DPDPA Readiness · India
Be ready for the DPDP Act, obligation by obligation.
Seven guided stages from “does the Act apply to us?” to a signed compliance review. Your Business Liaison implements and evidences, your GRC Liaison reviews and signs, and the live registers keep every statutory clock in view — with a hash-chained ledger that proves what you did when a Data Principal complains.
First assessment free for its first month. No card. No score.
At a glance
- Law
- DPDP Act 2023 + Rules 2025
- Stages
- 7
- Controls in the catalogue
- 49
- Live registers
- 10
- Document templates
- 14
- Evidence files stored in
- India (Mumbai)
Start without an account
Three things you can do right now.
5 minutes · no account
Does the Act apply to you?
28 plain-language questions. A role verdict (Data Fiduciary, Processor, both), the obligations that switch on, and a roadmap you can download as Word.
PowerPoint · no account
A board briefing deck
Tell us the sector, size and a sentence of context; download a PowerPoint that explains the Act, the penalties and the programme to your board.
Word · no account to read
Fourteen templates
Privacy notice, consent form, breach procedure, DPO charter and more — each drafted clause by clause against the Act and Rules. Read them all; sign in to generate yours.
How it works
Seven stages, each one ends in something you can show.
Stages 1 to 4 run in order. Once the control set is decided in Stage 2, implementation, the registers and the compliance review run in parallel.
Context & roles
Who you are under the Act, and who does the work
Establish whether the Act applies, your role as Data Fiduciary or Processor, the conditions that switch obligations on (children, cross-border, consent manager, SDF likelihood), and name the two liaisons.
You produce
An applicability profile that pre-decides Stage 2, and a staffed assessment.
Obligation applicability
Decide which DPDPA controls apply, and justify each
The DPDPA equivalent of a Statement of Applicability. Baseline controls bind every Data Fiduciary and are locked. Conditional domains are pre-decided from Stage 1 and can be overridden with a justification.
You produce
A justified control set that drives Stage 5.
Data map
Record every processing activity
Build the record of processing activities: purpose, data categories, principals, source, retention, processors and any transfer out of India. It is live evidence for two controls and the source for the retention and processor registers.
You produce
A record of processing activities kept current in Stage 6.
Documents
Assemble the notices, policies and procedures
Fourteen original templates drafted against the Act and Rules. Generate or download, complete, upload and mark ready. A ready document surfaces as suggested evidence on the controls it serves.
You produce
A document set the Board or an auditor can read.
Control implementation
Implement, evidence and review each control
For every applicable control the Business Liaison records the implementation status, notes and evidence, then sends it for review. The GRC Liaison records a finding: Meets, Gap, Breach risk or Observation. Gaps and breach risks carry a recommendation and open a corrective action.
You produce
Every applicable control reviewed with evidence and findings on record.
Operate
Run the registers against their statutory clocks
The live obligations: requests within 90 days, breach reports within 72 hours, grievances within 30 days, retention dates, processor and notice reviews, the consent ledger, transfers, the calendar and governance roles. The first real row in a register is live evidence on the control it feeds.
You produce
Registers on track, clocks green.
Attest
Prove it: dossier, ledger and a signed review
Roll everything up into the compliance dossier, verify the hash-chained evidence ledger, and hold the periodic compliance review the GRC Liaison signs, producing immutable minutes per cycle.
You produce
A dated, signed record per cycle.
Then the Board
When the Data Protection Board asks, hand over the dossier, the signed review minutes and a complaint pack built from the ledger — every entry dated, hashed and verifiable, not a spreadsheet assembled the night before.
Stage 6 · Operate
Ten registers, each with its statutory clock.
Silence is never read as compliance. The first real row in a register is live evidence on the control it feeds.
Rights requests
90 days · Rule 14(3)
Breach incidents
72 hours · Rule 7(2)
Grievances
30 days · § 13
Consent ledger
§ 5–6
Retention & erasure
§ 8(7), Third Schedule
Processors & DPAs
§ 8, review dates
Notices & policies
§ 5, versions
Cross-border transfers
§ 16
Compliance calendar
audits, DPIAs, training
Governance roles
DPO, auditor, grievance officer
Data Principals
Publish your intake portal and people submit rights requests and grievances themselves; each lands in the right register with the clock already running, and they get a tracking link without an account. Embed the portal in your own site.
