Map the data
Workshops and system review to build a personal-data inventory and processing register for your products and back office.
// DPDP ACT 2023 · DPDP RULES 2025Get ready for the DPDP Act
Get ready for the DPDP Act
before the obligations apply.
The Digital Personal Data Protection Rules were notified in November 2025, and most obligations apply about 18 months later, in May 2027. We help Indian businesses map their personal data, fix notices and consent, set up rights handling and breach response, and keep the evidence that shows it.
DPDP Act 2023DPDP Rules 2025Consent and noticesBreach response
Nov 2025DPDP Rules notified
May 2027Most obligations apply (about 18 months later)
₹250 crMaximum penalty for failing to protect personal data
// WHY THIS NEEDS PREPARATION NOW
A law you demonstrate, not a certificate you buy.
There is no DPDP certificate. Compliance is judged by the Data Protection Board of India when something goes wrong: a complaint, a breach or a failed rights request. What protects you is evidence that you knew what personal data you held, told people why, had a valid basis for processing, kept it secure and responded when asked. Most of that takes months to put in place, which is why the time before May 2027 matters.
// DELIVERY STANDARD
Built for decisions, evidence and accountable execution.
Whether this is a commercial engagement or a government program, the work is structured so technical teams can act and leadership can verify progress.
Gap assessment
Your current practice compared with each obligation in the Act and the Rules, ranked by risk and effort.
Fix what matters first
Notices, consent, rights handling, retention, vendor terms and breach response put in place with your product and legal teams.
Keep the evidence
Owners, reviews and records tracked in the Bitkosh Readiness Platform, so you can show the Board what you did and when.
// PROJECT OUTPUTS
What your team can take into the next review.
- Personal-data inventory and processing register
- DPDP gap assessment against the Act and the Rules
- Updated notices, consent flows and withdrawal mechanism
- Data Principal rights and grievance procedure
- Personal-data-breach response playbook
- Processor contract checklist and retention schedule
// BUILT FOR
Designed around the people who own the outcome.
- Founders and CTOs of Indian apps and SaaS products
- Legal, privacy and compliance teams
- Fintech, health and edtech companies holding sensitive data
- Companies that may be notified as Significant Data Fiduciaries
Personal data mapping
Where personal data enters, which systems and vendors hold it, why you process it and how long you keep it. Every later step depends on this map being right.
Notices and consent
Clear, itemised notices and consent flows in your website, apps and forms, with a record of each consent and an easy way to withdraw it, as the Act and Rules require.
Data Principal rights
A process and the tooling to handle requests for access, correction, erasure and grievance redressal within your published timelines, with a log that shows you did.
Security safeguards
Reasonable security safeguards such as encryption, access control, logging and backups, mapped to the controls you already run. Failure here carries the Act’s highest penalty band.
Breach response
A personal-data-breach playbook covering who decides, how the Board and affected people are told, and what goes in the follow-up report, rehearsed before you need it.
Vendors and children’s data
Contracts with the processors who handle data for you, plus verifiable parental consent where you process children’s data, and the extra duties if you are notified as a Significant Data Fiduciary.
// PRICING
Scoped to you, priced in writing.
Every engagement is scoped to your frameworks, your team and how much help you want — you get a written proposal before anything starts.
DPDP gap assessment
Talk to us
Data mapping plus a written gap report and roadmap. A good first step for a single product.
Full DPDP readiness programme
Talk to us
Mapping, implementation and evidence set-up across your products. Legal opinions, where needed, come from your own counsel.
DPDP work is scoped by how many products, systems and vendors handle personal data. Talk to us and we'll send a written proposal.
Frequently Asked Questions
Is there a DPDP certificate we can get?
No. The DPDP Act has no certification scheme. Compliance is assessed by the Data Protection Board of India, typically after a complaint or a breach, so what you need is working processes and evidence, not a certificate. Be wary of anyone selling a "DPDP certification".
When do the DPDP obligations apply?
The DPDP Rules were notified in November 2025 and apply in phases. The provisions setting up the Data Protection Board applied straight away, consent-manager registration follows about a year later, and most obligations on businesses, including notices, consent, rights, security safeguards and breach notification, apply about 18 months after notification, in May 2027. Check the Rules as notified for the exact dates that apply to you.
Are you a law firm?
No. We are a compliance and security team: we map your data, design the processes and put the controls in place. Where you need a legal opinion, for example on a specific processing basis, your own counsel should give it, and we work alongside them.
We already follow GDPR. How much is left?
A good deal carries over, such as data mapping, security and rights handling, but the DPDP Act differs on lawful bases, consent requirements, children’s data and breach reporting. We map your GDPR controls and close only the DPDP-specific gaps.
What is a Significant Data Fiduciary?
A business the government notifies as significant, based on factors such as the volume and sensitivity of data and the risk to people. It carries extra duties, including a Data Protection Officer based in India, periodic data protection impact assessments and independent audits. We help you prepare if you expect to be notified.
Let's build together
Be ready for May 2027 well before it arrives.
Book a free 30-minute consultation with our engineering team — no obligation, just a clear, practical plan.