document the applicable route with your counsel.
03 · Rights, retention and deletion
Data-principal requests need an owner and a workflow. We design access, correction, erasure and grievance handling, then connect retention rules to actual deletion — including backups and downstream vendors.
04 · Vendors and cross-border processing
Most personal data leaves your perimeter through vendors. We review processor contracts, security posture, sub-processors and data locations, and document the safeguards that apply to each flow.
05 · Breach readiness and evidence
We define what counts as a personal data breach, who decides, who notifies, what gets recorded and how the response is tested. The goal is a response that works at 2 a.m., not a document that works in a folder.
Who this is for
Our DPDP work fits organisations that collect or process personal data in India: SaaS and consumer platforms, healthcare and wellness providers, financial-services vendors, professional-services firms, and teams that handle employee or customer data at scale. It also fits global teams that need an India-specific privacy programme alongside GDPR or other obligations.
What we do not do
We are not a law firm and we do not provide legal advice. We work alongside your counsel on interpretation and notices, and we implement the operational and security controls. Compliance remains a shared responsibility between your organisation, its advisers and its vendors.
DPDP questions we hear
Does DPDP apply to our organisation?
The Act applies broadly to digital personal data processed in India, and to processing connected with offering goods or services to people in India. Applicability and exemptions depend on your facts; your counsel should confirm them. We can map the data flows that make the question concrete.
Do we need a Data Protection Officer?
The Act provides for a Data Protection Officer in certain cases, including for Significant Data Fiduciaries. Whether that applies to you depends on your classification and sector. We help define the role, responsibilities and operating interface once your counsel confirms the requirement.
Can you write our privacy notice?
We can draft the operational content and plain-language structure, but legal sign-off should come from your counsel. The notice must match what you actually do, so we build it from the data map rather than from a template.
How do we handle a personal data breach?
You need a defined process: detect, assess, contain, decide on notification, record and learn. We build the runbook, define roles and test it with a tabletop exercise. Notification obligations and timelines should be confirmed with your counsel.
Is there a DPDP certification?
We do not offer a certification, and we would be cautious of anyone who sells compliance as a certificate. The work is an operating programme with evidence. We can assess readiness and help you remediate; we do not act as a regulator or certification body.
DPDP
Make the obligations operational.
Bring your data flows, notices and current practices. We will show you where the gaps are and what a workable programme looks like.