DPDP compliance you can evidence — not just a policy PDF.
For DPOs, CISOs, compliance heads and CTOs at fintechs, NBFCs, hospitals, schools and enterprises: a readiness programme that maps your personal data, fixes consent and rights handling, and leaves you with proof an auditor can read.
Most DPDP gaps are operational, not legal.
The privacy policy exists. The problem is that nobody can show, for one named customer, where their data sits, what they consented to, and who has touched it since.
Sound familiar?
- Consent is a checkbox in the onboarding form. There is no record of which version of the notice the customer actually saw.
- A customer asks what data you hold on them, and the answer takes three departments and two weeks.
- Nobody can list every vendor, cloud service and analytics tool that personal data flows to.
- Marketing, collections and product teams reuse KYC or patient data for purposes it was never collected for.
- Retention policy is “keep everything”, because finance says the regulator might ask.
- Breach response lives in a security runbook that never mentions notifying affected individuals or the Board.
- Your school, hospital or app collects children’s data with no separate parental-consent path.
Enforcement follows evidence.
When a complaint or breach lands, the first questions are simple: what did you collect, on what basis, who did you share it with, and can you prove it? Organisations that answer from a living data map and consent log close the matter. Organisations that answer from inboxes do not.
If three or more signals apply, the ten-question readiness check below will show which compliance area to fix first.
Eight obligations, in plain business terms.
The Digital Personal Data Protection Act, 2023 applies to any organisation that decides why and how the personal data of individuals in India is processed. Here is what it asks of you, stripped of legal language.
Consent & lawful basis
Process personal data only with free, specific, informed consent — or under a narrow set of legitimate uses. Withdrawing consent must be as easy as giving it.
Notice
Before or with the consent request, tell people in plain language what you collect, why, how they can exercise their rights, and how to complain.
Data principal rights
Individuals can ask what you hold, have it corrected or erased, nominate someone to act for them, and expect a working grievance channel with a response.
Data fiduciary duties
Keep data accurate, protect it with reasonable security safeguards, use it only for the stated purpose, and delete it when that purpose is served.
Breach notification
Report personal data breaches to the Data Protection Board and to affected individuals in the prescribed form and timeframe — every breach, not only large ones.
Children’s data
Verifiable parental consent before processing a child’s data, and no tracking, behavioural monitoring or targeted advertising directed at children.
Significant Data Fiduciaries
Organisations notified as significant because of data volume or sensitivity carry extra duties: an independent data auditor, periodic impact assessments and a resident Data Protection Officer.
Processors & vendors
You stay accountable for personal data handled by processors on your behalf. Contracts, not assumptions, define what they may do with it and when they must delete it.
Penalties for non-compliance exist and are material. We keep the legal detail general on this page; specifics are worked through with your counsel during the engagement.
DPDP Readiness Calculator
Ten questions across five compliance areas. Takes about five minutes. Your readiness score and a category-by-category breakdown appear immediately — nothing is sent anywhere.
Answer honestly rather than aspirationally — the value of this tool is in seeing where your gaps actually are. Your answers stay in this browser tab and are never transmitted or stored.
Band description.
You must keep it. They can ask you to delete it. Both are true.
RBI, IRDAI, SEBI, income-tax and labour rules require you to retain KYC records, transaction logs, policy documents and employee files for years. The DPDP Act gives the same individuals a right to erasure and to withdraw consent. Organisations that treat this as a contradiction freeze. Organisations that document it move on.
The resolution is a written retention-vs-erasure policy that records, for every category of personal data, the purpose, the legal basis, the mandated retention period and its source, and exactly what happens when consent is withdrawn: non-mandated processing stops, the record is ring-fenced for the statutory period, and it is deleted on schedule with a log to prove it.
- Data-element register mapped to each retention source (RBI KYC rules, tax law, HR statute) and its expiry clock
- Withdrawal workflow that halts marketing, profiling and cross-sell within a defined SLA while preserving what law requires
- Erasure exceptions documented in a form defensible to both the sectoral regulator and the Data Protection Board
- Automated deletion on expiry, with an evidence trail that shows it happened
Six deliverables. Each one is something you can hand to an auditor.
We do not deliver a slide deck of findings. We deliver the artefacts that make compliance operational — and the evidence that it is running.
- Scoped to your data footprint: 10–20 systems for a mid-sized firm, more for group structures
- Led by a named engagement lead with your compliance head as counterpart
- Security controls verified by the same team that runs VAPT and incident response
- AI systems, prompt logs and model vendors mapped as personal-data flows from day one
Data map & inventory
Every system, vendor and data flow that touches personal data, with category, purpose, legal basis, owner and retention clock. Maintained as a living register, not a spreadsheet nobody opens.
