RuleExpert
Book a demo Check your score

RuleExpert Partner Programme

We build the platform.
You build the practice.

Demand for DPDP work is growing quickly across every sector we serve. We build the platform, the credential and the method for the DPDP Act and the 2025 Rules. Partners are the capability, and every services engagement that reaches us is routed to one.

Apply to partner Find partners Coming soon Partner login Coming soon

Before anything else

We are not asking you to sell software

You are an adviser, not a reseller. We are not going to put your independence at risk to sell our product.

We generate the demand

Our funnel, our marketing and our inbound enquiries all arrive at a company that does not deliver services. The work goes to partners, whether or not you have ever mentioned our name.

Adoption follows delivery

Run a programme and your client needs somewhere for notices to live, and a consent record that survives being questioned. You do not pitch it. You deliver with it, and they see why.

No targets, ever

No quota, no minimum, no revenue obligation. If your client never adopts the platform, you remain a partner in good standing and still receive routed work.

Three partner types

They want different things, so they get different things

Pick the one that describes your practice. You can hold more than one.

Type one

DPO practices

DPO-as-a-service providers · privacy consultancies

You are running twelve clients out of one spreadsheet. It works, and it does not scale.

  • Consent recorded in a log that cannot be edited afterwards
  • Rights requests and grievances in one queue, clocks running
  • Evidence packages your client can hand to a board
  • The same people carry materially more clients

Apply as a DPO practice

Type two

Law firms and lawyers

Counsel advising on the DPDP Act and the 2025 Rules

You write the opinion. Twelve months later the same client asks the same question, because nothing was ever operationalised.

  • Your position executed and recorded, so it can be proved later
  • Notices, consent and retention built the way you drafted them
  • An evidence trail that holds up when the advice is tested
  • A certification your firm can point to

Apply as a law firm

Type three

Cyber security firms

VAPT · SOC 2 · ISO 27001 · IT security services

Three weeks into an ISO engagement, the client asks whether this makes them DPDP compliant. Today you say it is a different exercise, and somebody else sells it.

  • Additive scope, because ISO and SOC 2 overlap with DPDP only on security
  • A delivery method you can scope, price and repeat
  • Six to eight questions, not a thirty-question privacy audit
  • A clean handover, so you set it up and leave

Apply as a security firm

How we support you

From the day you apply

Sandbox and training open immediately, before we have even made a decision.

A tenant for your own practice

Free, for as long as you are a partner. Your firm holds client data like everybody else, so run your own compliance on it.

A demo environment

Your own, with realistic fictional data, licensed for use in prospect meetings.

A free directory listing

Permanent, whether or not you certify, showing verified facts we can prove rather than claims we cannot.

Routed work, once certified

Engagements matched to your sector, your city and your languages, on a published rule.

Training and enablement

The method, the collateral and the scoping questions your team needs to run a DPDP engagement end to end — the same material our own people work from.

A named contact, and co-delivery early

Your first engagements are run alongside our team, so you are never learning the platform in front of a client.

How you grow with us

One, two, three across everything that matters

Measured on what you know, who you have served, and what you have delivered alongside us. Nothing is measured on what you sell.

1

Registered

Approved and papered

  • Directory listing
  • Practice tenant
  • Demo tenant
  • Full collateral

2

Certified

1 certification · 1 DPDP client of your own

  • Routed engagements
  • The certified partner badge
  • Sorts above uncertified firms
  • Eligible to be subcontracted

3

Advanced

2 certifications · 2 own clients · 1 delivered with us

  • Priority in the routing queue
  • Co-marketing
  • Input on the roadmap

4

Empanelled

3 certifications · 3 own clients · 3 delivered with us, plus a sector specialisation

  • First refusal in your sector or region
  • Named in client-facing material

Your first engagement comes early

Every partner gets a one-time first-deal priority, so the ladder cannot deadlock at the rung everyone starts on.

Specialists win in their lane

Healthcare, D2C, edtech, logistics and BFSI. Hold as many as you earn: a healthcare engagement routes to a healthcare specialist regardless of overall tier.

“Delivered with us” is not a quota

It measures delivery experience, and it is the only thing we can verify without asking you to self-report. There is no penalty for staying at Certified.

