DPDP Readiness Programme
DPDP Compliance Services
DPDP readiness, engineered.
Map your personal data, close the gaps across policies, contracts and systems, and prove it works, well before 13 May 2027.
Book a Complimentary 20-Minute DPDP Readiness CallOne programme, three sides
DPDP Compliance Services: One Programme, Three Sides
SDET Tech’s DPDP compliance services, delivered through our DPDP Readiness Programme, help organizations meet the obligations of India’s Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. We look at your compliance position where three things meet: what you have committed to, what your systems actually do, and what the law requires. We map your personal data, close the gaps across all three, and test that the controls work. Legal drafting and legal opinions are delivered through our empanelled legal partners.
Policies & contracts
What you’ve committed to customers and vendors.
IT systems
What actually happens to the data.
The law
What the DPDP Act and Rules require.
01 · The clock
DPDP Compliance Timeline and Penalties
Up to ₹250 crore per instance.
The highest penalty in the DPDP Act applies to a failure to take reasonable security safeguards against a personal data breach. From 13 May 2027 the core obligations apply in full, and the Data Protection Board of India can impose penalties for non-compliance.
Maximum penalty per instance
Sources: DPDP Rules, 2025 (MeitY) and the Government of India summary (PIB).
02 · The problem
DPDP Compliance Doesn’t Live in One Place
Your compliance position sits where three things meet. Fix one in isolation and the other two drift out of line: a new privacy policy means little if a vendor contract or a database says otherwise.
Policies & Contracts
What have you committed to?- Privacy policies & notices
- Customer contracts
- Vendor & processor contracts
- Internal policies
- Data-related obligations
IT Systems
What is actually happening to the data?- Infrastructure & storage
- Databases & applications
- APIs & data flows
- Endpoints
- Access & transfers
The Law
What does DPDP require?- Notice & consent
- Security safeguards
- Data principal rights
- Breach notification
- Governance & retention
DPDP Act Compliance: What the Act and Rules Require
The Act applies to digital personal data processed in India and, in some cases, to processing outside India that relates to offering goods or services to people in India. Whether it applies to your organization depends on your processing, so confirm scope with qualified counsel.
| Obligation | What it requires | How SDET Tech helps |
|---|---|---|
| Notice and consent | A separate, clear notice of the data and purpose; consent that is free, specific, informed and as easy to withdraw as to give | Notices & consent journeys |
| Data principal rights | Access, correction, updating, erasure and nomination | Data principal rights workflows |
| Security safeguards | Reasonable safeguards, such as encryption, access control and logging, including for processors | Security safeguards testing |
| Breach notification | Tell individuals without delay; notify the Board without delay, with a detailed report within 72 hours | Breach response playbook |
| Retention and erasure | Erase personal data when consent is withdrawn or the specified purpose is no longer served, whichever happens earlier, unless retention is required by law. | Retention, erasure & monitoring |
| Vendors and processors | Processor contracts carry data-protection terms | Contract & vendor clause remediation |
Primary texts: DPDP Act, 2023 (MeitY), DPDP Rules, 2025 (MeitY), Government of India summary (PIB).
03 · The method
Our DPDP Readiness Method: Know the Gap. Close It. Keep It Closed.
A five-stage DMAIC cycle, the same discipline we use to engineer software quality, run across your policies, contracts and systems.
Define
What are we dealing with?Departments, contracts, policies, IT estate and the DPDP obligations that apply to you.
8 departments · 80 contracts · 18 policies in scopeMeasure
Where do we stand today?Contracts, commitments, policies and live controls scored against DPDP in a readiness assessment.
Baseline alignment: 6 / 10Analyse
Why are we here?Root causes behind each gap: inconsistencies, outdated clauses, untested controls.
Outdated vendor clause → processor mismatch → remediation planImprove
What needs to change?Redraft, redesign and implement, then retest until the evidence holds.
