01
Data
Where personal data enters, sits and leaves — including the processor systems your own inventory does not list.
DPDP enforcement powers activateEnforcement092d 01h 44mFull compliance deadline273d 01h 44m
Fixed scope · Fixed fee · Three weeks
DPDP Gap Assessment
In three weeks you will know exactly where you stand against every obligation in the Act and the Rules — and what closing each gap costs.
No discovery phase that turns into a retainer. The scope is written down before we start, the fee does not move, and the output is a document your board and your auditor can both read.
- 03
- Weeks, start to report
- 64
- Obligations tested
- 08
- Named deliverables
- 12h
- Of your team's time
What we assess
Consent Manager readinessRoPAPrivacy noticeConsent artefactsData principal rights workflowData processing agreementsDPIACross-border transfer assessmentRetention & erasureRule 6 security safeguardsRule 7 breach readinessCERT-In reportingVerifiable parental consentSignificant Data Fiduciary obligationsDPO appointmentTraining
Every item above is tested against your systems, not against a questionnaire. Where an obligation does not apply to you, the report says so and says why.
Method
Four lenses on the same estate, so nothing hides between them.
02
Documents
Notices, consent artefacts, contracts, retention schedules and policies, read against the rule text rather than against each other.
03
Controls
Rule 6 safeguards, access, logging and retention — sampled and evidenced the way an auditor would sample them.
04
Clocks
Rights fulfilment and breach response timed against the statutory windows, not against your SLA.
The schedule
Three weeks, week by week.
WEEK 01
Days 01–05 · 4h of your time
Discovery and data mapping
Kickoff, system walkthroughs and interviews with the owners of each processing activity. We build the processing inventory and the processor list, including the vendors nobody thinks of as processors.
Output: draft RoPA · processor register
WEEK 02
Days 06–10 · 6h of your time
Obligation testing
Each processing activity mapped to the obligation that governs it, then tested: notice, consent, rights workflow, retention, transfers, Rule 6 safeguards and Rule 7 readiness. Evidence sampled, not assumed.
Output: obligation matrix · evidence log
WEEK 03
Days 11–15 · 2h of your time
Findings, costing and walkthrough
Findings ranked by regulatory exposure, each with a remediation action, an owner, an effort estimate and a cost. Delivered in a working session with the people who have to do the work, and a short board-ready summary.
Output: assessment report · costed roadmap · board summary
What you receive
Eight named deliverables. Nothing vaguer than that.
Every artefact is yours to keep, in editable form, whether or not you continue with us for implementation.
- 01DPDP Gap Assessment ReportEvery obligation, your position against it, and the evidence we saw.
- 02Record of Processing ActivitiesPopulated, not a blank template — ready to maintain.
- 03Data flow and processor mapIncluding cross-border flows and the contracts behind them.
- 04Costed remediation roadmapRanked by exposure, with effort, owner and cost per action.
- 05Notice and consent reviewRedlined against the Act and the Rules, clause by clause.
- 06Breach readiness assessmentRule 7 and CERT-In, timed against the real windows.
- 07SDF and DPO applicability opinionA written position on whether the heavier obligations reach you.
- 08Board summaryTwo pages, no jargon, with the exposure stated in rupees.
Who we need
Twelve hours of your team's time. In total.
Scheduled in advance, in blocks, so nobody loses a week to a compliance project.
| Role | What we need from them | Time |
|---|---|---|
| Privacy / compliance lead | Day-to-day counterpart. Policies, prior assessments, open commitments. | 4h |
| IT / engineering | System walkthroughs, access and logging evidence, integrations. | 3h |
| Legal / contracts | Processor agreements and the transfer arrangements behind them. | 2h |
| Business owners | One interview each per major processing activity — marketing, ops, support. | 2h |
| Executive sponsor | Kickoff and the closing walkthrough. Nothing in between. | 1h |
The fee
One number, agreed before we start.
Banded by the size of your processing estate, not by hours burned. If the estate turns out larger than scoped, we tell you before the work happens — the fee never moves after the fact.
Get a scoped quoteSingle entityUP TO 25 PROCESSING ACTIVITIES
₹4,50,000Multi-entity or SDFGROUP STRUCTURES · SHARED PROCESSORS
₹7,50,000Credited to implementationIF YOU CONTINUE WITHIN 60 DAYS
50%What happens next
From first call to signed scope in five days.
01 · DAY 00
Free consultation
Forty-five minutes on what you process and who touches it.
02 · DAY 02
Written scope and fee
Activities in scope, entities covered, deliverables named, fee fixed.
03 · DAY 05
Kickoff scheduled
Interview slots booked with named people, evidence request issued.
04 · DAY 26
Report and walkthrough
Findings, costed roadmap and the decision on what to fix first.
Three weeks from now, you could stop guessing.
Enforcement powers activate on 13 November 2026. An assessment started this quarter leaves room to fix what it finds.
Talk to DPDP expertsLet's discuss your DPDP position.
Talk to DPDP experts
Fixed scope · Fixed fee · Three weeks — free consultation, response within 24h.