When this work helps
A defined, one-time review for organisations preparing for DPDP requirements, planning improvements or reassessing readiness after a significant change.
Scope and practical outputs
Review current data handling against the DPDP requirements relevant to your organisation and the agreed scope. Areas include notices, consent and other relevant processing grounds, security safeguards, breach preparedness and data principal rights.
- A readiness report identifying reviewed activities, evidence and gaps.
- Separate findings for absent, partial, unknown and evidenced arrangements.
- A prioritised action plan with owners, dependencies and completion checks.
What your team contributes
Make relevant owners available and provide current material through an agreed channel. Explain gaps in access or evidence so the report can state its limits.
An example to discuss
A policy may say leavers lose access promptly. A review can ask the HR and IT owners to demonstrate a recent handover using suitably limited evidence.
Agree the boundaries
The agreed sample does not establish that every record or operation was checked. Certification, penetration testing and a formal legal opinion are distinct scopes.
Common questions
Will I receive a compliance score?
The useful result is a set of findings and priorities. A single score can hide an unresolved issue that needs immediate attention.
What happens when evidence is missing?
The finding remains unknown or unverified, with a named follow-up. Missing evidence is not silently treated as a pass.
Discuss the work you need
Agree the service, deliverables, responsibilities and fees before committing to an engagement.
Related reading
References
- MeitY: Digital Personal Data Protection Act, 2023
- Gazette: DPDP Act commencement notification, 13 November 2025
This page explains topics to scope and discuss. It does not establish applicability, certify compliance or confirm a paid engagement.
← Services