DPDP Act Compliance and Readiness

The Act sets rules for how organisations handle personal data in digital form. It calls the business that decides why and how data is used the "data fiduciary", and the person the data is about the "data principal". Broadly, it asks businesses to tell people what they collect and why, ask for consent where it applies, protect the data, let people see, correct and erase it, and report breaches.

Rules made under the Act support it, and different duties come into force at different dates. Which parts apply to you, and how to read them, is a question for counsel. Our work starts from their answer.

We are engineers and process designers. We map data, build consent flows, set up request workflows, automate deletion and write breach response plans. We do not interpret the law. Partner counsel does that, and we work from their guidance. Any formal testing or certification goes through accredited partners.

Any business with a website form, a CRM, an app, an HR system, or student or patient records is handling personal data. Education, healthcare, travel, real estate, e-commerce and service businesses all fit. If you serve children, the Act requires verifiable parental consent for a child's data, which changes how sign-up has to work.

• A data map: what you collect, where it is kept, who can access it and which vendors receive it.
• Consent and notices: clear notices and consent capture in your forms and apps, and a cookie banner that blocks non-essential tags until the visitor agrees.
• Request workflows: a way for people to ask for access, correction or erasure, or to complain, with tracking so every request is closed on time.
• Retention and deletion: rules for how long each kind of data is kept, and automation to remove it afterwards.
• Breach readiness: a step-by-step plan for spotting, containing and reporting an incident under the Act and CERT-In's directions, with a practice run.
• Vendor review: a technical look at the outside vendors who handle data for you.

We talk to the teams who use data and trace where it comes in and goes out. This is where the hidden spreadsheets and old exports turn up. Then we rank the gaps, agree the questions for counsel and plan the changes. We build the flows, workflows and automation, test each one from start to finish, brief your team and run a breach practice exercise.

• Secure by default: access to personal data is narrowed to the people whose job needs it, and every access can be traced in a log.
• Built to scale: consent and request flows are built once and reused across your website, apps and forms, so a new form starts compliant.
• Tested before it ships: every flow, from consent to deletion, is tested end to end, including that deleted data is really gone from every system.
• Looked after after launch: systems and rules both change, and Compliance Care keeps the reviews and requests going.
• Small changes handled, not invoiced: updating a notice or adding a new form to the consent setup gets done, not quoted.
• Honest advice: if all you want is the minimum to show a cookie banner, we will explain why that falls short, and we will tell you when a risk needs a lawyer before an engineer.

Personal data runs through almost everything a business builds. Tracking and consent meet in GA4 analytics setup. Customer messages flow through WhatsApp AI reception and AI agents. Security hardening and ISO 27001 and SOC 2 readiness sit in the same Trust, Security & Compliance work. Because one team builds those systems and the safeguards around them, compliance is designed in, not bolted on.

If you want a legal opinion, or a certificate that says you are compliant, we are not the source. Counsel advises, and we will not hand you a paper that claims more than the work supports.

To start, the DPDP Readiness Scan gives a first look at your personal data, consent and notices. Or tell us where your data lives.