Get audit-ready for DPDP Act
DPDP Act 2023 (India) · Digital Personal Data Protection Act
India's comprehensive data protection law governing the processing of digital personal data, establishing rights of data principals and obligations of data fiduciaries.
DPDP ActWhat is DPDP Act?
India's comprehensive data protection law governing the processing of digital personal data, establishing rights of data principals and obligations of data fiduciaries.
Who it applies to
Organisations processing digital personal data in India, and those processing Indian data from outside the country when offering goods or services here. Relevant to essentially every Indian business holding customer records.
How the standard is organised
Framed around the Data Fiduciary and its duties - notice, consent, purpose limitation, security safeguards and breach notification - with additional obligations for entities notified as Significant Data Fiduciaries.
Framework names, marks and abbreviations (ISO, SOC 2, PCI DSS, TISAX, HIPAA, GDPR and others) are trademarks of their respective standards bodies and are used here only to describe what the Bitkosh Readiness Platform helps you track and prepare for. The badges shown are original Bitkosh artwork, not the official marks. Bitkosh Technologies is not affiliated with, sponsored by, or endorsed by ISO, AICPA, the PCI Security Standards Council, ENX/VDA, or any other framework owner, and using this platform does not by itself confer or guarantee certification — certification/attestation is granted only by the relevant accredited third-party body.
DPDP Act on the Bitkosh platform
The 46 DPDP Act controls sit in one workspace with gap assessment, evidence collection and your readiness score, and shared controls count towards the equivalent requirement in the other 47 ready frameworks at the same time — so a second framework costs a fraction of the first.
How the platform worksSample controls
Six controls from the platform's control library, chosen because they are the most specific to this framework.
- ACT-9.1Obtain verifiable parental or guardian consent
Before processing children's data or applicable data of a person with a lawful guardian, obtain verifiable consent subject to notified exemptions.
Children & Guardians - RULE-3Provide itemised notice and rights links
A standalone clear notice must itemise data and purposes and link to consent withdrawal, rights exercise and Board complaints; commences 13 May 2027.
Notice & Consent - ACT-3Determine territorial and material applicability
Document whether digital personal data processing in India, or processing connected with offering goods or services to Data Principals in India, is in scope and record exclusions.
Scope & Governance - ACT-9.3Restrict child tracking and targeted advertising
Do not track or behaviourally monitor children or direct targeted advertising at them unless a notified exemption and its conditions apply.
Children & Guardians - ACT-8.2Engage processors under valid contracts
Use Data Processors only under valid contracts and govern processing performed on the Data Fiduciary's behalf.
Processor Management - ACT-8.10Operate an effective grievance mechanism
Establish an effective mechanism for Data Principal grievances and respond within the published period.
Data Principal Rights
More privacy & data protection frameworks
Frequently Asked Questions
Who publishes DPDP Act, and who does it apply to?
How is DPDP Act conformance demonstrated?
How is DPDP Act structured?
Ready to get audit-ready for DPDP Act?
See how the Bitkosh Readiness Platform gets you audit-ready for DPDP Act — and the other 47 ready frameworks — from a single control library.