DPDPA Readiness Tool
DPDPA Autopilot: The Six-Phase DPDP Act Readiness Programme, Running as Software
DPDPA Autopilot is the working implementation of SecureRoot's DPDPA Implementation and Readiness Guide: six phases, forty-nine activities, six operational workflows and the 68-row control and requirement mapping sheet, dated from your start date and tracked to a go or no-go gate before full enforcement on 13 May 2027. Every activity that can be automated has a module that does it, and every control is evidenced.
At a Glance
- Programme
- 6 phases, 49 activities, 6 workflows, 68 mapped requirements
- Deployment
- Multi-tenant SaaS, or client-hosted; one SQLite file per deployment
- Consent
- Read from Consent Hub, not rebuilt; mock mode never produces evidence
- Law stated as at
- 19 October 2026; full enforcement 13 May 2027
DPDP Act readiness, phase by phase, with evidence.
In One Paragraph
In One Paragraph
DPDPA Autopilot is SecureRoot's readiness suite for the DPDP Act, 2023 and the DPDP Rules, 2025. It turns the six-phase implementation programme into a dated plan with 49 activities, builds the Record of Processing Activities and data-flow diagrams from discovery, generates the notices, policies and DPAs, runs the rights, breach, retention and children's-data workflows with every regulator clock, and scores readiness against a 68-row requirement mapping. It is a readiness aid, not legal advice.
The Problem
The Act gives you a deadline. It does not give you a plan, a tracker or a clock.
Full enforcement of the DPDP Act arrives on 13 May 2027. Between now and then an organisation has to work out its role under the Act, find where personal data lives, build a Record of Processing Activities, rewrite its notices, design consent, sign DPAs, stand up rights and breach workflows, test all of it and keep evidence of every step. A guide tells you the order. It does not date the activities, assign the owners or hold the evidence.
The breach workflow alone has five clocks running from one incident: CERT-In in six hours, the Data Protection Board and every affected Data Principal without delay, the detailed Board report in 72 hours, the sector regulator on its own timetable, and whatever the contract says. A spreadsheet does not start those clocks.
DPDPA Autopilot takes SecureRoot's published guide and runs it: the phases are dated from your start date, each activity names the module that performs it and the requirements it serves, and the evidence repository fills as the work is done.
Capabilities
What DPDPA Autopilot Does, Phase by Phase
One capability per phase of the guide, plus the cross-phase capabilities added in release 2. Each is a built module with its own tests, recorded in the product's QA report.
01
Phase 0: Mobilise and govern
A timeline engine dates the compressed 26-week or full path from your start date. A role wizard settles Fiduciary, Processor, Significant Data Fiduciary likelihood, Third Schedule and children exposure. Roles, RACI, budget, operating rhythm, board brief and charter are generated.
02
Phase 1: Discover and assess
Discovery connectors for PostgreSQL, MySQL, SQLite, file shares, CSV and XLSX, REST APIs and IMAP mailboxes, plus an OCR scanner for images, PDFs and Office files, detect Indian identifiers with confidence scores and store only counts, locators and masked samples. Findings become RoPA entries, data-flow diagrams, a transfer register, a vendor inventory, a gap assessment and a four-wave roadmap.
03
Phase 2: Design
Policy suite, a Rule 3 notice studio with a rule-based notice checker, a consent architecture matrix with no pre-ticked boxes and an enforced withdrawal path, the Consent Manager decision, a Rule 6 safeguards map to ISO 27001 and 27701, a retention schedule suggested from the RoPA, and DPA and vendor questionnaire templates.
04
Phase 3: Implement
Rights requests with the internal 30-day and published 90-day clocks and generated response letters; breach response with every regulator clock and pre-filled notifications; retention jobs with legal hold and the 48-hour Third Schedule notice; a children's data gate; training and DPA trackers.
05
Phase 4: Validate
A control test plan per requirement with automated checks, DPIAs suggested from the RoPA, timed breach drills with drill reports, a readiness scorecard and go or no-go pack, audit findings and an evidence repository index.
06
Phase 5: Operate
The seven operating metrics, a regulatory watch with a monthly check, the quarterly privacy report, a Significant Data Fiduciary obligations tracker and the annual re-assessment.
07
Breach response centre
A severity engine, the seven-step runbook with due times from the clocks, Data Principal notification campaigns with hashed contacts and approved templates, regulator submissions with references and acknowledgements, an evidence locker with one-year retention, post-incident reviews and a submission pack export.
