India's Digital Personal Data Protection Act
DPDPA is on
the horizon.
All core operational obligations — consent mechanisms, Data Fiduciary requirements, and penalties — take full effect on:
Full effect
13 May 2027
The clock to operational compliance is already running.
Where most companies are today
Companies are currently engaging legal advisors as the first step
Deciding data purposes
Establishing consent grounds
Drafting RoPAs
Privacy impact assessments
But the operational processes aren't in place yet.
Advisory decides what compliance should look like. It doesn't run it — or keep running it.
What companies actually need
01
Discover the data inventory
Find every system and store where personal data lives.
02
Record processing & legal basis
Log each activity and the lawful basis it relies on.
03
Maintain a record of consent
Keep a durable, auditable history of what was agreed.
04
Re-consent existing customers
Reach out to current data principals for updated consent.
05
Respond to data-principal requests
Handle access, correction, and erasure within the clock.
06
Report status to leadership
Give the board a clear, current view of compliance.
And do all of it — regularly.
What we're building
An elegant, simple solution you self-host in your own environment.
Self-hosted by design
Your data never leaves your own environment.
No recurring SaaS cost
Avoid monthly license costs.
One-time setup
Pay once to deploy, then support fees only.
Built to replace legacy tools
Legacy solutions
- Expensive annual licences
- Vendor-hosted — your data leaves your walls
- Heavy, slow to roll out
DPDPA CMS Self-hosted
- One-time setup, support fees only
- Self-hosted — data stays in your environment
- Purpose-built for DPDPA — quick to deploy
We're building to replace expensive tools like OneTrust.
Preview it today
See DPDPA CMS running before the 2027 deadline. Tell us a little about your organisation and we'll set up a preview.
Self-hosted in your own environment
One-time setup, support fees only
Purpose-built for the DPDPA