DPDP Act compliance, built into your systems
We find every place personal data lives, build consent, rights, retention and breach workflows into the systems you already run, and our partner law firm signs off the legal documentation.
DPDP deadlines that apply to you
DPDP Rules 2025 compliance runs on three dates. For most companies, the one that matters is 13 May 2027.
- 13 November 2025
- DPDP Rules notified; Data Protection Board provisions in force
- 13 November 2026
- Consent Manager registration rules (Rule 4) start. Most companies don't need to register.
- 13 May 2027
- Core duties start: notices, consent, rights requests, security, breach reporting, retention
Who does what: our engineers and our partner law firm
DPDP Act compliance in India needs legal work and engineering work. You don't need separate DPDP Act consultants and engineers: our engineers do the technical work, and our partner law firm does the legal work.
Our partner law firm
- Applicability opinion
- Notice wording
- Processor contracts
- Signed, written documentation
Mono engineers
- Data map
- Consent capture and logs
- Rights-request workflow
- Retention jobs
- Breach runbook
- Audit evidence
What the DPDP Act changes in your systems
Use this as a DPDP compliance checklist: each duty, the system change it needs, and the evidence that shows it's done.
| Obligation | System change | Evidence |
|---|---|---|
| Notice and consent | A clear notice wherever personal data is collected. Consent recorded per purpose, with a way to withdraw it. | Evidence: Versioned notices and a consent log |
| Rights requests (access, correction, erasure, grievance) | One intake for requests, an identity check, routing to every system that holds the data, and deadline tracking. | Evidence: Request log with each step and its date |
| Retention and erasure | A retention period for each system, with deletion run as scheduled jobs. | Evidence: Retention schedule and deletion logs |
| Security safeguards | Access control, encryption, logging and monitoring on systems that hold personal data. | Evidence: Access reviews, logs and a control register |
| Breach notification | Detection, triage and one runbook that covers CERT-In and the Data Protection Board. | Evidence: Tested runbook and incident records |
| Vendors and processors | A map of which vendors receive personal data, and controls on what they get. | Evidence: Processor register; contracts flagged for the law firm |
| Children's data | Verifiable parental consent wherever children use your service. | Evidence: Parental consent records |
Not sure where you stand? Take the free 2-minute DPDP self-check.
How we help
Our DPDP compliance services start with a gap assessment, then build what it finds. If you want the rest of your tech checked too, the full tech audit covers data protection.
DPDP gap assessment
A personal data inventory, data-flow maps, a gap register and a costed plan.
DPDP implementation
Consent logs, rights requests, retention jobs and breach workflows, built into your systems.
Full tech audit
Infrastructure, code, security, spend and AI tools, with data protection included.
From assessment to evidence
One DPDP compliance company for the whole job, from the first data map to the records you show the Data Protection Board.
- 01
Scope
Agree which systems, teams and vendors are in scope, in writing.
- 02
Assess
Map personal data and compare each system against the Act and Rules.
- 03
Design
Plan the consent, rights, retention and breach changes.
- 04
Build
Build the changes into the systems you already run.
- 05
Evidence
Collect the logs and records that show it works. The law firm signs off.
- 06
Run
Hand over runbooks so your team keeps it running.
FAQ
DPDP compliance FAQs
Most duties start on 13 May 2027, 18 months after the DPDP Rules were notified on 13 November 2025. The rules for registering Consent Managers start earlier, on 13 November 2026.
For most companies, no. It is when the rules for registering as a Consent Manager start. Registration is for companies that want to run a consent platform for others: an Indian company with a net worth of at least ₹2 crore. Your main deadline is 13 May 2027.
No. Our engineers do the technical work. Our partner law firm reviews it and gives you signed, written legal documentation.
Up to ₹250 crore for failing to take reasonable security safeguards to prevent a breach. Up to ₹200 crore for failing to report a breach or for breaching the duties on children's data. Other failures carry lower limits set out in the Act's Schedule.
Find every system that holds personal data, then compare how each one works against the Act and Rules. That is the gap assessment.
Not always. You need consent records you can prove. Some companies buy a platform; many build consent capture and logging into their own apps. We help you choose, then build or integrate it.
CERT-In requires cyber incidents to be reported within 6 hours. Under the DPDP Rules you must tell affected people and the Data Protection Board without delay, and send the Board a detailed report within 72 hours. We build one runbook that covers both.
Yes. Employee data is digital personal data. Some processing for employment is allowed without fresh consent, but security, retention and breach duties still apply.