The Digital Personal Data Protection Act, 2023 governs the processing of digital personal data in India and of data processed outside India in connection with offering goods or services to individuals in India. The DPDP Rules, 2025 set out how obligations work in practice and phase them in over eighteen months.
With the main obligations applying from May 2027, the time to act is now: we run DPDP readiness assessments, map personal data, redesign notices and consent journeys, prepare breach response procedures and align your programme with ISO/IEC 27701 so it can be independently certified.
Who it is for
- Companies processing personal data of individuals in India
- Global companies offering goods or services to people in India
- Consent managers and significant data fiduciaries
What you gain
- Ready before obligations take effect
- Consent and notice processes that fit your products
- One programme aligned with GDPR and ISO 27701
How we get you compliant
Applicability and scoping
Confirm whether and how the law applies to you, entities, data, systems, roles and territories.
Data and process mapping
Build a record of processing or control inventory so obligations can be tied to real systems and owners.
Gap assessment
Measure current practice against each obligation and rank the gaps by legal and business risk.
Remediation roadmap
Policies, notices, contracts, technical controls and governance, sequenced so the highest risks close first.
Evidence and ongoing monitoring
A compliance calendar, metrics and periodic reviews so you can demonstrate compliance to a regulator or customer at any time.