08
Multi-tenant, by invitation
Tenants with owner, admin, consultant, member and viewer roles; session sign-in with lockout, invites, tenant API keys, CSRF and security headers; every organisation belongs to a tenant and every request is scoped by the server-side session. SecureRoot operates all tenants from an ops console.
How It Works
How a Programme Runs
A SecureRoot consultant opens the programme with you. From there the tool holds the plan and the evidence, and the consulting holds the judgement.
01
Set the start date and the role
The timeline engine dates all six phases and the gate from your start date, on the compressed or the full path. The role wizard records what you are under the Act and why.
02
Discover and map
Connectors and the OCR scanner find personal data in your systems and files. The RoPA, the data-flow diagrams, the vendor inventory and the gap scorecard are built from what they find.
03
Design, then implement
Notices, policies, consent architecture, retention schedule and DPAs are generated and approved as versioned documents. The rights, breach, retention and children's workflows go live with their clocks.
04
Validate and operate
Control tests, DPIAs and breach drills produce the go or no-go pack. After the gate, the operating metrics, regulatory watch and annual re-assessment keep the programme current.
Workflow
Breach Response, With Every Regulator Clock
The workflow from the guide's section 6.3 as the breach response centre runs it. One intake starts every clock; each step carries the clock that governs it and the record it leaves.
- 01
Detect and contain
Isolate the affected systems, preserve logs for a year under Rule 6 and 180 days under CERT-In, and open the incident record. The severity engine rates it.
- Owner:
- Security lead
- Record:
- Incident record
- 02
Triage
Within one to two hours: data categories, number and category of Principals, minors, cross-border and processor involvement, and the sectors and contracts triggered.
- Owner:
- Privacy lead
- Record:
- Triage note and clock board
- 03
File with CERT-In
The CERT-In report goes within six hours of noticing the incident, in the CERT-In format, with any sector-regulator report on its own clock.
- Owner:
- CISO; clock: 6 hours
- Record:
- Submission reference
- 04
Notify without delay
The initial intimation to the Data Protection Board and the plain-language notice to each affected Data Principal go from pre-approved templates, contacts hashed, sends batched.
- Owner:
- Privacy lead; clock: without delay
- Record:
- Campaign log and Board acknowledgement
- 05
Investigate and report
Root cause, responsibility and remediation are recorded with the 72-hour clock visible. The detailed Board report is filed, or an extension requested in writing before the clock expires.
- Owner:
- Privacy lead; clock: 72 hours
- Record:
- Detailed report and acknowledgement
- 06
Close and review
The post-incident review writes risks and evidence back to the register and the mapping sheet, leadership is briefed, and the submission pack is exported.
- Owner:
- Privacy lead
- Record:
- Post-incident review and submission pack
Screenshots
DPDPA Autopilot, as It Looks
The programme dashboard: readiness, activities, open risks and the penalty exposure upper bound, with all six phases dated from the start date. Demo tenant, fictional client. 
One incident intake, five regulator clocks. Each shows the deadline, the time left and the notification it pre-fills. 
The RoPA builder: activities classified by lawful ground, with CSV import and export and the retention schedule suggested from it. 
The data-flow diagram generated from the register, with cross-border hops and processors without a signed DPA highlighted. 
The seven-step breach runbook, each step due by the clock that governs it. 
The Phase 4 readiness scorecard and go or no-go pack the Board, an auditor or a customer will ask to see.
Inside the Product
Inside the Product
Privacy Operations You Can Assign and Close
The working view of a DPDP Act programme: what consent you hold, which rights requests are running down their clocks, and how far the readiness assessment has actually got.
A flat product screenshot of DPDPA Autopilot, a privacy operations platform for the DPDP Act 2023 and the DPDP Rules 2025. Headline: weighted privacy posture score 68 of 100, up 6 points this quarter, computed across 14 of 16 assessment domains; 2 domains are not yet measurable, so the product excludes them and renormalises the weights rather than scoring them zero. Readiness assessment: 87 of 97 measurable questions answered, from 110 questions in total; the 2 excluded domains hold the remaining 13. Domain progress: Notice & Consent 82 percent, Data Principal Rights 74 percent, Security Safeguards 68 percent, Retention & Legal Holds 61 percent, Breach Response 55 percent, Processor Oversight 47 percent. Data Principal rights requests, served through a public portal with statutory response clocks: 14 open, 1 overdue, 41 closed this quarter. The five visible rows: DPR-0468, erasure, overdue 2 days; DPR-0482, access, 3 days left; DPR-0479, access, 11 days left; DPR-0485, correction, 19 days left; DPR-0486, nomination, 27 days left. Consent and discovery: 96,412 active consent records, 1,845 withdrawals in the last 90 days, 12,480 PAN and 3,214 Aadhaar-pattern identifiers found by checksum-validated discovery across 23 of 31 connected systems. DPIA: 6 in progress, 14 complete, 4 processor questionnaires open. Incident reporting: 2 open, 1 under reportability review with the decision pending. Audit trail: 48,112 hash-chained events, verified daily with no gaps found. Illustrative snapshot of a typical programme, not a named client.
