The Digital Personal Data Protection Act, 2023 sets out how organisations must collect, use, store and protect personal data of individuals in India, with significant penalties for failures such as a lack of reasonable security safeguards.
We help you understand what the Act and its Rules mean for your business, find the gaps in how you handle personal data today, and put practical processes in place.
Objectives
- Map what personal data you collect, why, and where it flows
- Review notices and consent capture for clarity and specificity
- Set up processes for data principal rights and grievance redressal
- Implement reasonable security safeguards and breach notification procedures
Methodology
01
Discover
- Data inventory and data-flow mapping
- Identify processors, cross-border transfers and children's data
02
Assess
- Gap assessment against the Act and Rules
- Review of notices, consent, retention and security safeguards
03
Implement
- Privacy policies, notices and consent flows
- Rights-request and breach-response procedures
- Processor contracts and staff training
Deliverables
Personal data inventory and data-flow maps
DPDP gap assessment report
Privacy notice and consent templates
Rights-request and breach-response procedures
Implementation roadmap