DPDP Act 2023 · India
Consent, inventory, and rights. A ledger the Board can read.
Personal data stays in your network. Every grant, withdrawal, and erasure writes a receipt the Board can ask for.
Control plane
LiveReceipt
cr-8f2c48a
Sealed
15 Oct 2026, 21:04 IST
Duties covered
Notice · Consent · Rights · Safeguards
Written against the DPDP Act, 2023.
Deployment
SaaS and self-hosted
Records stay in your network.
Connector types
35
From PostgreSQL, Snowflake, and S3 through Salesforce and Kafka.
Next milestone
Full enforcement, penalties applicable
DPDP Act 2023, Section 33, read with DPDP Rules 2025
6 months (190 days) to Full enforcement, penalties applicable.
DPDP Act 2023, Section 33, read with DPDP Rules 2025
Where programmes stall
Four questions a policy pack cannot answer.
Consent lives in a banner. Processing lives in six other systems.
A grant is not proof unless the same purpose reaches CRM, warehouse, and vendors. Withdrawal has to follow it.
You cannot list every store that holds a Data Principal.
Erasure without an inventory is a guess. Discovery starts from the catalogs you already run, not a spreadsheet of system names.
A processor still has last week’s consent.
Vendor oversight is not a register on a slide. A change in consent or a rights ticket has to reach the parties who still hold the data.
The public site says one thing. The tags load another.
A scan that never opens the page will miss tags that fire before a choice. Pitstop and TrustScope run against the live property.
Platform
One control plane. Six jobs.
Locate the stores you already run, classify the personal data, and mark what a rights request can look up. Records stay in your network.
- Start from the catalogs those systems already expose
- Name contact, financial, and children’s data
- Exact lookups for rights, not a guessed search
- Further connectors can be added
- Inventory of fields, not a copy of the rows
Discovery
Inside your network
- 01SourceLive
Customer database
Starts fromSystem catalogRow values leave?No - 02LocateCleared
Find stores and fields
OutputWhere personal data sits - 03ClassifyCleared
Name the personal data
OutputContact, financial, child - 04ConfirmIn review
Ready for rights lookups
LookupExact match, not a guess - 05InventorySealed
customers.email
ClassContact identifierRights lookupIndexed
How it works
Discover, map, consent, fulfil, then prove.
Each stage writes to the same ledger. A rights ticket cannot close on stores the inventory never edged.
- 01
Discover
Inventory
- 02
Map
Lineage
- 03
Consent
Notice and grant
- 04
Rights
Access and erasure
- 05
Evidence
Ledger
Connectors
35 connector types today. More can be added.
Live types on the moving rail. Further stores use the same inventory when you add them.
PostgreSQL
MySQL
Oracle
SQL Server
Snowflake
BigQuery
AWS Glue
Unity Catalog- Amazon DataZone
MongoDB
DynamoDB
Azure Cosmos DB
Elasticsearch
Redis
Amazon S3
Apache Kafka
Salesforce- ServiceNow
- Workday
SharePoint
SAP
Zendesk- AWS
- Azure
GCP
Kubernetes
CloudWatch Logs- CloudTrail
- Azure Log Analytics
- Azure Activity Log
- GCP Cloud Logging
- GCP Audit Logs
- AWS Backup
- Azure Recovery Services
- GCP Backup
Further systems
Not claimed as live until they are connected on an estate.
MariaDB
IBM Db2
Azure SQL- Amazon Redshift
- Azure Synapse
- Teradata
- ClickHouse
- Apache Hive
- Databricks
- Amazon Athena
- Google Cloud SQL
- Trino
- Apache Iceberg catalogs
Cassandra- Couchbase
Neo4j
Firebase- Supabase
- Azure Blob Storage
- Google Cloud Storage
- MinIO
- Box
Google Drive
OneDrive- Amazon Kinesis
- Azure Event Hubs
- Google Pub/Sub
- Apache Pulsar
HubSpot
Shopify- Intercom
- Freshdesk
Jira
Confluence
Slack- Microsoft Dynamics
- Oracle Fusion
Services
Software plus people who have read the Act.
Advisory
Applicability against Sections 5–16, SDF readiness, and a sequenced remediation plan.
Privacy operations
Consent, DSAR, breach notification, and processor contracts running as daily work.
AI governance
Purpose, notice, and rights controls on models that process personal data of Indian residents.
Technical implementation
Embed on the site, connect the stores you already run, and keep records in your network.
What is DPDP? Common questions
DPDP is the Digital Personal Data Protection Act 2023, India's comprehensive data protection law. DPDP Consultancy (dpdpconsultancy.in) helps Data Fiduciaries comply when processing personal data of Indian Data Principals, with penalties up to ₹250 Crore per violation.
DPDP stands for Digital Personal Data Protection. The full name of the law is the Digital Personal Data Protection Act, 2023 (also called DPDPA). The implementing rules were notified in November 2025.
The DPDP Act applies to any organisation that processes digital personal data of individuals in India, including Indian companies, foreign companies offering goods or services to people in India, employers, SaaS platforms, hospitals, banks, and marketplaces. Certain research, legal, and state functions have limited exemptions, but most businesses are in scope.
The DPDP Act 2023 prescribes penalties up to ₹250 Crore for failing to implement reasonable security safeguards, ₹200 Crore for consent and notice violations, ₹150 Crore for children's data violations, and ₹50 Crore for Data Principal obligation breaches. Significant Data Fiduciaries face additional obligations including a DPO, DPIAs, and annual audits.
The Digital Personal Data Protection Act received Presidential assent in August 2023. The DPDP Rules were notified in November 2025, with phased enforcement. The next milestone on this site's timeline is Full enforcement, penalties applicable (1 May 2027; DPDP Act 2023, Section 33, read with DPDP Rules 2025). Full enforcement in the timeline is Full enforcement, penalties applicable on 1 May 2027. Organisations should implement consent, notice, rights, and security controls now. Remediation typically takes months.
DPDP is India-specific: it uses Data Fiduciary and Data Principal terminology, emphasises consent and notice, and is enforced by the Data Protection Board of India. Unlike GDPR, DPDP does not use the same lawful bases (legitimate interest is not a general basis), has different children's data rules, and sets Indian-rupee penalty caps. GDPR-aligned programmes still need DPDP-specific consent, notice, and rights controls.
A typical DPDP compliance journey is: (1) assess applicability and gaps, (2) design consent, notice, and rights workflows, (3) implement technical controls such as a consent platform and DSAR automation, and (4) operate continuous monitoring. DPDP Consultancy provides a free website privacy scan, a 10-question readiness assessment, advisory services, and a compliance intelligence platform for Indian enterprises.