Privacy advice that survives a legal review and an architecture review.
We read the DPDP Act and Rules the way a lawyer does and walk through your systems the way an engineer does, then report where the two do not yet line up.
Every finding names the provision and the control.
Section references are shown so counsel can check the basis, and the control is described so engineers can build it.
What the Act and Rules ask
- Notice and consent that is specific, informed and as easy to withdraw as to give (ss.5–6)
- Legitimate uses without consent, and the limits on them (s.7)
- Fiduciary duties on accuracy, safeguards, breach intimation and erasure (s.8)
- Children’s data and verifiable parental consent (s.9)
- Rights of data principals and grievance redress (ss.11–14)
- Significant Data Fiduciaries, impact assessments and audits (s.10)
What the systems must do
- A personal data inventory and data-flow map for every system and processor
- Consent capture, storage and withdrawal that actually reaches downstream systems
- A rights-request workflow with owners, clocks and evidence
- Retention and erasure that includes backups and processors
- Safeguards proportionate to risk: access control, encryption, logging
- Breach detection and a rehearsed escalation path
A readiness assessment with the basis shown.
Scored against the Act and Rules, with findings ranked by risk and effort so management can sequence the work.
- Interviews, documents and walk-throughs. Findings rest on evidence, not on a questionnaire alone.
- Provision and effort side by side. A finding shows the section it rests on and what it costs to fix.
- A board note. One page for directors, in plain language.
Readiness by area legal basis · score out of 100
| Area | Score | |
|---|---|---|
| Notice and consent | 58 | |
| Rights and grievance | 64 | |
| Processor oversight | 45 | |
| Security safeguards | 71 | |
| Breach response | 49 | |
| Children’s data | 38 | |
| Retention and erasure | 52 |
Overall
Priority findings legal basis and effort side by side
| # | Finding | Basis | Priority | |
|---|---|---|---|---|
| 1 | Consent text bundles marketing with service delivery | s.6 | Low | P1 |
| 2 | No documented escalation path for reporting a breach to the Board | s.8(6) | Medium | P1 |
| 3 | Processor contracts lack deletion and sub-processor terms | s.8(2) | Medium | P2 |
| 4 | No verifiable-consent step for users who may be minors | s.9 | High | P2 |
| 5 | Retention schedule exists for 3 of 11 systems | s.8(7) | Medium | P3 |
A processor register that matches the contracts.
Where personal data leaves your control, the contract, the data and the law need to say the same thing.
- Agreements checked clause by clause. Purpose, security, sub-processors, deletion and audit rights.
- Transfers recorded with their basis. Including data held outside India.
- Review dates owned by a named person. So oversight does not lapse after the first review.
Register 5 of 24 processors
| Processor | Personal data | Agreement | Location |
|---|---|---|---|
| Cloud hosting provider | Customers, staff | In force | India |
| SMS gateway | Mobile numbers | In force | India |
| Payroll vendor | Staff, bank details | Renewal due | India |
| Survey tool | Contact details | No agreement | Outside India |
| Support desk software | Customers | In force | Outside India |
What we do in this area.
Scoped to the organisation, from a short study to a continuing retainer.
Assess
DPDP gap assessment, data inventory and records of processing, and a risk register with a prioritised plan.
Design
Notice and consent framework, rights and grievance procedures, retention schedules, breach response plan and processor contract clauses.
Assure
Impact assessments, breach drills, periodic reviews and board reporting, and support through an audit or a regulator’s query.
Start with a gap study.
It shows what you hold, what is exposed and what to do first, before any tool is bought.