The output
Everything the Board, an auditor or a client will ask for.
The compliance dossier
Every applicable control with its status, evidence, finding and corrective action; the data map; the register summaries. One Word document.
The evidence ledger
An append-only, hash-chained record of every right honoured. Data Principals appear only as a salted hash and a masked identifier — never raw personal data.
The complaint-response pack
When a Data Principal complains to the Board, pull every ledger entry for that person into one dated, verifiable pack in a minute.
Signed review minutes
The GRC Liaison holds the periodic compliance review and signs it; the minutes are immutable and hashed into the ledger.
AI, with a leash
Optional, per assessment, off until an authorised seat holder accepts the notice. The evidence reviewer grades only what a document actually shows and quotes its source; the copy-editor never changes a fact. A strict switch turns AI off everywhere for an assessment whose policy is “nothing leaves for a model”.
Who does what
Two seats. One assessment.
Seat 1 · Business Liaison
Implements and evidences
Answers Stage 1, keeps the data map, generates and uploads documents, records the implementation status and evidence of each control, runs the registers day to day.
Seat 2 · GRC Liaison
Reviews and signs
Decides applicability, records a finding per control — Meets, Gap, Breach risk, Observation — opens corrective actions and signs the compliance review. May act as DPO.
Optional · RegXpert
An external consultant
Bring your own, or ask regXperience to match one. A consultant takes the GRC seat on as many client assessments as they run.
Each assessment carries one GRC seat and two Business seats. Business writes the left column of every control, GRC writes the right. Neither can write the other's.
Walkthrough on request
Book a demo and we will walk the seven stages on an organisation like yours.
See it work
A stage end to end.
Stage 1 to the first signed review
A rights request from the public portal to the ledger
The dossier and complaint pack exports
Pricing
One flat rate per assessment.
Your first assessment is free for its first month, with no card. After that, every assessment carries one flat USD rate, monthly or annual. Cancel any time, effective at the end of the period. Your records remain yours to export.
First assessment
Free
for the first month
Every stage, register and export
1 GRC + 2 Business seats
No card to start
Per assessment
US$99
/ month · or US$990 / year
Unlimited assessment cycles
Evidence stored in India
Cancel any time, effective at period end
Maintenance
US$24 / month
once the assessment is complete
Everything stays readable and exportable
Registers keep running
Two read-only seats for auditors
Bringing in an external GRC consultant? That is charged on top of the platform fee and depends on the nature of the work; ask for a rate card. Founding members of the original DPDPA Workflow keep the platform free of charge for as long as they remain members.
A bundle of 3 users — 1 GRC seat and 2 Business seats — unlimited assessment cycles, every register and all exports. First month free. Up to 3 active assessments self-service.
Need more than 3? Contact salesQuestions
The ones people ask first.
- Do we get a score?
- No. A score invites the wrong conversation. You get seven stages with honest states, a finding per control and clocks that are green or overdue. When everything reads complete, you are ready.
- Where is our data kept?
- Files you upload — evidence, attachments, generated documents, minutes — are stored in Amazon Web Services' Mumbai region. Your account, the assessment and its register rows live on the regXperience platform in Singapore. Read the full picture on the “what we keep” page.
- Is AI involved?
- Only where you turn it on, per assessment. An optional evidence reviewer reads an uploaded notice or screenshot and suggests a grade; a copy-editor tidies your template answers. Nothing leaves for a model until an authorised seat holder accepts the notice, and a strict switch turns AI off for good.
- We advise several clients.
- Create one assessment per client. Each is sealed from the others, carries its own seats and registers, and you can hold the GRC seat on every one. Up to three active assessments self-service; more through sales.
Book a demo
Want to see it on your own processing?
We will walk through the seven stages, the registers and the ledger for an organisation like yours.