The Data Protection Board
does not distinguish
between organisations
that did not know
and organisations that
did not act.
Thirteen practice areas. One framework. Every engagement produces a documented, operative, defensible legal position — built before the Board looks, not in response to its notice.
Based on AMLEGALS gap assessments 2024–2025: most organisations have addressed fewer than ten of the forty-four operative DPDPA sections.
Statutory Mapping
All 44 sections. Every processing activity. Gap Matrix and exposure quantification.
Consent Architecture
Rule 3-compliant. Product by product. Language by language.
Governance Design
Board accountability. DPO mandate. Executed DPA with every processor.
Technical Integration
Security safeguards to Rule 6. Tested breach protocol.
Continuous Intelligence
DPB monitoring. Regulatory updates. Programme adapts with the business.
Build for trajectory, not the snapshot
A programme measured by where it will be when tested — not when assembled.
Governance absorbs what documentation cannot
A filing exercise without operational governance is not a programme.
Enforcement learns. So must the programme.
The Board’s practice is forming now. The programme that does not monitor will be surprised.
Legal certainty is the product
Every engagement produces a documented, defensible legal position. Not a report.
Three functions. Three specific exposures.
One regulatory framework that applies to all.
The services below are the answer to these three problems. The problem is stated first because that is the only honest order.
data processing agreement clause.
Section 8(2) requires a written contract with every processor. One hundred percent of legacy contracts are non-compliant from day one. A vendor breach without a valid DPA is the organisation’s breach — and the GC’s accountability.
in most Indian balance sheets.
One breach event can trigger ₹250Cr plus ₹200Cr plus ₹150Cr simultaneously. The compound event is a ₹600Cr exposure. The auditors will ask why it was not on the risk register before the breach — not after it.
after the breach — not by you before it.
Section 8(5) says “reasonable security safeguards.” The Board defines reasonable retrospectively. The CISO who cannot produce a documented rationale for every security decision has not built a defence. They have built a gap.
One breach. Multiple simultaneous violations. The organisations with documented compliance programmes are the ones whose first Board response produces a compliance undertaking — not a penalty.
DPB Update Q1 2026: The Data Protection Board has issued its first operational guidelines. Enforcement practice is forming now. The organisations building their compliance record today will be the ones with documented evidence when the first major penalty is announced.
No compliance programme exists without these six.
Every organisation processing personal data in India must have these six elements operative — not planned, not drafted, operative. The Data Protection Board’s first question at any inquiry is whether the foundation exists.
DPDPA Full Spectrum Implementation
Not templates. A compliance architecture a DPB investigation would find operative — consent records, safeguards, agreements, governance. All functioning. All documented.
Gap Analysis and Readiness Assessment
Built without a Gap Analysis, your programme rests on assumptions. Every gap identified, every exposure quantified, remediation sequenced.
- 44-section statutory mapping
- Quantified exposure per gap
- Sequenced remediation plan
Consent and Notice Architecture
A notice that does not meet Rule 3 is not a notice. We design consent architecture product by product, language by language.
- Rule 3-compliant notice drafting
- Product-specific consent flows
- Consent withdrawal mechanisms
Data Security Safeguards
Rule 6 prescribes the standard. We measure your architecture against it and produce the written compliance record.
- Rule 6 architecture review
- Vendor security assessment
- Remediation opinion letter
Data Processing Agreements
A GDPR template does not satisfy the DPDP Rules. We draft to your specific data flows. None templated.
- DPDPA-compliant DPA drafting
- Complete vendor DPA library
- Processor audit obligations
Data Principal Rights Infrastructure
Rights granted must be honoured. We build the operational framework — not the policy document.
- Rights request workflow
- Response timeline protocols
- DPB notification procedures
Every transaction, transfer, and technology decision has a DPDPA dimension.
M&A transactions, cross-border data flows, SDF classification, AI governance, sector-specific overlays — each creates a DPDPA obligation the parties have not yet addressed. These eleven services address them.
Transaction Support and M&A Privacy
We find the liability before the deal closes and structure to ring-fence it. Not after.
- Privacy due diligence review
- Liability quantification
- Deal structure advisory
Contracts and Documents
Every instrument drafted to the specific processing relationship. None templated.
- Privacy policy suite
- Consent documentation
- Vendor agreement library
Training and Awareness
Architecture fails when the person handling data does not understand why it matters. Real scenarios — not slides.
- Board and C-suite briefings
- Operational scenario exercises
- Documented training records
Privacy Due Diligence for Investors
Does the programme exist? Does it work? What is the Schedule I exposure? The report goes to the investment committee — not a folder.
- DPDPA health check
- Schedule I exposure quantification
- Compliance maturity scoring
International Data Privacy
One firm. One framework. Both sides of every international data relationship — GDPR to PDPL to DPDPA.
- Six-jurisdiction advisory
- Combined DPDPA DPA and GDPR SCCs
- Both-sides transfer mechanisms
AI Governance and Data Privacy
AI systems process personal data. The DPDPA governs it. We build the governance framework the algorithmic rider demands.
- AI processing legal basis
- Algorithmic rider compliance
- Automated decision framework
SDF Classification Assessment
The Central Government classifies — not the organisation. We assess your exposure before the notification arrives.
