DPDPA compliance workspace
DPDP Act, 2023 · in force · Rules notified 2025
When the Board asks, answer with records.
A complaint under the DPDP Act names a person and a date. This workspace runs your registers so every right honoured is evidence — timestamped, cited, exportable. Built for founders, ops and compliance leads who answer for personal data without a legal team.
No invented compliance score. Every answer is cited to the section or rule behind it.
Both free · no account · about 5 minutes each · free today, see pricing
The actual workspace — illustrative walkthrough with sample data.
Your path
Five stops, in order.
Start anywhere — the first three need no account at all.
Prefer the walk written down? One company, one year — the whole journey as a story →
Inside the workspace: fourteen cited assessments, ten live registers on statutory clocks, and point-in-time proof — see everything you unlock →
Why trust it
Start without an account
Take the assessment first — sign in only if you want to save it
Cited to the source
Every question and step names the section or rule behind it
Current to DPDP Rules, 2025
G.S.R. 846(E), notified 13 Nov 2025
Built for Indian scope
Data Fiduciaries, SDFs, and in-scope foreign firms
First a right (2017), then a law (2023), now a clock — core obligations are enforceable 13 May 2027. Read the story of the law →
The real cost of non-compliance
It isn’t ₹250 crore. It’s the dividend you never collect.
You’ll see that number everywhere — it’s a scare tactic, and not how we want to earn your time. What genuine adherence pays instead is an advantage you can bank: the trust customers extend, the procurement doors that open, the growth that compounds.
Every step below is a documented finding, not a promise.
The dividend only pays if you genuinely adhere — that’s the part we help you operationalise.
Try the whole workspace free — evaluate where you stand, then operationalise your compliance at your own pace.
Whose story is this? Almost every organisation’s.
Scope
Who must comply?
§ 2 (i) · §§ 4–10
Everyone who decides the why and the how
Any organisation that determines the purpose and means of processing digital personal data — from a two-person D2C brand to a bank. E-commerce, fintech, healthcare, ed-tech, telecom, SaaS, ad-tech, HR-tech, gaming, marketplaces, and government bodies (with carve-outs).
Notice and consent
Security safeguards
Breach reporting
Erasure when the purpose is served
Answering rights requests
And here is what it asks of everyone it reaches.
What the Act requires
Key obligations
01Give notice first
§ 5 · Rule 3A standalone, itemised, plain-language notice — in English or any of the 22 scheduled languages — before or when consent is sought.
02Take real consent
§ 6Free, specific, informed, unconditional and unambiguous — and as easy to withdraw as it was to give.
03For children, ask the guardian
§ 9 · Rules 10–12Verifiable guardian consent for under-18s, and no tracking or targeted advertising directed at children.
04Use it only for the purpose
§ 4Process personal data only for the specified lawful purpose the person agreed to — nothing else.
05Guard it while you hold it
§ 8 (5) · Rule 6 · § 8 (2)Reasonable security safeguards — encryption, access control, logs kept a year, backups — and a written contract behind every processor.
06Send it abroad with care
§ 16 · Rule 15Transfers are permitted except to countries the Central Government restricts; sector-specific localisation rules still apply.
07If it leaks, move fast
§ 8 (6) · Rule 7Tell affected people without delay, and file the detailed report to the Data Protection Board within 72 hours.
08Erase it when the purpose is served
§ 8 (7) · Rule 8Delete personal data once its purpose is served or consent is withdrawn — keeping it needs a reason.
09Honour rights, all along
§§ 11–14 · Rule 14Access, correction, erasure, nomination and grievance redressal — answered within your published window, at most 90 days.
10If you are designated significant, prove more
§ 10 · Rule 13An India-based DPO reporting to the board, an independent data auditor, and a DPIA and audit every 12 months.
One datum’s lifetime, ten duties — each one runs as a cited module in the workspace.
This is the workspace built to carry those obligations — watch it run.
The product suite
See it in action.
The first five minutes, exactly as you’d live them — and every other module has its own walkthrough, one click further.
Start free — 28 questions, no account
Answer plain-language questions about your organisation. The engine works out whether the Act applies, the role you hold, and your likely Significant Data Fiduciary band — then hands you a prioritised roadmap, each step cited to its section.
Prefer to read it? Every module has a written walkthrough, and the workspace has a screen-by-screen guide.
Nobody should have to write act one from a blank page.
Don’t start from a blank page
14 ready-to-use templates.
Privacy policies, processing agreements, consent forms, breach notices, a privacy impact assessment — every document the journey asks for, drafted for the DPDP Act.
Browse free
Sign in (free) to read, download & generate
Versions saved to your Document locker
However this story goes for your organisation, it starts small — twenty minutes tonight is enough.
Two doors in — both free.
The applicability assessment
28 plain-language questions, no account, answers kept in your browser. Leave with a roadmap of exactly what applies to you — every step cited to its section of the Act.
The board briefing deck
Six quick questions — or none. Leave with a board-ready PowerPoint that explains the DPDPA in your board’s language, with a clear ask and speaker notes.
And two promises before you start. One we make: compliance must not be overwhelming — read the design principles this workspace follows →. One we will not make: that you are compliant, because nobody honestly can — why we refuse to give you a score →.
Read the law for yourself
Official sources
All links verified to resolve at time of publication. Statute text and Rules supersede any summary on this page.