🎯 Who it applies to

Any organisation — Indian or foreign — that processes personal data of Indian residents. Applies regardless of where the data is stored or processed.

📑 Key obligations

Lawful processing, purpose limitation, consent management, data minimisation, accuracy, security safeguards, breach notification, and data principal rights.

⚠ Penalties

Up to ₹250 crore for failure to implement adequate security safeguards. Up to ₹200 crore for failure to notify data breaches. Significant Data Fiduciaries face enhanced scrutiny.

🌟 Significant Data Fiduciaries

Organisations designated as SDFs (high-volume or high-sensitivity processors) face additional obligations: mandatory DPO appointment, DPIA requirements, and algorithmic audits.

🔎 DPDP Readiness Assessment

Comprehensive gap assessment against all DPDP Act obligations — data inventory, consent mechanisms, data flows, third-party processing, breach notification readiness, and security safeguards.

📊 Data Mapping & Inventory

Document all personal data categories, processing purposes, data flows (internal and third-party), retention periods, and legal basis for processing across your organisation.

🛠 Consent Management Implementation

Design and implement DPDP-compliant consent management — notice design, consent capture mechanisms, withdrawal processes, and audit trails. Covers web, app, and offline touchpoints.

📋 Privacy Notices & Policies

Draft and review privacy notices, data processing agreements, third-party processor contracts, and internal privacy policies to meet DPDP Act requirements.

🚨 Breach Notification Programme

Develop your breach detection, classification, and notification procedure — including Data Protection Board notification templates and timeline management for the mandatory reporting window.

👥 DPO-as-a-Service

eShield provides outsourced Data Protection Officer (DPO) services — mandatory for Significant Data Fiduciaries and advisable for any high-risk processor under the DPDP Act.

Readiness assessment, data mapping, gap analysis report

Consent management, privacy notices, policy suite

Breach notification procedure, data principal rights workflow

Compliance monitoring, DPO advisory, annual review