- Home
- Compliance
- DPDP Act 2023
Regulatory compliance
DPDP Act 2023 compliance consulting
India's Digital Personal Data Protection Act, 2023 and the DPDP Rules create clear obligations for every organisation processing digital personal data. We help you understand what applies, build the programme and keep evidence ready.
Why teams choose Adiroha
- Led by CISA and ISO 27001 lead auditors
- Clear scope, roadmap and timeline before we start
- Evidence organised in the Cydital platform
- Support through the external audit and beyond
Scope
What we cover
- Personal data discovery and mapping
- Gap assessment against the DPDP Act and Rules
- Consent and notice design
- Data principal rights handling (access, correction, erasure, grievance)
- Children's data and verifiable parental consent
- Breach notification to the Data Protection Board and affected individuals
- Processor contracts and vendor controls
- Significant Data Fiduciary obligations: DPO, DPIA and audits
Deliverables
What you receive
- DPDP gap report and implementation roadmap
- Data inventory and processing records
- Notices, consent flows and policies
- Programme managed in Cydital
How we work
Discover. Assess. Remediate. Validate.
Discover
Understand your business, scope, stakeholders and the obligations that actually apply to you.
Assess
Gap assessment against the framework or regulation, turned into a prioritised, costed roadmap.
Remediate
Implement policies, controls and evidence with your teams, tracked in Cydital.
Validate
Internal audit before the external one, audit-day support, and continuous compliance after.
FAQ
Common questions
Does the DPDP Act apply to my company?
It applies to processing of digital personal data within India, and to processing outside India connected with offering goods or services to people in India.
How is DPDP different from GDPR?
DPDP relies mainly on consent and certain legitimate uses, with a simpler structure than GDPR. There's significant overlap, so one programme can serve both.
Do we need a Data Protection Officer?
Significant Data Fiduciaries must appoint a DPO based in India. Other organisations must still publish contact details for data-related queries.
When do DPDP obligations take effect?
The DPDP Rules were notified in phases, with most data fiduciary obligations taking effect over the following months. We'll confirm the current timelines for your organisation.
What are the penalties under the DPDP Act?
The Act sets penalties up to ₹250 crore per instance, depending on the breach, such as failing to take reasonable security safeguards.
How long does DPDP readiness take?
Typically 3–6 months for a mid-sized organisation, depending on how much personal data you process and how many systems hold it.
Do we need to change our consent forms?
Usually yes. DPDP consent must be free, specific, informed and unambiguous, with a clear notice and an easy way to withdraw.
Related
Related services
CICRA
Compliance and information security assessment under the Credit Information Companies (Regulation) Act, 2005.
Learn moreISO 27001 Compliance
ISO 27001:2022 implementation — from gap assessment and ISMS design to internal audit and certification, led by certified lead auditors.
Learn moreSOC 2 Compliance
SOC 2 readiness for Type I and Type II reports — scoping, control design, evidence and auditor coordination.
Learn moreTalk to a specialist about DPDP Act 2023.
A free 30-minute consultation to understand your scope and timeline. We follow up with a fixed proposal.