Why choose us

We will not tell you that you are compliant.

No one honestly can. The DPDP Act issues no certificate and no grade— there is no body that marks you out of a hundred — so any number you are shown is one a vendor invented. If the Data Protection Board ever asks about you, it asks something else entirely: what did you do, when did you do it, and can you show it? That is the question we built for.

Start the free check Build a board deck

Both are free. Neither asks you to create an account.

A framed certificate reading 100% compliant, cancelled by a thick blue cross drawn straight through it. A person stands calmly beside it. Lettered across the panel: no one can certify you compliant.

The claim everyone else makes

There is no compliance score. We did not invent one.

Look at how this market sells itself. Three claims, taken verbatim from vendor pages you can read today.

“Achieve 100% DPDP Act 2023 compliance.”

Sold alongside India-hosted data residency and automated rights workflows — real features, attached to a promise no software can keep.

“Staying 100% compliant.”

A second platform, the same guarantee, a different homepage.

A live compliance score on a dashboard.

A third leads with real-time scoring and 98.5% accuracy on its assessments. Every comparison article then describes the whole category the same way: dashboards, real-time compliance status.

Nothing in the Act or the Rules creates a certificate, a grade or a percentage. Significant Data Fiduciaries must appoint an independent data auditor and run periodic audits — an obligation, not a badge. No vendor’s dashboard reading has standing anywhere.

What does have standing is a record: what you decided, what you published, who owned it, and the date it happened.

On the left, a monitor showing a gauge and the number 87%, cancelled by a thick blue cross. On the right, a dated sheet of paper with a blue tick. Lettered between them: the law asks what you did, not for a score.

What we show instead

A map, not a score.

Thirteen cells, one per obligation area. Each is in exactly one of four states, and you can read the whole thing in about ten seconds.

Assessed, no known gaps — you looked, and it was clean

Assessed, gaps open — you looked, and there is work

In progress — started, not finished

Not yet looked at — and visibly so — never averaged away

Then a verdict in plain words, and the next thing to do named on the same screen. You cannot mistake it for a grade, because it is not one.

We do count things

Nine of thirteen areas assessed. Twenty-four of sixty-one graded controls with a file behind them. Three open gaps. Counts like those run through the workspace and every document we generate, because each one states two measured facts. A percentage states one invented one.

A grid of square tiles — some filled blue with a tick, some marked with an exclamation, some completely blank — above a legend reading done, gaps, not started. Lettered across the panel: you see every area, even the ones not started.

The part that costs us

Five things we do that would be easier not to.

Anyone can write a promise. These are the ones you can check without asking us — which is the only kind worth printing.

A checklist pinned to a wall with five blue ticks reading no score, no email wall, our own templates, official gazette text, sealed evidence. A person points at it. Lettered across the panel: five promises you can check yourself.

No compliance score

A single number sells better than a map. It is also false precision — an average of what we have measured and what nobody has looked at yet, printed as though the two were the same. There is no compliance percentage anywhere in this product: not on your workspace, not on a module page, not in the Word dossier, not in the gap analysis. We did not hide the number behind a setting. We deleted the arithmetic that produced it.

Check it yourself

Go looking for a percentage — your workspace, any module, the Word dossier we generate for your board. There is not one anywhere.

The board deck asks for nothing

The most useful free thing we make is a board briefing deck, and it sits behind no signup wall. Generate one without an account and nothing is filed on our servers: no document record, no stored file, and the context you type is never written down. We count the request against a hashed IP so the tool stays available. That is all we keep.

Check it yourself

Build one now without signing in. We ask for no email, because we do not need one.

The templates are ours

Fourteen documents — notices, consent forms, a processing agreement, a breach notice, a retention policy and the rest — drafted in-house against the Act and the Rules. Not adapted from a GDPR pack, not licensed from a library, not generated and left unread.

Check it yourself

Read any of them in full before you create an account.

We cite the gazette, not the press release

Most published summaries of the Rules quote the PIB explainer, because it is shorter and easier to read. It is also not the law. Our rule-level citations come from the official G.S.R. 846(E) text, and inside the app you can open the provision beside our reading of it.

Check it yourself

Click any citation in the product. The Act opens with that provision highlighted.

The evidence ledger is sealed against us too

Evidence entries are append-only and hash-chained, so the record cannot be silently altered after the fact — including by us. Your own data principals appear in it only as a salted one-way hash with a masked display form. There is no browsable list of the people you serve.

Check it yourself

Verify the chain yourself from the evidence page, any time.

The clock

Here are the actual dates.

A great many published timelines put the penalties in November 2026. They do not begin then. The commencement is phased across eighteen months, and only the last phase carries the Board’s power to fine you.

Every section and rule below is clickable — it opens the text beside this page, so you never have to take our summary on trust.

A hand-drawn timeline with three marks — November 2025, November 2026, and a blue circle at May 2027. A person points along it. Lettered across the panel: penalties start 12 May 2027, not before.

13 November 2025

Done

The Rules were gazetted. The Data Protection Board was constituted and every definition in the Act became operative.

§ 1 (2) · § 2 · §§ 18–26 · § 35 · §§ 38–43 · § 44 (1) · Rule 1 · Rule 2 · Rules 17–21

12 November 2026

Consent manager registration begins, together with the Board’s oversight of it.

§ 6 (9) · § 27 (1)(d) · Rule 4

12 May 2027

The one that matters

The substantive obligations land — notice, consent, breach notification, cross-border transfer and data principal rights — and with them the Board’s power to impose penalties.

§§ 3–5 · § 6 · §§ 7–17 · § 27 · §§ 28–34 · §§ 36–37 · § 44 (2) · Rule 3 · Rules 5–16 · Rules 22–23

If this page is ever out of date, that is a defect and we would like to know. Write to us and we will correct it.

Before you get too far

When we are the wrong choice.

You need personal data found for you.

We do not scan your databases, drives and SaaS accounts to discover personal data. Our own capability matrix marks automated discovery No for tools in our tier, and data mapping only Partial — we give you a ROPA to complete, not one that fills itself. India-native enterprise platforms and the global suites do this properly.

You run consent at consumer scale.

Millions of consent events, an SDK inside your app, a banner across several properties, a consent manager registration to hold. We handle consent as a notice and a ledger you keep, not as high-volume infrastructure — the matrix says Partial, and a consent-focused platform is built for exactly this.

You are answering several regimes at once.

If GDPR, ISO 27001 and the DPDP Act all sit on the same desk, a multi-regime suite will serve you better than an India-only tool. Ours is deliberately one Act deep rather than five regimes wide. The free assessment can still sharpen the India-specific part of that picture.

We also wrote an honest map of this market, including the places where another tool is the better answer. Read it before you talk to us.

A signpost with two arms: us pointing left, and someone else pointing right in blue. A shopkeeper points the customer along the blue arm. Lettered across the panel: if we are wrong for you, we will say so.

Do not take our word for it

Everything above is checkable before you sign up.

The applicability check is free and anonymous.

The board deck is free and asks for no email.

Every template can be read in full first.

Each claim in the workspace links to the provision it rests on.

Start the free check Read the templates