We build the data infrastructure your DPDP compliance depends on — consent, minimisation, retention, lineage, breach detection, and erasure. We're engineers, not your legal counsel.
Penalties run up to ₹250 crore. The Data Protection Board began its first enforcement actions in Q1 2026, against app developers with invalid consent or inadequate retention.
November 2025
Core DPDP Act obligations already apply — lawful processing, notice, and baseline data-principal rights.
13 November 2026
Rule 4 makes Consent Manager integration mandatory — consent capture, withdrawal, and audit trail must run through a registered Consent Manager.
~13–14 May 2027
Full enforcement of the Act, including the Data Protection Board's penalty powers at scale.
DPDP compliance and AI readiness draw on the same governed data platform — lineage, retention, and access controls serve both.
Consent Manager integration (Rule 4) — capture, timestamp, and let a user withdraw consent per purpose, not blanket opt-in.
Pipelines that collect and retain only the fields a stated purpose actually needs — enforced at ingestion, not left to policy documents.
Automated retention and deletion schedules per data category, so data isn't kept past its stated purpose by default.
Traceability from any personal-data field back to its source and every system it flowed through — the same lineage work that underpins AI readiness.
Monitoring and alerting on unauthorised access to personal data, with the logging needed to notify the Board within the required window.
A working deletion workflow that reaches every system holding a data principal's personal data, not just the primary database.
We build the data infrastructure your compliance depends on.
We're engineers, not your legal counsel.
Nothing on this page is legal advice, a compliance guarantee, or a certification. Whether your organisation is DPDP-compliant is a determination for your legal counsel — we build and maintain the systems that determination depends on.
A CFO buys this to avoid a ₹250 crore penalty exposure ahead of 13 November 2026. A CEO buys the same engineering to make the data platform ready for AI. The consent, lineage, retention, and access work underneath is identical either way — see our AI Readiness Assessment for the other half of the case.
We scope the consent, minimisation, retention, lineage, breach detection, and erasure work your data platform needs — fixed price, fixed scope, published on our price bands.
