Practice 03 · Data Protection & DPDP
India's Digital Personal Data Protection Act is now operational law with a dated deadline. Most organisations know what it says; few can show an auditor how it is met. We turn the obligations into running capability — discovered, documented, consented, evidenced — and operate it with you afterwards.
The compliance clock
The Act was passed in 2023. The Rules that make it enforceable were notified in November 2025, with obligations phasing in over eighteen months. That is the build window.
The Data Protection Board is constituted and the phased timetable starts running.
Notice, consent, rights handling, security safeguards, breach notification and erasure obligations all apply in full.
For failing to take reasonable security safeguards against a personal data breach. Other failures carry their own ceilings.
What the Act asks of a Data Fiduciary
Consent must be free, specific, informed, unconditional and unambiguous — given by clear affirmative action, against a plain-language notice, in English or any scheduled language, and withdrawable as easily as it was given.
Collect for the stated purpose, use it for that purpose, and erase when the purpose is served or consent is withdrawn — including at your processors.
Individuals can ask what you hold, have it corrected or erased, raise a grievance and nominate someone to act for them. Each request has a workflow and a clock.
Encryption, access control, logging and monitoring, backup and retention controls — specified in the Rules, and the obligation with the highest penalty attached.
Affected individuals and the Data Protection Board must be informed of a personal data breach, with the detailed report following on a tight timeline. Response has to be rehearsed, not improvised.
Verifiable parental consent before processing a child's data, and no tracking, behavioural monitoring or targeted advertising directed at children.
If designated: a Data Protection Officer in India, an independent data auditor, and periodic Data Protection Impact Assessments and audits.
You remain accountable for what your processors do. Cross-border transfers are permitted except to countries the Government restricts — and sectoral regulators may say more.
None of the above counts until it can be shown. The record of processing, the consent log, the DSAR register and the DPIA file are what an auditor — or the Board — will ask to see.
DPDP Act s.11DPDP Act s.12DPDP Act s.13DPDP Act s.14How we work
Four stages. Each one leaves you with an artefact an auditor recognises, not a slide deck. We run them in sequence or join at whichever stage you've reached.
You cannot protect, consent for or erase data you haven't found. Stage one is a complete picture of where personal data lives, how it moves and who touches it.
The Act and the Rules, read against your actual practice. Where consent is implied rather than given, where retention is indefinite, where a DSAR would take a month to answer.
Policies are necessary and insufficient. Stage three deploys the mechanisms — consent capture, cookie governance, rights workflows, breach response — into the systems people actually use.
Compliance decays the day after the project ends. Stage four keeps it alive: the register current, the consents valid, the DSARs on time, the evidence one export away.
Privacy management platform
Documents and spreadsheets do not survive contact with dozens of applications and a statutory clock. Where the estate warrants it, we deploy a privacy management platform and run the programme on it.
We deploy and operate the miniOrange privacy management platform — all six modules under one licence, integrated across your application estate. miniOrange is also our identity and access partner, which matters: consent, rights and access control end up touching the same users and the same systems.
A living inventory of every processing activity: purpose, lawful basis, categories, recipients, retention, transfers.
Structured DPIAs for high-risk processing, with risk scoring, mitigations, sign-off and re-assessment triggers.
Scanning, categorisation, prior consent, granular choice and withdrawal across web properties — the way this site does it.
Purpose-specific notices and consent capture across channels and languages, with versioning, withdrawal and consent-manager readiness.
Intake, identity verification, data retrieval across systems, review, response and deadline tracking for access, correction, erasure and nomination requests.
Programme status for the DPO, the board and the auditor: open DSARs, consent coverage, DPIA backlog, breach events, retention exceptions.
Mapped to the law and the standards
We don't invent a proprietary maturity model. Every control traces to a section of the Act, a Rule, or a clause in a standard you may already hold.
Start where you are
Clause-by-clause assessment, data-flow map and a prioritised roadmap. The fastest way to know how far from the line you stand.
A complete record of processing and DPIAs for your high-risk activities, built from discovery evidence.
The six-module platform integrated across your applications, with consent, cookie and DSAR workflows live.
RoPA upkeep, DSAR handling, continuous DPIA, reporting and audit support, run by our team alongside your DPO.
Questions we're asked
If you process digital personal data of individuals in India — employees, customers, candidates, vendors' staff — you are a Data Fiduciary under the Act, whatever your size or sector. Processing outside India also falls in scope when it is connected to offering goods or services to people in India.
The Act set the obligations; the DPDP Rules notified in November 2025 set the mechanics and the clock. Obligations phase in over 18 months, with full compliance due by 13 May 2027. The Data Protection Board is being constituted now, and consent-manager registration opens ahead of the main deadline.
The Central Government designates Significant Data Fiduciaries based on the volume and sensitivity of data processed, risk to individuals and to the state, and similar factors. Designation brings extra duties: a Data Protection Officer based in India, an independent data auditor, and periodic Data Protection Impact Assessments and audits. If you handle large volumes of personal data, plan as though designation is possible.
The Act's schedule sets monetary penalties per instance, with the highest — up to ₹250 crore — for failing to take reasonable security safeguards to prevent a personal data breach. Failures to notify a breach, to meet obligations for children's data, or to meet Significant Data Fiduciary duties each carry their own ceilings. The Board also considers repetition and mitigation when it decides.
A small organisation with a handful of processing activities can start with documents. Most enterprises cannot sustain RoPA, DPIA, consent records, DSAR deadlines and breach timelines by hand across dozens of applications — and the audit evidence is only as good as the record. We deploy the miniOrange privacy management platform when the estate warrants it, and say so when it doesn't.
Explore further
A readiness review takes weeks, not quarters — and it tells you what to build first.
Choose which categories you allow. Non-essential cookies stay disabled until you enable them here, and nothing in those categories loads before you do.
Required for the site to function — security, load balancing and remembering this choice. These cannot be switched off.
Helps us understand which pages are useful, in aggregate. Disabled until you allow it.
Used to measure campaigns and show relevant content on other platforms.