- Classification criteria analysis
- Data volume and sensitivity audit
- Pre-notification structuring
DPO Appointment, Data Audit and DPIA
Three statutory SDF obligations — DPO appointment as KMP, independent data audit, and periodic DPIA — each requiring documented legal instruments.
- DPO mandate and governance
- Audit readiness programme
- Full DPDPA standard DPIA
Cross-Border Data Transfers
Section 16 permits the transfer. It does not remove the receiving jurisdiction’s law. We resolve both sides of every corridor simultaneously.
- India-EU: DPDPA DPA and GDPR SCCs combined
- ASEAN corridor documentation
- Sector localisation resolution
Sector-Specific DPDPA Advisory
Every regulated sector carries a compliance overlay on top of the DPDPA. Each conflict must be resolved before two enforcement authorities pursue the same breach.
- BFSI: multi-regulator coordination
- Healthcare: DISHA and DPDPA mapping
- EdTech: Section 9 verifiable consent
Startup Privacy by Design
Retrofitting compliance costs multiples of building it correctly from the start. Privacy by design from day one — investor-ready, lean, scalable with the business.
- Privacy by design architecture
- Investor due diligence package
- Enterprise procurement readiness
The first response to a Board notice determines the outcome.
The Data Protection Board is operational. Enforcement practice is forming now. These six services address what happens when the Board is watching — or has already made contact.
Data Breach Response
Notifiability. DPB notification. Sector regulatory coordination. Managed through to closure. The obligation is immediate. The organisation without a prepared response protocol spends the notification window on organisation, not notification.
DPB Show Cause Response
The first response to a DPB notice determines whether the outcome is a compliance undertaking or a penalty. We draft it on fact and law — not procedural delay.
- Show cause response drafting
- Mitigation strategy
- DPB correspondence management
Appellate Tribunal Representation
The DPB record determines the appellate case. The quality of the first-instance proceedings is the quality of the appeal.
- Grounds of appeal drafting
- Written submissions
- Oral advocacy at Tribunal
Compliance Posture Review
Legal certainty is the product. Documentation assembled in response to a notice is not a programme.
- Existing programme audit
- Documented gaps remediated
- Board-presentable posture report
DPO as a Service
Not vendors. Not quarterly visitors. Named practitioners embedded in your compliance structure who happen to sit at AMLEGALS.
- Named DPO practitioner
- Board governance attendance
- PRAMAANA™ evidence maintenance
Annual DPDPA Retainer
Your primary DPDPA adviser throughout the year — monitoring, advising before launch, ensuring your programme leads the regulatory environment rather than chasing it.
- Regulatory monitoring and alerts
- New processing activity review
- Annual board compliance report
Three outcomes. One sentence each.
Sector. Situation. Result. Timeframe.
No other words are needed. The outcome sentence is the only sentence a GC or CFO actually reads.
“A private sector bank with 4.2 million retail accounts implemented DPDPA-compliant consent architecture, vendor DPA library, and board governance framework in eleven weeks — and cleared its first DPB audit without a single remediation notice.”
“A pharmaceutical company facing a DPB show cause notice received a compliance undertaking — not a penalty — within six weeks. The AMLEGALS evidence file, built before the notice arrived, was the deciding document in the Board’s determination.”
“A technology company with 2.8 million users embedded AMLEGALS as their standing DPO. Series B investor due diligence cleared in one week. The PRAMAANA™ evidence package was the reason the investment committee did not raise a single compliance question.”
Six client types. Six different statutory positions.
The obligation is identical. The architecture differs. The consequence of inaction is specific to each.
Foreign Companies in India
DPDPA applies to every organisation processing personal data of Indian data principals — regardless of where incorporated. The first DPB notice before a programme exists sets the penalty at the maximum. There is no mitigation without prior documentation.
MNCs and Large Corporates
SDF classification is determined by the Central Government — not the organisation. It arrives without warning. The compliance programme the classification requires must exist before the notification. Not after it.
Startups and Scale-Ups
DPDPA obligations begin from user one. Not from Series B. Not from profitability. A DPDPA gap discovered in Series B due diligence does not delay the round. It kills it — in a legal memo no one shows you until the term sheet is pulled.
BFSI, Healthcare and Telecom
One breach event triggers simultaneous notification obligations to the DPB, RBI, IRDAI, and SEBI. Four enforcement authorities. Four different timelines. Four different formats. One point of instruction.
Investors and VCs
73% of Indian VC and PE due diligence checklists now include DPDPA compliance as a specific line item. An unquantified DPDPA liability is a valuation risk that the next funding cycle will price — whether you have quantified it or not.
SMEs and Professional Services
There is no size exemption in DPDPA. The obligation applies from the first act of processing. The penalty under Schedule I is not proportionate to size. The obligation is identical to an enterprise. The Board does not distinguish.
“Every organisation will eventually answer to the Data Protection Board. The only question is whether they answer from a position of documented compliance — or documented absence of it.”Anandaday Misshra · Founder and Managing Partner, AMLEGALS
The compliance record that holds when the Board looks
is built before they look.
Thirteen practice areas. Three tiers. One framework. Every engagement produces a documented, operative, defensible legal position.