Whoever runs your DPDP programme runs it here.

The machinery they don’t have. A portal your customers can use without an account, a queue that tracks every deadline, a map of which systems hold one person’s data so erasure is real, and evidence anyone can verify. Your team keeps the judgement — this removes the manual work underneath it.

Yes. We have empanelled lawyers, Data Protection Officers and security specialists who can run your programme or work alongside your team — as a named DPO, on a gap assessment, or drafting notices and processor agreements. They work in the same platform, and you keep it when the engagement ends.

It captures a tick. The Act asks for more: an itemised notice describing each purpose, in plain language, available in the required languages, with withdrawal as easy as giving — and a record you can produce years later showing exactly what was agreed, when, and to what. Most systems capture the tick and none of the rest.

The Act’s Schedule sets penalties by the obligation breached. The largest single item is ₹250 crore, for failing to take reasonable security safeguards. Breach-notification and children’s-data failures carry up to ₹200 crore, Significant Data Fiduciary duties up to ₹150 crore, and most other breaches up to ₹50 crore.

Under Rule 7 of the DPDP Rules 2025 you must inform the Data Protection Board without delay on becoming aware of a breach, and follow it with detailed particulars within 72 hours. Affected Data Principals must also be informed without delay. The 72 hours is the deadline for the full account, not for the first intimation.

Some of it, and only where the obligation cannot be met without it — which is a more useful answer than a flat no. The Data Registry, the map of your estate, holds metadata and nothing else: which systems exist, what categories they hold, who owns them. It never holds a record about a person. Consent and rights are necessarily different, because §6(10) makes you able to demonstrate a particular person consented, and §11 makes you answer that person — neither is possible without a record of them. So the consent log and the rights queue do hold one. We keep it minimal, identifiers are stored as hashes, and where a contact address is needed to reply to somebody it is encrypted at rest. Everything sits in India, and your operational databases stay where they are — we never copy them.

On infrastructure in India. Data at rest, backups included, stays in-country.

There is no revenue or headcount threshold. The Act applies to anyone processing digital personal data in India, and to anyone outside India processing it to offer goods or services here. A ten-person clinic and a listed hospital chain owe the same core duties — notice, consent, security, breach reporting, and honouring rights requests. What changes with size is the volume of work, which is the part DPDP compliance software takes off you.

The shape is familiar; the detail is not. DPDP compliance India turns on things the GDPR does not have — legitimate uses under §7 instead of six lawful bases, verifiable parental consent for everyone under 18, a breach report to the Board inside 72 hours with no severity threshold below which you may stay quiet, and a blacklist for transfers abroad rather than an adequacy list. There is also no data portability right here. Tooling built for the GDPR maps onto this badly, which is why ours is built against the Act’s own sections.

Yes. Most organisations start with the free Scorecard, then take on Consent or DSR first depending on where their exposure is largest. Modules share one data model, so adding another later needs no migration. Buying a DPDP solution one obligation at a time is the sensible way round — it is also why nothing here is sold as an all-or-nothing suite.