Is Your Business Ready for DPDP?
If your business stores employee or customer information in spreadsheets, a CRM or web apps, or you communicate with customers on WhatsApp, India's Digital Personal Data Protection (DPDP) Act applies to you.
Enforcement starts 13 May 2027 and fines can reach ₹250 crore for serious violations.
We go beyond other compliance advisors who only tell you what needs to change. We tell you how to implement the technical changes.
DPDP Readiness Assessment
Identify whether your personal-data practices meet DPDP requirements.
Technical & Operational Help
Tell you what needs to change and how to make the changes without disuptring your business.
Practical Governance Support
Set up processes, responsibilities and controls in place for ongoing compliance.
Five quick questions to check your DPDP exposure
Can you show data processing consent from every customer?
Can you legally send marketing messages through WhatsApp?
Can you respond if a customer asks to access or erase data?
Who else has access to copies of customer data right now?
What data must you retain, and what should you delete?
DPDP readiness is operational
Personal data moves through more systems than most teams realize.
Customer, employee, and user records spread across tools that no single person fully tracks — and getting ahead of that takes more than a privacy policy.
The difficult part is often not identifying the requirement, but determining how to make consent, deletion, access control, retention and breach response work across the systems already in use.
- Customer data is spread across websites, forms, CRMs, payment tools, WhatsApp, email, spreadsheets, and support systems
- Privacy notices often do not match actual data flows
- Consent is collected inconsistently or is not recorded clearly
- Vendors process personal data without a clear inventory or contract review
- Old data is retained because nobody owns deletion
- There is no tested breach response process
What we help with
A simple sequence from uncertainty to working controls.
1. Catalog Data
Identify what personal data is collected, how it is stored, and how and with whom it is shared.
2. Review Usage
Examine for what purpose the data is used, whether consent was obtained.
3. Data Lifecycle
Chart what happens to data when users request changes or stop using the service and employees leave.
4. Identify Gaps
Compare current practices with the requirements and identify risks and areas needing correction.
5. Find Solutions
Identify the specific process, system, configuration or development changes required and, where necessary, evaluate implementation options.
Why work with us?
- We look at your actual systems
- We work with what you already have
- We help make the changes
- 25+ years working in privacy and technology
A track record in privacy protections since 2015
Our principal consultant, Sushil, has been writing and working with privacy, data protection, and security since 2015 — long before DPDP had a deadline.
The advice has stayed the same: collect less data, protect it better, explain its use clearly, and build security in from the start.
- The Wire, 2018: India’s proposed data protection measures and privacy concerns
- ORF Digital Policy Portal, 2017: Data minimization and saying “No, thanks” to unnecessary data
- The Wire, 2017: Startup advice on privacy and security from the start
- The Caravan, 2015: Security and privacy issues with a missing children portal
Start with the free DPDP Risk Screener
A quick self-check that shows where your business may be exposed to data protection and privacy risk. Your answers are scored in your browser and stay with you unless you ask us to contact you.
- 15 quick questions
- Plain-language questions anyone can answer
- Risk category and top themes
- Optional follow-up request
Need a deeper review?
Schedule a risk review session. We will look at your business model, systems, vendors, and data handling practices, then suggest the most sensible next step.
Schedule a risk review