Secure · Governance, risk and compliance
DPDP compliance for Indian enterprises: the technical and operational side of the Digital Personal Data Protection Act and Rules. NetScale maps where personal data lives, builds the controls the Rules require and keeps the evidence current, following ISO/IEC 27701, which it holds itself. Legal interpretation stays with your counsel.
DPDP Readiness
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India’s law on digital personal data.
The DPDP Rules, 2025 set out how it works. For IT, DPDP compliance means the safeguards the Rules name, working and evidenced: encryption or masking, access control, monitoring and logging, a year of logs, and breach intimation to the Data Protection Board and the people affected.
The ISO/IEC 27701 standard and its certificate sit under ISO 27701:2025 privacy management.
Personal data sits in spreadsheets, inboxes and shared drives. Can you name every copy?
Our answer: DPDP readiness
Customer records are open to everyone in the department. Who needs that access?
Our answer: Security safeguards
An email with personal data went astray. Who decides whether to notify the Data Protection Board?
Our answer: Breach response and reporting
A payroll vendor holds every employee’s records. What does its contract say about protecting them?
Our answer: Vendor and processor risk
Data mapping, gap assessment against the Rules, and a phased programme to close the gaps by control area.
Encryption or masking, access control, monitoring and logging, backups, and breach detection, designed into the estate rather than added to it.
An incident runbook that tells the Data Protection Board and the people affected without delay, sends the Board a detailed report within 72 hours, and meets the CERT-In 6-hour duty.
Privacy information management system implementation and audit, aligned to DPDP and data protection requirements.
Processors, contracts and access reviewed and placed on one risk register.
One management system, drawn three times.
You can stop at any phase boundary. The assessment is free, and each phase is priced in writing before it starts.How we engage
The DPDP Rules were notified on 13 November 2025, and consent manager registration applies from 13 November 2026. The substantive duties apply from 13 May 2027, 18 months after notification. Press reports say MeitY asked industry in January 2026 for views on a 12-month timeline instead. They differ on whether it would cover every data fiduciary or only significant ones, and nothing had been notified by October 2026.
Reasonable security safeguards including encryption or masking, access control, monitoring and logging, one year of logs, backups, and, after a breach, intimation to the Data Protection Board and the people affected without delay, with a detailed report to the Board within 72 hours.
Source: Digital Personal Data Protection Rules, 2025 (external site)
The Act makes reasonable security safeguards and breach notification statutory duties, with penalties set in its Schedule. Applicability and penalties are for your counsel.
Source: Digital Personal Data Protection Act, 2023 (external site)
We design and run the controls and produce the evidence. We do not give legal advice on applicability, consent wording or notices.
Systems and processes that hold personal data, and how many have never been mapped.
The gap between current controls and the Rules: logging, access control, encryption and backup are the usual large items.
An outsourced data protection officer, if the programme includes one.
Evidence: how much has to be built from scratch, and how much only kept current.
The most relevant engagement, with its numbers. Client names and the full write-up are shared in conversation.
Co-working · Two Indian cities
How a co-working space operator measured its readiness under India’s Digital Personal Data Protection Act and scoped the work to close the gaps.
Email security and awareness
Email protection and backup
Privileged access management
Cloud platform and identity
Firewalls and secure networkingOur own information security and privacy management systems, run under both standards.
Certifications and technologyA review of where your personal data lives and how your network, cloud and applications stand against the DPDP Rules’ technical duties. It goes control area by control area, with a written finding for each. Ours is free, and the findings are yours whether we work together or not.
The substantive duties on data fiduciaries apply from 13 May 2027. The Rules were notified on 13 November 2025, and consent manager registration applies from 13 November 2026. Press reports say MeitY has consulted industry on a shorter timeline, and nothing had been notified by October 2026, so check the dates with counsel before relying on them.
No. The Act does not create one. ISO/IEC 27701, a privacy information management standard, is the closest recognised way to evidence the controls, and we hold it ourselves. Whether it satisfies a specific counterparty is a question for them and your counsel.
Closely. ISO/IEC 27701:2025 sets privacy controls for data mapping, purpose limitation, retention, processor management and breach handling. Those map to the DPDP Rules’ technical duties, so a 27701 programme produces most of the evidence DPDP needs. Where the Rules ask for more, such as telling the Board and the people affected about a breach without delay and sending the Board a detailed report within 72 hours, we add it.
It costs nothing and commits you to nothing. You get a written list of where your IT environment is exposed, and your team can act on it with or without us.