How work reaches you

A published rule, not a private list

We offer each engagement to the best-matched partner who has waited longest. That is the whole rule, and we publish it.

1

We qualify first

Real need, budget, decision-maker, timeframe. You should never receive a tyre-kicker from us; if you do, the programme has already failed you.

2

We match on facts

Sector specialisation, city or willingness to travel, languages, capacity, and whether you are accepting clients.

3

One partner at a time

Twenty-four hours to accept or decline, never a broadcast, because you should not do spec work and a prospect contacted by three firms at once looks chaotic.

4

Declining costs nothing

A fast “not our sector” genuinely helps. Only silence affects your position next time.

Your own clients are always yours, permanently. Taking our free DPDP Scorecard does not make a company ours — it is a lead, not a deal.

Certification

A credential that means something

A badge nobody has to earn is worth nothing to the firm holding it, which is why ours is a real assessment.

A written paper

The Act, the Rules and the platform’s boundaries. Scenario-based rather than recall.

A practical

Your team, against a real scenario. Accuracy is scored first, and overclaiming is a fail rather than a deduction.

Common core, one track module

A VAPT engineer does not need to draft consent notices. A lawyer does not need a discovery scan.

Certification says two things and nothing more: that you can operate the platform, and that you know the Act. It is issued to your firm, never to a named individual, and is valid for twelve months. It is not a gate to joining or to being listed — only to routed work.

Apply to partner Find partners Coming soon Partner login Coming soon

Founding partners

The first twenty firms

Founding Partners get priority routing through the first year and a voice on the roadmap.

Five working days to a decision.

Sandbox and training open immediately, before we have decided anything.

No fee, no exclusivity, no minimum commitment.

We will tell you what we cannot do before you ask.

The bar, plainly: a registered firm, one person who will sit the certification, and evidence of DPDP work delivered in the last two years. If that is not you yet, tell us anyway and we will say what would change it.

Already a partner? Partner login is coming soon. Looking for a firm to work with? The partner directory is coming soon.

What happens to what you type here

Expertinasia Pvt. Ltd. — the company behind RuleExpert — decides why and how this information is used, which makes us the Data Fiduciary for it under the Digital Personal Data Protection Act, 2023.

What we collect
Your firm name, your name, work email, the partner type you selected and the description of DPDP work you give us — and, if you fill them in, your phone number and city.
Why, and on what basis
To assess this partner application and reply to you about it. Because you are handing it to us for that purpose yourself, this rests on Section 7(a) of the Act — a legitimate use — and not on consent. We do not need your consent to answer you, so we do not ask for it.
Marketing is separate
If you tick the box below, we will also send occasional DPDP updates and partner programme news. That is a different purpose, it rests on your consent under Section 6, and it is entirely optional — the box is unticked, and leaving it that way changes nothing about the decision on your application.
Who else sees it
Only our own team, and the service providers who run our email and business systems under contract. We do not sell it, and we do not share it for anyone else’s marketing.
How long we keep it
Application records are kept for 24 months from your last contact with us, then deleted. If you become a partner, your records are kept for as long as the partnership runs. If you consent to marketing, we keep your contact details until you withdraw.
Your rights
You can ask us what we hold about you (Section 11), have it corrected or erased (Section 12 — which expressly covers information given under Section 7(a)), and nominate someone to act for you (Section 14). Write to tushar@ruleexpert.com and we will respond within 90 days, as Rule 14(3) requires.
Withdrawing marketing consent
One line to the same address, or the unsubscribe link in any message. It is as easy to withdraw as it was to give, which is what Section 6(4) requires. Withdrawing stops future marketing; it does not undo what was lawfully sent before.
If we get it wrong
Raise it with us first at tushar@ruleexpert.com. If we do not resolve it, you may complain to the Data Protection Board of India — under Section 13(3) the Board expects you to have come to us first.

More detail is in our privacy notice. Nothing above depends on reading it.

Five working days to a decision. Or email partners@ruleexpert.com directly — the form is a convenience, not a gate.

Thank you. Your application is in.

We will reply by email within five working days. Sandbox and training access follow as soon as we have looked at it. If it is urgent, email partners@ruleexpert.com.