6 / 10 → target 9 / 10Control
How do we stay aligned?Monitor, review, govern and update; re-test after every material change.
Continuous review cycleOutputs shown are from an illustrative engagement, not client results.
How We Test DPDP Controls
A privacy policy states what an organization intends to do. The obligations are met or missed in how systems behave. For each control we define the expected behaviour, then test it.
| Control | A document review checks | Our testing checks |
|---|---|---|
| Consent withdrawal | Policy says withdrawal is as easy as giving consent | Withdraw in the product; confirm processing stops downstream, in analytics and partner integrations |
| Rights requests | A workflow is documented | Run requests end to end and measure response time |
| Erasure and retention | A retention schedule exists | Deletion reaches replicas, search indexes, caches and non-production copies |
| Access control and logging | A role matrix exists | Least-privilege access verified in production and non-production; access logged |
| Breach response | A playbook exists | Walk an incident from detection to notification, with timestamps |
| Vendor data flows | An agreement is signed | Contract scope compared with data actually shared through APIs |
04 · What you get
Eight DPDP Readiness Deliverables. One Accountable Partner.
Data inventory & flow map. What personal data you hold, where it lives, who touches it.
DPDP gap assessment & alignment score. A baseline you can track to target.
Notices & consent journeys. Itemised, plain-language, easy to withdraw.
Data principal rights workflows. Access, correction, erasure, grievance.
Contract & vendor clause remediation*. Customer, processor and partner terms aligned.
Breach response playbook. Detection to Board and principal notification.
Security safeguards testing. VAPT, access control, logging, encryption checks.
Retention, erasure & monitoring. Schedules plus an ongoing review cycle.
Legal drafting and opinions are delivered through our empanelled legal partners.
Why SDET Tech for DPDP Readiness
Certified
ISO 9001:2015 and ISO/IEC 27001:2022 certified. We run the controls we recommend.
Tested, not just documented
Quality-engineering discipline: we verify controls the way we verify software.
One engagement
Policy, legal and technology under one plan, with no handoffs between three vendors.
Built for Organizations Handling Digital Personal Data
DPDP Compliance FAQs
What does a DPDP consultant do?
Works out which obligations apply, where an organization falls short and how to fix it: mapping data, reviewing policies and contracts, assessing IT systems and testing controls.
What should we do first to prepare for 13 May 2027?
Find out where personal data lives and who touches it, then compare notices, contracts and system behaviour against the DPDP obligations. That is where our programme begins.
What is a DPDP alignment score?
A baseline of how closely your contracts, commitments, policies and live controls match DPDP obligations, tracked to a target.
Do we need to appoint a Data Protection Officer?
Every fiduciary must publish a DPO or designated contact. An India-based DPO is an extra duty for Significant Data Fiduciaries.
Is there a DPDP certification?
No. The DPDP Act is a law, not a certification scheme. We provide evidence of readiness instead.
How is DPDP different from GDPR?
Structured differently, so a GDPR programme cannot simply be reused. Map existing controls against DPDP.
Does SDET Tech provide legal advice?
No. Legal drafting and opinions are delivered through our empanelled legal partners.
DPDP is asking the right questions
DPDP Compliance Checklist
- Do you know every system and vendor that holds personal data?
- Does each collection point give a separate notice of the data and purpose?
- Can a person withdraw consent as easily as they gave it, with processing stopping downstream?
- Have you published contact details for a DPO or designated person?
- Do vendor contracts include data-protection terms that match how data is shared?
- Are encryption, access control and logging in place and tested?
- Do you retain personal data and logs for at least one year where required?
- Do you have a tested breach plan, including the 72-hour detailed report?
- Do retention and erasure schedules work in practice, including copies?
If you answered no or not sure to any item, that is a gap to assess.
DPDP is asking the right questions.
Do you have the answers?
Know where you stand before the Data Protection Board asks. Book a complimentary 20-minute DPDP readiness call with our team.