A flat product screenshot of DPDPA Autopilot, a privacy operations platform for the DPDP Act 2023 and the DPDP Rules 2025. Headline: weighted privacy posture score 68 of 100, up 6 points this quarter, computed across 14 of 16 assessment domains; 2 domains are not yet measurable, so the product excludes them and renormalises the weights rather than scoring them zero. Readiness assessment: 87 of 97 measurable questions answered, from 110 questions in total; the 2 excluded domains hold the remaining 13. Domain progress: Notice & Consent 82 percent, Data Principal Rights 74 percent, Security Safeguards 68 percent, Retention & Legal Holds 61 percent, Breach Response 55 percent, Processor Oversight 47 percent. Data Principal rights requests, served through a public portal with statutory response clocks: 14 open, 1 overdue, 41 closed this quarter. The five visible rows: DPR-0468, erasure, overdue 2 days; DPR-0482, access, 3 days left; DPR-0479, access, 11 days left; DPR-0485, correction, 19 days left; DPR-0486, nomination, 27 days left. Consent and discovery: 96,412 active consent records, 1,845 withdrawals in the last 90 days, 12,480 PAN and 3,214 Aadhaar-pattern identifiers found by checksum-validated discovery across 23 of 31 connected systems. DPIA: 6 in progress, 14 complete, 4 processor questionnaires open. Incident reporting: 2 open, 1 under reportability review with the decision pending. Audit trail: 48,112 hash-chained events, verified daily with no gaps found. Illustrative snapshot of a typical programme, not a named client.
Every figure on these product boards is illustrative sample data from one example programme. No screenshot here shows a named client.
Who It Is For
Who DPDPA Autopilot Is For
Organisations that have to be demonstrably ready by May 2027 and want the programme, not just the gap list.
Healthcare and healthtech
Hospitals, labs and health apps, where clinical data, insurer sharing, children's accounts and the ABDM overlay all carry their own rules. The sector playbook is built in.
Fintech, NBFCs and banks
RBI and SEBI clocks alongside Rule 7, KYC retention periods, and lending-app consent and breach workflows from the sector playbook.
IT, ITES and SaaS
Organisations that are Processors for some data and Fiduciaries for the rest, with DPA flow-down, cross-border transfers and client breach SLAs shorter than their own clocks.
Likely Significant Data Fiduciaries
Large consumer businesses expecting the heavier duties: the SDF obligations tracker, DPIAs and the annual audit are first-class objects.
Regulatory Mapping
What the Law Asks, and What the Tool Tracks
The requirement library is the guide's 68-row control and requirement mapping sheet: 45 baseline rows and 23 sector rows. Each row names the duty and the module that evidences it.
DPDP Act, 2023, sections 4 to 7, and DPDP Rules, 2025, Rule 3
- What it requires
- A lawful ground for every processing activity, and a standalone notice before or with the consent request, itemising the data, the purposes, withdrawal, rights and the route to the Board.
- What DPDPA Autopilot does
- The RoPA builder classifies the lawful ground per activity; the Rule 3 notice studio generates the notice and a rule-based checker tests it. Consent itself is captured in Consent Hub and read back as evidence.
DPDP Act, 2023, section 8, and DPDP Rules, 2025, Rules 6 and 7
- What it requires
- Reasonable security safeguards, one-year log retention, breach intimation to the Board and affected Principals without delay and a detailed report within 72 hours, and erasure once the purpose is served.
- What DPDPA Autopilot does
- The Rule 6 safeguards map, the breach response centre with every clock started from one intake and pre-filled notifications, and retention jobs with legal hold and the 48-hour Third Schedule notice.
DPDP Act, 2023, section 9
- What it requires
- Verifiable consent of a parent or lawful guardian for a child's data, and no tracking, behavioural monitoring or targeted advertising directed at children.
- What DPDPA Autopilot does
- The children's data gate: age capture, guardian identification, verification through a token rather than a document, guardian consent, restrictions switched off for child accounts, and the transition at 18.
