Overview
Conformite Assist helps Indian businesses comply with the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. We map the personal data you hold, assess where you stand against the law, and build the consent, notice, rights, breach response and security practices it requires, so you can show compliance clearly whenever a customer, partner or regulator asks.
The DPDP Act is India's first comprehensive law on how organisations collect and use digital personal data. It applies to any organisation that processes digital personal data in India, and to organisations outside India that offer goods or services to people in India. If you hold customer, employee, vendor or website data about people in India, the Act almost certainly applies to you.
The law rests on a simple principle. You may process personal data only for a lawful purpose, usually with the individual's informed consent, and you stay accountable for protecting it at every stage. Failing to take reasonable security safeguards can attract penalties of up to ₹250 crore per instance, and failing to notify a breach or meet the obligations for children's data can attract up to ₹200 crore.
What our DPDP compliance service covers
- DPDP readiness assessment: a structured gap assessment against the Act and the Rules, with a prioritised plan to close each gap.
- Personal data mapping: an inventory of what personal data you hold, why, where it lives, who can access it and which third parties receive it.
- Privacy notices: clear, itemised, standalone notices that meet the Rules, in English and Eighth Schedule languages where needed.
- Consent design: consent that is free, specific, informed and unambiguous, withdrawal that is as easy as giving consent, and systems ready to work with registered Consent Managers.
- Data principal rights: working processes for access, correction, erasure, nomination and grievance redressal, with a published point of contact.
- Breach response: detection, escalation and notification to the Data Protection Board and affected individuals, with ready templates and tested drills.
- Reasonable security safeguards: access control, encryption, logging and monitoring and the rest, mapped to ISO 27001 where you already have it.
- Retention and deletion: retention schedules, deletion routines and log retention that meet the Rules.
- Processor and vendor contracts: DPDP-aligned clauses and oversight for every third party that processes data on your behalf.
- Children's data: verifiable parental consent and the safeguards the Act requires.
- Significant Data Fiduciary support: Data Protection Officer function, Data Protection Impact Assessments and periodic audit readiness.
- Training and awareness: role-based training for the teams who handle personal data every day.
The Compliance Timeline
- 13 November 2025. The DPDP Rules were notified and the Data Protection Board of India was established in law.
- 13 November 2026. The Consent Manager provisions come into force, including registration of Consent Managers with the Board.
- 13 May 2027. The core obligations for Data Fiduciaries apply in full: notice, consent, security safeguards, breach reporting, retention limits and data principal rights.
Who Needs DPDP Compliance
- Businesses of every size that collect personal data from customers, employees, vendors or website visitors in India.
- SaaS, fintech, health-tech, e-commerce, edtech, HR and staffing companies that process personal data at scale.
- Overseas companies and global capability centres that process personal data of people in India.
- Organisations that handle children's data and need verifiable parental consent.
- Large data processors that may be designated Significant Data Fiduciaries by the Central Government.
Where to Start: a DPDP Readiness Assessment
The May 2027 date looks distant until you map the work behind it. Redesigning consent flows, building a processing register, integrating with Consent Managers and standing up a breach process is months of cross-functional effort involving legal, IT, product, HR and marketing. We track every clarification and notification so your programme stays aligned as the regime matures.
Almost every engagement begins the same way, with a structured assessment that measures your current practices against the Act and the Rules. It produces a gap register, a view of your likely classification, and a prioritised plan with owners and effort estimates.
This matters because the Act is broad and cross-functional, and the most common mistake is to buy a tool or draft a policy before understanding which obligations actually apply. The right order is the reverse. Understand your position, then build to it.
How We Work
- Discover. We understand your business, your data, your systems and whether you are likely to be treated as a Significant Data Fiduciary.
- Assess. We run a DPDP readiness assessment and give you a clear gap report, ranked by risk and effort.
- Build. We work with your legal, IT, product, HR and marketing teams to put notices, consent, rights, breach, security, retention and vendor controls in place.
- Evidence. We help you create the records that prove compliance, including consent records, registers, policies and logs.
- Sustain. We review your programme periodically, track regulatory updates and stay on hand as your business and the law evolve.
What You Receive
- DPDP gap assessment report and remediation roadmap.
- Personal data inventory and data flow maps.
- Privacy notice and consent templates.
- Data principal rights and grievance redressal procedure.
- Personal data breach response plan and notification templates.
- Retention schedule and deletion procedure.
- DPDP clauses for processor and vendor contracts.
- DPIA methodology and templates, where you are or may become a Significant Data Fiduciary.
- An evidence pack organised for regulator and customer enquiries.
DPDP, ISO 27701 and ISO 27001 in One Programme
Many of the security safeguards the DPDP Act expects already exist in an ISO 27001 information security management system, and ISO 27701 extends that system into privacy management. We map each DPDP obligation to the controls you already run, so you build once and meet several requirements together. If you also handle personal data from the EU, our Privacy consulting covers GDPR alongside DPDP in the same programme.
The same logic applies in reverse. If you are a regulated financial entity working through SEBI or RBI cyber requirements, a large share of the security groundwork serves DPDP as well. Run one programme, not three.
Why Conformite Assist
- Independent since 2011. Privately owned and independent of technology vendors, so our advice fits your business, not a product.
- 25+ years of compliance expertise. Practical judgement on what regulators, auditors and customers actually look for.
- Practical, not paper. Controls and processes your teams can run every day, not documents that sit on a shelf.
- Integrated. DPDP mapped with ISO 27001, ISO 27701, GDPR and SOC 2, so one programme serves many obligations.
- Global perspective. 200+ clients served across 13 regions and four continents.
Key benefits
- A clear view of which DPDP obligations actually apply to you.
- Notices, consent and rights processes that meet the Rules.
- A breach response tested before you need it.
- Evidence you can show a customer, partner or regulator on request.
- One programme that serves DPDP, ISO 27001 and ISO 27701 together.
Frequently asked questions
Who needs to comply with the DPDP Act?
Any organisation that processes digital personal data in India, and organisations outside India that offer goods or services to people in India. Most businesses holding customer, employee or user data about people in India are Data Fiduciaries under the Act.
When do DPDP obligations apply?
The Rules were notified on 13 November 2025. Consent Manager provisions come into force on 13 November 2026, and the core obligations for Data Fiduciaries apply from 13 May 2027.
What are the penalties under the DPDP Act?
Up to ₹250 crore per instance for failing to take reasonable security safeguards, and up to ₹200 crore for failing to notify a personal data breach or meet the obligations for children's data. Penalties are decided by the Data Protection Board of India.
Do we need a Data Protection Officer?
Only if the government designates you a Significant Data Fiduciary. Every other Data Fiduciary must publish a contact point for data queries and run a grievance redressal process.
What is a Consent Manager, and do we need to work with one?
A Consent Manager is an entity registered with the Data Protection Board that gives individuals a single platform to give, review and withdraw consent across businesses. Where you rely on consent, your systems should be technically ready to receive consent signals and act on withdrawals.
How long does DPDP readiness take?
For most mid-sized organisations, three to four months of focused work covers the core programme. Larger groups with many systems, entities or processors usually need longer, which is why starting with a readiness assessment matters.
Is DPDP the same as GDPR?
They share ideas such as consent, rights and breach notification, but DPDP is an Indian law with its own rules on notices, Consent Managers, the Data Protection Board and Significant Data Fiduciaries. GDPR documents need adapting, not copying.
Can ISO 27001 or ISO 27701 help with DPDP compliance?
Yes. An ISO 27001 system already covers much of the security the Act expects, and ISO 27701 adds privacy management on top. Mapping DPDP to these standards avoids duplicated effort.