A 1,000+ employee IT and product-engineering services firm, prompted by its US clients to get DPDP-ready — not for the software it builds, but for how it handles the people behind it: candidates, employees, visitors and contractors.
A 1,000+ employee IT and product-engineering services company based in India, delivering software services to enterprise clients in the United States. Like most services firms of this size, its own product isn't where DPDPA exposure concentrates — its workforce data is.
Their US enterprise clients began asking about DPDP Act 2023 compliance as part of ongoing vendor due diligence.
That question landed on a team that hadn't yet mapped what DPDPA actually required of them — so they came to us to work through it properly, rather than produce a paper answer to a client questionnaire.
This is a workforce-data engagement. The scope covers four areas where the company acts as a Data Fiduciary over its own people, not over the end users of anything it builds for clients.
Everything from a job application landing in the pipeline through screening and selection.
The ongoing employment relationship, not just the point of hiring.
Anyone entering company premises who isn't staff.
The non-employee workforce operating alongside full-time staff.
Customer data — anything belonging to the end users of the software this company delivers for its US clients — sits outside this engagement entirely. That's a deliberate boundary: getting the workforce-data foundation right first is what makes a later, separate conversation about customer data possible on solid ground.
Established where candidate, employee, visitor and contractor data handling actually stood against the Act — findings, not assumptions.
See this service →02TechnologyThe findings fed directly into the model for how consent gets captured, tracked and honoured across all four workforce categories.
See this service →Rather than displacing what the client already runs, our work has been to design the DPDP-compliant consent and data-handling model around it and support the integration work needed to make it real — solutioning the flows candidate by candidate and employee by employee, not handing over a policy document and leaving implementation to figure itself out.
>50% complete — remaining work expected within 4–6 weeks
A DPDPA programme like this one moves at the speed of the slower party — and in this case, that wasn't us.
It depended on the client's own commitment and an internal sponsor who kept the work prioritised on their side, week over week.
30 minutes to talk through your specific footprint — no obligation.
Book a Consultation