DPDPA compliance and consent-technology analysis — the Act, the Rules, and what implementation actually looks like, written plainly.
DPDPA’s 72-hour breach notification clock starts at discovery, not occurrence, and what has to be reported to the Board and affected users.
What a DPIA evaluates, when it’s triggered beyond Significant Data Fiduciary status, and a five-step process for running one.
Parental consent doesn’t permit profiling or ads for under-18 users; verifiable consent, age-gating, and data segregation requirements.
Designing a DPDPA-compliant preference center with no dark patterns that turns a legal requirement into user trust.
DPDPA’s permissive default on transfers, and how RBI localization overrides it for regulated entities.
Why DPDPA compliance has to be cultural across every function, not just documented by legal.
Comparative look at DPDPA against GDPR, CCPA, PIPL, LGPD and others, and what’s genuinely unique about India’s approach.
Why code-layer scanning catches undocumented collection points that database scanning alone misses.
A recent "government-registered" Consent Manager list turns out to mean Companies Act incorporation, not DPDPA registration.
When a user reaches you through different entry points, whose consent record governs — the channel’s, or the person’s?
30 minutes to talk through where you actually stand — no obligation.
Book a Consultation