End-to-end readiness for the Digital Personal Data Protection Act 2023 and the DPDP Rules 2025, from gap assessment through consent architecture to the security safeguards Section 8(5) actually demands, evidenced clause by clause.
Aligned to
DPDP Act 2023ISO 27001SOC 2NIST CSFPCI DSSGDPRCISDORAMost DPDP programmes are being sold as a consent banner and a policy refresh. That covers the visible half of the Act and leaves the expensive half untouched.
The Act's largest penalty is not for a missing notice. It is for failing to keep reasonable security safeguards under Section 8(5), an engineering obligation that sits outside what any consent tool can deliver.
The second problem is evidence. A control you cannot demonstrate on the day the Board asks is a control you do not have. We build the compliance layer and the security layer together, and we document both to the standard our ISO 27001 and SOC 2 work already meets.
MeitY notified the DPDP Rules on 13 November 2025 and staged commencement across eighteen months. Knowing which obligations are live decides what you build first.
Definitions apply and the Data Protection Board of India is constituted. Data principals can already lodge complaints.
The Board can inquire and levy penalties. Consent Manager registration opens. Technical work should be substantially done by here.
Notice, consent, rights, retention, cross-border transfer and breach obligations apply in full to every data fiduciary.
The Schedule prices each failure separately, and penalties are levied per instance. Two of the top three are engineering problems, not paperwork.
Figures are the maximums set out in the Schedule to the Digital Personal Data Protection Act, 2023. The Data Protection Board of India determines the amount for each instance. This page is general information and not legal advice.
Five phases in a fixed order. You cannot write a notice before you know what you collect, and you cannot promise erasure before something enforces it.
Stakeholder interviews, automated PII scanning, system inventory and applicability analysis.
Consent architecture, notice set, retention schedule, rights workflows and security target state.
Our engineers build alongside your team: consent, DSR portal, encryption, logging, erasure jobs.
Mock rights request, mock breach drill, VAPT retest and an evidence pack indexed by clause.
Quarterly reviews, new-feature privacy checks, DPO retainer and annual re-attestation.
Every engagement ships a named deliverable and an evidence pack built to withstand regulatory scrutiny on day one.
We test current practice against every obligation that binds you, ranked by penalty exposure rather than ease of closure, then tell you what to fix first and what can wait.
Itemised notice, granular purpose-level consent, and a withdrawal path as easy as the path in, plus the rights and grievance workflows behind it. Deploy on OrbCyber Consent or the platform you already run.
Impact assessment plus the safeguards it demands. This is where Section 8(5) lives, the clause behind the ₹250 crore line, and where our security engineering does the work a consent tool cannot.
One session for everyone, deeper modules for the four teams that actually touch personal data: engineering, support, HR and marketing.
You must intimate affected principals and the Board without delay, then file full particulars within 72 hours. That is a drill, not a policy document.
A named privacy officer on retainer: rights requests, Board correspondence, quarterly reviews and customer security questionnaires. Required in India for Significant Data Fiduciaries under Sec. 10.
Every artifact is indexed against the clause it satisfies, so an auditor, an enterprise customer or the Board can be answered from one folder.
Handed over on completion, in editable and signed formats.
Built for organisations that meet one or more of these.
The same principles that run our ISO 27001 and SOC 2 engagements, applied to India's data protection regime.
The Act's biggest penalty is a controls failure. We are a security firm first, so Section 8(5) is home ground rather than a subcontract.
Every artifact is built to withstand regulatory scrutiny on day one, indexed against the clause it satisfies.
We implement whichever consent platform fits your architecture: yours, a third party's, or OrbCyber Consent. The gap assessment is priced and delivered before any platform decision.
Platform automates evidence collection and continuous monitoring; senior consultants make the judgement calls.
The questions that come up on almost every first call.
Because the work consumes most of the runway. A mid-market programme runs 16–20 weeks of our time plus your engineering capacity, and the technical items (consent architecture, erasure automation, vendor agreements) have long tails. From 13 November 2026 the Board can inquire and levy penalties, so the practical window is shorter than the headline date suggests.
A useful share of the Section 8(5) safeguards (access control, encryption, logging, incident response) maps across, and our unified control library credits it rather than re-doing it. What does not map is the consent and purpose layer: itemised notice, granular consent, withdrawal, rights fulfilment, purpose-linked retention and children's data. That is usually where the real work sits.
The central government notifies SDFs based on factors including volume and sensitivity of data, risk to data principals, and impact on the sovereignty and integrity of India. There is no self-registration. We assess your likelihood during the gap assessment and, where it is close, recommend building to the SDF bar anyway. The additional obligations are a DPO in India, an independent data auditor and periodic DPIAs.
No. The Act does not create a statutory certification for data fiduciaries. What we issue is an OrbCyber readiness attestation, an independent statement of your posture against the Act and Rules, with the evidence behind it. It is built for enterprise procurement, diligence and insurance conversations.
No. We prepare you and support you through independent audit, exactly as we do on ISO 27001 and SOC 2. Independence matters, and it matters more where the Act requires an independent data auditor for Significant Data Fiduciaries.
Yes. We build OrbCyber Consent, our own consent management platform. We keep the advice honest by sequencing it: the gap assessment and roadmap are scoped and delivered before any platform decision, and they are priced the same whether or not you licence ours. If a third-party platform fits your architecture better, we will implement that instead. Licence fees are always quoted separately from consulting fees, never bundled into a single number.
Most clients combine two or three of these. Here is what pairs well with a DPDP engagement.
Our consent management platform: itemised notices, granular consent, tamper-evident artefacts and one-click withdrawal.
ISO 27001, SOC 2, NIST, PCI DSS, GDPR: readiness through certification, on a unified control library.
Continuous third-party assurance and automated questionnaires: the processor side of DPDP.
Book a free 30-minute consultation. No slides, just a working conversation about your DPDP gaps and roadmap.