Consent & notice design
Layered, plain-language notices and consent capture at each collection point — app, branch, web, call centre — versioned so you can prove what a person saw and agreed to.
Rights-request process
One intake channel, identity verification, routing to data owners, SLA tracking and templated responses for access, correction, erasure and nomination requests.
Breach playbook
Detection-to-notification runbook with severity triage, a decision tree for Board and individual notification, communication templates, and a tabletop exercise with your incident team.
Vendor contracts & processor controls
Standard data-processing clauses, a risk-tiered vendor register, and a review of existing agreements for gaps in sub-processing, cross-border transfer and deletion commitments.
Evidence store
Policies, approvals, training logs, consent records and rights-request history captured in Avisha Trust — so the answer to “show me” takes minutes, not a scramble.
Deliverable 01 is where most programmes stall: putting a retention clock on every data element when the RBI or IRDAI rule and the erasure right point in opposite directions. The playbook we use is free and there is no form in front of it.
Read the retention-vs-erasure playbookA checklist gets you past the first audit. Continuous readiness gets you past the second.
Checklist compliance
- Policies written once, unchanged as products, vendors and AI tools change
- Consent records buried in application databases nobody can query per person
- Rights requests handled by whoever happens to receive the email
- Breach plan untested until the day it is needed
- Evidence reconstructed from inboxes when the regulator or a customer asks
Continuous readiness with Avisha Global
- Living data map updated as systems, vendors and models change
- Versioned consent and notice records searchable for any individual
- Rights requests tracked against SLAs with a full audit trail
- Breach playbook rehearsed; notification templates ready to send
- Evidence captured continuously in Avisha Trust, ready on request
From gap assessment to steady state in about twelve weeks.
Timelines assume a mid-sized organisation with 10–20 systems holding personal data. Larger estates extend the remediation sprint, not the method.
Week 1–2 · Gap assessment
Interviews with product, IT, HR, marketing and vendor owners. Data-flow discovery across systems. Output: a scored gap report against every DPDP obligation, ranked by exposure.
Week 3–6 · Remediation sprint
Close the highest-risk gaps first: retention-vs-erasure policy, processor contracts, breach playbook, grievance-officer or DPO designation. Weekly steering with your compliance lead.
Week 7–12 · Consent & rights operations
Roll out redesigned notices and consent capture at collection points, stand up the rights-request desk, train front-line and data-owner teams, run a breach tabletop.
Ongoing · Monitoring via Avisha Trust
Consent, rights SLAs, vendor reviews and policy attestations tracked on one dashboard, with quarterly reviews as data flows and AI usage change.
The same Act. Very different obligations on the ground.
A lender’s hardest problem is reconciling KYC retention with erasure. A hospital’s is consent across labs, insurers and apps. A school’s is that almost every data principal is a child. We start from your sector’s pressure point, not a generic template.
Ask About Your Sector
Fintech
DPDP for payments and lending
Read the sector guideNBFC
DPDP for RBI-regulated NBFCs
Read the sector guideInsurance
DPDP for IRDAI-regulated insurers
Read the sector guideRegistered Broker
DPDP for SEBI-registered brokers
Read the sector guideHealthTech
DPDP for digital health
Read the sector guideHospital
DPDP for hospitals and clinical establishments
Read the sector guideEdTech
DPDP for education platforms
Read the sector guideE-Commerce
DPDP for online retail
Read the sector guideHR Tech
DPDP for workforce platforms
Read the sector guideSaaS
DPDP for software companies
Read the sector guideEnforcement Tracker
IT Act precedents, CERT-In directions and GDPR analogues: what regulators actually penalise.
Open the trackerFree Gap Assessment
18 questions, 7 areas, instant prioritised action list. Nothing leaves your browser.
Start nowCompliance, security and AI from one team.
Security and compliance under one roof
The breach playbook is written by people who run VAPT and incident response, not only by policy authors. “Reasonable security safeguards” are tested, not assumed.
Product-backed evidence
Avisha Trust captures consent, rights requests and attestations continuously. The Avisha Trust Seal signals your posture publicly — it is not a government or statutory certification, and we say so.
Built for the Indian regulatory stack
We reconcile DPDP with RBI, IRDAI, SEBI, CERT-In and tax obligations rather than importing a GDPR template and hoping it fits.
AI usage in scope from day one
Training data, prompt logs and AI vendors are mapped as personal-data flows, because that is where the next generation of gaps is forming.
Two weeks of gap assessment tells you which of the eight obligations you are actually exposed on, ranked by exposure. Most compliance heads are wrong about which one — it is rarely notices, and it is usually processors or retention.
Request the two-week gap assessmentFrequently asked questions
Know your DPDP gaps before the Board or a customer finds them.
Start with a scoped two-week gap assessment, or run the free readiness check first.