Skip to content
Notepoint.
Get in touch
Security & Compliance Fixed scope

DPDP Act Readiness Review

A hands-on gap assessment against India's DPDP Act 2023, covering consent, retention, notices and your breach response.

Timeline
15 working days
Price
₹22,999 incl. GST
Reference
NP-SEC-102
Ownership
Delivered into accounts you own

Overview

What this engagement is

India's Digital Personal Data Protection Act places real obligations on how organisations collect, use and keep personal data, yet few teams have a clear picture of where that data lives. We begin by tracing it everywhere it goes: production databases, analytics tools, support inboxes, marketing platforms and the stray spreadsheet on a shared drive. From there we examine consent capture, retention habits and processor agreements against the Act, and turn the gaps into a costed remediation plan. The review is engineering-led rather than legal advice, and we are explicit about the points where your counsel should take over.

Deliverables

What you receive

7 items
  • Inventory of personal data across systems, vendors and storage locations
  • Data flow diagrams covering collection, processing, sharing and deletion
  • Gap assessment against DPDP Act obligations, each gap rated by severity
  • Review of consent notices and capture flows, with revised wording
  • Proposed retention schedule for each category of data
  • Process for data principal rights, including access, correction and erasure
  • Breach notification procedure plus a remediation plan with effort estimates

Outcomes

What changes once it ships

A clear map of where personal data sits, often for the first time

Consent and retention practices you can stand behind

A ranked plan of action in place of a general unease about exposure

Process

How the 4 stages run

  1. Discover

    Short interviews with system owners to locate personal data, including forgotten copies

  2. Map

    Data journeys recorded from the point of collection through to deletion

  3. Assess

    Current practice measured against the Act, provision by provision

  4. Plan

    Gaps ranked and assigned owners, effort estimates and a recommended order

A strong fit for

  • Indian organisations holding customer personal data at any volume
  • Products with Indian users that are widening what data they collect
  • Teams whose privacy policy was borrowed from another site long ago

What we need from you

  • Time with system owners for brief interviews
  • Your current privacy policy, vendor list and consent screens
  • A senior sponsor who will own the remediation plan afterwards

You share these through the brief that opens in your client dashboard once payment is confirmed. The timeline starts when they arrive.

Answers

Questions about this engagement

No. It is a technical and operational readiness review. We work alongside your legal counsel and flag anything that needs their judgement.
The data inventory and flow maps apply to both. A complete GDPR assessment is additional scope, which we are happy to quote.
Yes. Obligations grow with volume and sensitivity, but they apply from your very first data principal.

This is a digital service — nothing is shipped. Work is delivered to the timeline above, into systems you control, and our refund terms explain what happens if a date is missed.

Often paired with

Engagements that work well alongside.

All Security & Compliance
Security & Compliance Popular

Web Application VAPT

A hands-on penetration test of your web application, with proof-of-concept evidence for every finding and a retest once fixes land.

Hands-on penetration test of authentication, authorisation and business logic

₹29,999

12 working days · GST incl.

Add
Security & Compliance

SOC 2 Evidence Groundwork

We put in place the technical controls and evidence collection a SOC 2 Type II audit expects, before your observation window opens.

Control gap assessment against the Trust Services Criteria in your scope

₹44,999

30 working days · GST incl.

Add

GST included

₹22,999

Add Buy now