Cyber Security
DPDP Act Compliance
The Digital Personal Data Protection (DPDP) Act, 2023 applies to almost every business that handles personal data of people in India. We help you understand what it means for your systems and teams, close the gaps, and put the security safeguards and processes in place that the Act and the DPDP Rules expect.
What's included
Capabilities
- DPDP applicability and gap assessment
- Personal data discovery and data flow mapping
- Privacy notices and consent journeys
- Data Principal rights requests (access, correction, erasure)
- Reasonable security safeguards for personal data
- Personal data breach response and notification process
- Data retention and deletion schedules
- Processor and vendor contract reviews
What you get
- A clear view of what personal data you hold, where it flows and why
- A prioritised DPDP gap report with owners and timelines
- Notices, consent records and rights-request processes that work in practice
- Security controls and a breach response plan you can evidence
Our approach
How we deliver dpdp act compliance
- 01
Assess
We confirm how the Act applies to you, map the personal data you collect and process, and compare current practice with the Act and Rules.
- 02
Plan
You receive a prioritised remediation plan covering notices and consent, rights requests, retention, vendors and security safeguards.
- 03
Implement
We help your product, IT and legal teams put the changes in place, from consent flows in your apps to access controls, logging and encryption.
- 04
Sustain
Breach drills, periodic reviews and security testing keep your programme current as your systems and the regulations evolve.
Does the DPDP Act apply to our business?
If you process digital personal data of people in India, such as customers, employees or users, it very likely does. It can also apply to businesses outside India that offer goods or services to people in India.
When do the DPDP Rules take effect?
The DPDP Rules, 2025 were notified in November 2025 and phase in over 18 months, with most obligations on businesses applying from the end of that period. Starting early leaves time to change systems and contracts.
What are the penalties for non-compliance?
The Act allows penalties of up to ₹250 crore per instance, for example for failing to take reasonable security safeguards to prevent a personal data breach.
Do you provide legal advice?
We are a cyber security and technology firm, not a law firm. We handle the technical and operational side of compliance and work alongside your legal advisers on interpretation.
More cyber security services
Find out where you are exposed — before an attacker does.
Book a free, no-obligation consultation. We will discuss your environment, your concerns and the most effective next step.