Overview
The DPDP Act 2023 sets new duties for every Indian business that handles personal data, yet few product teams know exactly where theirs lives. We track it down across your database, analytics, support desk, marketing tools and the spreadsheets sitting on staff laptops. Then we compare your consent flows, retention habits and vendor agreements with what the Act expects. Treat it as an engineering and process exercise, not legal counsel; anything your lawyer should see is clearly flagged. You finish with a prioritised plan your team can act on.
What you receive
- A register of personal data held across your systems, vendors and storage
- Diagrams showing how data is collected, used, shared and deleted
- Each duty under the Act checked, with gaps rated by severity
- Consent screens and notices reviewed, with improved text provided
- Suggested retention periods for every type of personal data
- A workflow for handling access, correction and deletion requests
- A breach reporting procedure and a fix plan with effort estimates
How it runs
-
Step - 01
Discovery
We interview system owners and find personal data, including forgotten copies.
-
Step - 02
Flow mapping
Each data journey is diagrammed from the moment of collection to deletion.
-
Step - 03
Assessment
Your current practice is checked against each relevant section of the Act.
-
Step - 04
Roadmap
Gaps are ranked and given owners, effort estimates and a sensible order.
Timeline: 15 working days, counted from the day we receive what we need from you.
Is it a fit?
A good match for
- Any Indian business storing customer personal data, large or small
- Products expanding the information they gather from Indian users
- Companies whose privacy policy was borrowed from elsewhere years ago
What we need from you
- Brief calls with the owner of each system that holds data
- Copies of your consent screens, supplier list and existing privacy policy
- A senior sponsor who will take charge of fixes afterwards
Why it helps
- Clear visibility of where personal data really lives
- Consent and data-keeping habits you can confidently defend
- A prioritised action plan instead of a vague worry
Questions
No. This is a technical and operational readiness exercise. We work with your lawyers where needed and clearly mark any question that calls for their judgement.
The data register and flow diagrams are useful for both laws. A complete GDPR assessment is extra scope, and we can quote it separately on request.
Yes. Duties grow with the volume and sensitivity of data you hold, but they apply from the very first person whose data you process.