DPDP Act Readiness and India Data Protection Compliance

Flow chart of the DPDP Act engagement, 6 phases in order, each one selectable. Phase 1, Data Discovery and Mapping. We map where personal data enters, flows, and rests across your systems. You cannot protect what you have not found. Activities: Scan systems and databases for personal data; Interview teams on collection and sharing points; Map data flows across vendors and borders; Build the personal data inventory. Hands over Data Flow and Inventory Map. Phase 2, Gap Assessment Against the DPDP Act. We measure your current practices against the DPDP Act and its Rules, covering consent, notice, and data principal rights. Activities: Assess consent and notice practices against the Act; Review readiness for data principal rights; Check breach reporting and security safeguards; Rank gaps by penalty exposure and effort. Hands over DPDP Act Gap Assessment Report. Phase 3, Consent and Notice Design. We help you build clear notices and a consent mechanism that meets the law, including consent manager considerations. Activities: Draft notices in plain language per purpose; Design the consent capture and withdrawal flow; Assess consent manager integration options; Plan notice delivery in the required languages. Hands over Consent and Notice Framework. Phase 4, Rights and Breach Processes. We set up processes for data principal requests and for reporting breaches within the required timelines. Activities: Build the data principal request workflow; Define grievance redressal roles and timelines; Write the breach notification procedure; Run a breach response tabletop exercise. Hands over Data Principal Rights Playbook and Breach Procedure. Phase 5, Control Implementation. We help you put in place the security safeguards and retention rules the DPDP Act expects. Activities: Implement encryption and access safeguards; Set retention and erasure schedules; Update processor contracts with DPDP Act clauses; Roll out privacy training to data-handling teams. Hands over Implemented Safeguards and Retention Schedule. Phase 6, Readiness Review. We run a final review so you can show a regulator, or a customer, that your programme holds together. Activities: Test the consent and rights workflows end to end; Verify remediation of earlier gaps; Compile the accountability evidence pack; Brief leadership on residual risk. Hands over DPDP Act Readiness Report. Each phase begins from the artefact the phase before it produced.