DPDP Untangled turns the DPDP Act 2023 into an operating system for how you actually handle personal data — assessed, architected, enabled, sustained.
Most consent platforms are rented, forever — a SaaS subscription you never stop paying for. We evaluate what you need, design the consent architecture, then build and deploy a real CMP codebase onto your own infrastructure and hand you the keys. Source access, no seat licences, no vendor lock-in on the thing your compliance posture depends on.
Explore the Consent Management PlatformThe gap compounds every renewal — a rented CMP's cost keeps climbing, an owned one doesn't.
The DPDPA's Section 33 schedule, in full — not the one figure everyone quotes.
| Violation | Provision | Maximum penalty |
|---|---|---|
| Failure of reasonable security safeguards (data breach) | Section 8(5) | Up to ₹250 Cr |
| Failure to notify the Board / affected persons of a breach | Section 8(6) | Up to ₹200 Cr |
| Breach of additional obligations for children's data | Section 9 | Up to ₹200 Cr |
| Breach of Significant Data Fiduciary obligations | Section 10 | Up to ₹150 Cr |
| Any other breach of the Act or Rules | Residuary | Up to ₹50 Cr |
Under Section 33(3) the Board can double a penalty on aggravating factors. Substantive obligations become enforceable 13 May 2027.
A linear path from not knowing DPDP exists to a fully maintained programme — eight stops, each mapped to the real services that get you there. Advisory, not a gate: the point is finding out where you are today.
Find Your DPDP Readiness Level →Evidence-based findings, scored for exposure and remediation effort.
Start here →Your records of processing, actually built as a living register — not a Word doc.
See what's built →Where you stand today, and the sequenced path to where you need to be.
Get your roadmap →Safeguards mapped against Section 8(5) — not a generic security checklist.
Get your roadmap →Not a subscription — source code, deployed on your infrastructure. Full source access, no recurring licence, no vendor lock-in.
Explore the platform →Four lines, one practice — the flagship is the platform you own, not a service you subscribe to.
Evidence-based findings, not policy-review guesswork.
Explore Assessments →TrainingFrom developers to the board — role-specific, not generic.
Explore Training →Technology · FlagshipFlagship — full source access, no recurring licence.
Explore Technology →Governance & DocumentationYour processing records and consent journey, built as living registers — plus DPO-as-a-Service to keep them current.
Explore Governance →Every sector page covers both roles DPDPA actually distinguishes — as a Data Fiduciary (your own customer data) and as a Data Processor (processing on someone else's behalf) — since the obligations aren't the same for each.
Consent architecture under RBI overlap, with contractual pass-through across the distribution chain.
No sector regulator — DPDPA applies directly, with per-procedure consent for sensitive data.
Verifiable parental consent at scale, with no regulator to appeal to.
Third-party pixel and SDK exposure most teams haven't fully mapped.
Primarily a processor for enterprise clients — real exposure is what you enable for their end users.
Minimal processor footprint unless the business sells direct to consumers.
Narrow exemption pathways for specific citizen services, not a blanket carve-out.
TRAI's TCCCPR and Digital Consent Acquisition now run alongside DPDPA obligations.
Ad-consent flows sit inside the core product, not beside it.
Wide footprint with many processors in the chain — BGV and payroll vendors chief among them.
High data sensitivity paired with very little technology enablement across the sector.
Every real topic an implementation team actually runs into, answered plainly and kept current as the Rules evolve. Prefer to read it as articles? Browse all Insights →
Every section, cross-linked to the Rule that actually implements it — not a summary that skips the wording that matters.
Rule by rule, including Rule 6's security safeguards and the breach-notification timelines under Rule 7.
Where DPDPA obligations collide with RBI, SEBI and IRDAI rules already in force — the gaps that trip up regulated sectors first.
What actually changes for data leaving India, and what doesn't, under the Act's transfer provisions.
Builds a purpose-itemised notice from your data flows — not a static template you edit blind.
A real starting structure for your Records of Processing, built around what Section 8's obligations actually require.
Walks through when a DPIA is actually warranted, and what evidence a defensible one needs.
Enter your breach-discovery date, get every Section 8(6) notification deadline that follows from it.
A seven-question check on the DPDP Readiness page — find out which of the 8 stops you're actually at.
The same diagnostic, tuned to sector-specific risk — BFSI, healthcare and EdTech first.
Short, role-specific sessions on breach handling, consent design and DPO fundamentals — built for teams, not a compliance-day slideshow.
What a board actually needs to know about DPDPA exposure — framed for sign-off decisions, not implementation detail.
Answered from the Act and Rules text directly, with the section cited — not a generic legal disclaimer.
One of the most common real questions implementation teams hit in month one.
Points straight to the transfer provisions, not a vague "consult counsel" non-answer.
One engagement, told straight — no vanity numbers, no anonymised-beyond-recognition composite.
DPDP compliance across a workforce, not a product — candidate data, employee consent, visitor and contractor management for a 1,000+ employee IT services firm.
We test consent flows, contracts and systems directly instead of taking your privacy policy's word for it.
Powered by truConsent, an IITM-incubated Privacy Intelligence Suite — our advisory work is grounded in what actually gets built.
Risk profiles we've mapped ourselves, sector by sector — not a generic checklist applied everywhere.
Rules changes, deadlines, and what they mean for you — no spam, unsubscribe any time.
Assess where you stand today, and what your next step should be — before you talk to anyone.
Find Your Readiness Level →30 minutes, straight answers — no deck, no sales pitch. Prefer to see every way to reach us first? Visit Contact →
Book a Consultation