DPDP Act, 2023, section 10
- What it requires
- For a Significant Data Fiduciary: a Data Protection Officer in India, an independent data auditor, and periodic impact assessments and audits.
- What DPDPA Autopilot does
- The role wizard scores SDF likelihood; the SDF obligations tracker, DPIAs suggested from the RoPA and the annual re-assessment carry the duties when they apply.
DPDP Act, 2023, sections 11 to 14, and DPDP Rules, 2025, Rule 14
- What it requires
- Access, correction, erasure, nomination and grievance rights, answered within the published period and never beyond the limit the Rules set.
- What DPDPA Autopilot does
- The rights request workflow: intake, verify, route, fulfil, respond and escalate, with the internal 30-day and published 90-day clocks and generated response letters.
CERT-In Directions, 2022, and sector regulators
- What it requires
- Incident reporting to CERT-In within six hours, and to RBI, SEBI, IRDAI, NHA or ABDM on their own timetables where they apply.
- What DPDPA Autopilot does
- Every clock is started from one incident intake and shown on the clock board, with the sector overlay chosen when the programme is set up.
Law is stated as at 19 October 2026. Requirements that commence later are shown as upcoming, not as current failures. The tool is a readiness aid and not legal advice.
Plainly Stated
What DPDPA Autopilot Is Not
It is not legal advice. It implements SecureRoot's published guide and states the law as at 19 October 2026; a qualified reviewer is still the one who signs off a notice, a DPA or a breach notification.
It does not capture consent. Notices, consent records and the consent ledger live in Consent Hub. Autopilot reads Consent Hub for consent evidence and metrics, and when no Consent Hub instance is reachable it runs in a mock mode that is never allowed to produce evidence.
It is operated with a SecureRoot consultant on the programme. Tenants, roles and sign-in exist so your team works in it too, but the programme is opened and gated with us, not bought as a self-serve subscription.
Pricing
Pricing
DPDPA Autopilot is priced with the readiness programme it runs: the number of legal entities, the sectors in scope, the compressed or full path, and whether it is hosted by SecureRoot or in your environment. We put the scope and the price in writing after a scoping call rather than publish a figure that would be wrong for most of the organisations reading this.
Is DPDPA Autopilot the same product as DPDP Compass?
Yes. DPDP Compass was the earlier name of SecureRoot's DPDP Act readiness platform. It is now DPDPA Autopilot, rebuilt in October 2026 around the six-phase DPDPA Implementation and Readiness Guide. Links to the old product anchor still land on this page.
What are the six phases?
Phase 0 mobilises and governs the programme, Phase 1 discovers data and assesses gaps, Phase 2 designs notices, consent, policies and contracts, Phase 3 implements the workflows, Phase 4 validates with control tests and drills, and Phase 5 operates and improves. The tool dates all six from your start date on either the compressed 26-week path or the full path, and gates before enforcement.
Does it handle consent banners and the consent ledger?
No, by design. Consent capture, notices and the consent ledger are Consent Hub's job. Autopilot reads Consent Hub for consent evidence, deployment status and metrics. When no Consent Hub instance is connected it runs in a mock mode that shows the shape of the data and is blocked from producing evidence.
How does the breach response centre work?
One incident intake starts every clock at once: CERT-In at six hours, the Board and affected Data Principals without delay, the detailed Board report at 72 hours, the sector regulator on its own timetable, and the contractual SLA. The seven-step runbook carries due times from those clocks, notifications are pre-filled from approved templates, regulator submissions record references and acknowledgements, and the evidence locker keeps everything for a year.
What does the data discovery actually store?
Counts, locators and masked samples only. Connectors read metadata first and sample second, the OCR scanner reads images, PDFs and Office files locally, and detections of Aadhaar, PAN, mobile numbers, ABHA, cards and the rest are scored for confidence. Raw values, file bytes and extracted text are never stored.
Can it be hosted in our own environment?
Yes. The API and the built web app run from one Node process with a single SQLite file per deployment, so it can be hosted by SecureRoot as a tenant or installed in your environment. Either way, access is by invitation and every request is scoped to a tenant on the server.
Services
Where It Fits in the Work
The services SecureRoot delivers with DPDPA Autopilot, read from the catalogue.
Related Reading
Articles on DPDPA Autopilot
Ready When You Are
Tell us what is due and who is asking. You will leave the call with a written scope, a timeline and a fixed price, and an honest answer if we are not the right firm for it.