Where the law meets the architecture.
Qanalyx advises Indian organisations on privacy, data governance and AI. We read the DPDP Act and the IT Act, and we read your systems, so every recommendation holds up in law and can be built in practice.
Three areas of advice, one view of your data.
Each stands on its own. Together they give an organisation a single account of what it holds, why it holds it and who answers for it.
DPDP Act compliance
Readiness against the Act and Rules, and the notice, consent, rights, breach and processor arrangements that follow.
Governance a board can measure
Ownership, classification, quality and policy for the data estate, including data lakes, tied to the laws and contracts that govern it.
AI you can explain
An inventory of AI use, a risk assessment for each, and the contract and oversight arrangements around them.
Legal advice needs systems knowledge. Technical controls need a legal basis.
We work with both in the same room, so a finding names the provision it rests on and the control that satisfies it.
What the law asks
- Which obligation applies, to whom, and from when
- What counts as valid notice, consent and lawful use
- What a contract with a processor or AI vendor must say
- What evidence a regulator, auditor or court will expect
What the systems must do
- Where personal data sits and how it moves
- How consent, withdrawal and erasure work in each system
- What is logged, who can see it and how long it is kept
- How an AI system is tested, supervised and changed
The Rules are notified. The clock is running.
The DPDP Rules were notified in November 2025 and phase in over up to eighteen months.
- November 2025DPDP Rules notified, with obligations phased in.
- About November 2026Consent manager provisions take effect, about twelve months after notification.
- About May 2027Remaining obligations on data processing take effect, about eighteen months after notification.
Timelines are as reported on notification of the Rules. Confirm dates and applicability for your organisation before acting. This summary is not legal advice.
See what an engagement produces.
Every engagement ends with documents and registers you keep. These are illustrative examples on synthetic data.
Readiness by area legal basis · score out of 100
| Area | Score | |
|---|---|---|
| Notice and consent | 58 | |
| Rights and grievance | 64 | |
| Processor oversight | 45 | |
| Security safeguards | 71 | |
| Breach response | 49 | |
| Children’s data | 38 | |
| Retention and erasure | 52 |
Overall
Priority findings legal basis and effort side by side
| # | Finding | Basis | Priority | |
|---|---|---|---|---|
| 1 | Consent text bundles marketing with service delivery | s.6 | Low | P1 |
| 2 | No documented escalation path for reporting a breach to the Board | s.8(6) | Medium | P1 |
| 3 | Processor contracts lack deletion and sub-processor terms | s.8(2) | Medium | P2 |
| 4 | No verifiable-consent step for users who may be minors | s.9 | High | P2 |
| 5 | Retention schedule exists for 3 of 11 systems | s.8(7) | Medium | P3 |
Classification column level
| Column | Class | Tag |
|---|---|---|
| mobile_number | Restricted | PII |
| vendor_tax_id | Restricted | PII |
| contract_value | Confidential | — |
| account_open_date | Internal | — |
| ward_code | Public | — |
Policy library 6 policies in force
Catalogue 8 of 279 datasets
| Dataset | Layer | Class | Quality |
|---|---|---|---|
| ● Asset register | Gold | Internal | 98 |
| ● Application forms | Silver | Internal | 94 |
| ● Contract ledger | Gold | Confidential | 96 |
| ● Service requests | Silver | Restricted | 89 |
| ◉ Customer master | Gold | Internal | 93 |
| ◉ Billing records | Silver | Internal | 91 |
| ● Event logs | Bronze | Internal | 78 |
| ◉ Document scans | Bronze | Public | 96 |
Lineage Customer view
Register 6 of 17 use cases
| Use case | Personal data | CERT-In tier | Status |
|---|---|---|---|
| Customer support assistant | Yes | Tier 2 | Assessed |
| Résumé screening | Yes | Tier 3 | In review |
| Contract summariser | Yes | Tier 2 | Assessed |
| Demand forecasting | No | Tier 1 | Assessed |
| Credit pre-screening | Yes | Tier 3 | Pending |
| Marketing copy generator | No | Tier 1 | Assessed |
Assessment checklist Résumé screening
| Lawful basis and notice | Done |
| Training and retrieval data provenance | Done |
| Bias and accuracy testing | In progress |
| Human review point defined | Done |
| Vendor terms and data location | In progress |
| Logging and change control | Open |
Register 5 of 24 processors
| Processor | Personal data | Agreement | Location |
|---|---|---|---|
| Cloud hosting provider | Customers, staff | In force | India |
| SMS gateway | Mobile numbers | In force | India |
| Payroll vendor | Staff, bank details | Renewal due | India |
| Survey tool | Contact details | No agreement | Outside India |
| Support desk software | Customers | In force | Outside India |
Study first. Framework second. Technology last.
A documented study comes before any recommendation, so decisions stand up to audit.
Study
Map systems and data flows, review contracts and policies, and build a risk register.
Framework
Policies, standards and decision rights, with draft clauses for contracts.
Specification
Requirements for tools and controls, based on confirmed gaps and neutral between vendors.
Assurance
Periodic reviews, board reporting and support through audits.
DPDPIndia.in: a free knowledge portal on the DPDP Act, cyber crime and public-sector data governance
Qanalyx helps manage DPDPIndia.in, a knowledge-sharing portal that explains the Act in plain language, follows the Rules and publishes a monthly briefing. It is free to read and needs no sign-up.
Know where you stand before you buy anything.
An independent privacy and data gap study shows what you hold, what is exposed and what to do first.