Not because they are dishonest. Because nobody sat them down and explained every section, every obligation, every penalty, and every deadline in a language that is not legislation.
“This ecosystem is that explanation.”
The Digital Personal Data Protection Act is not a recommendation. It is a deadline. The organisations that treat it as a future problem are already behind the organisations that treated it as today's priority.
We built this ecosystem because the law deserves better than a PDF summary. It deserves an intelligence system.
Each vertical is a complete knowledge system. Click any card. It takes you directly into the intelligence.
Section by section commentary. Written by lawyers who advise boards, not researchers who read statutes.
The Act read alongside its subordinate rules. The mapping that turns legislation into operational reality.
Penalty intelligence. GDPR enforcement as a predictor of where DPDPA will strike first.
Six jurisdictions compared. GDPR, PDPL, UAE, UK GDPR, Singapore PDPA. Every transfer clause and adequacy gap mapped.
12 proprietary frameworks coined from 27 years of practice. The language the market did not have before we gave it to them.
Consent notices. Privacy policies. DPIA templates. Breach notification protocols. Board resolution formats. Ready to deploy.
The same law applies to a 10 person startup and a 10,000 person enterprise. This hub makes the difference survivable.
Original analysis as developments happen. Not aggregation. Practitioner opinion on what each development means for your compliance.
Where your industry stands. Where India stands relative to global benchmarks. The readiness picture nobody else is publishing.
That tells us something. You are not browsing. You are looking for a law firm that thinks the way you need them to think.
Begin a conversation →Ask your current privacy advisor this question: what is the difference between the Privacy Dividend and Consent Capital? If they do not know, they are not reading the same literature your regulator will.
Original frameworks. Not borrowed ones.Each doctrine is a lens we coined from 27 years of practice. The market uses our language now. This is where it started.
Your company processes data across borders. The law does not stop at borders. Neither should your advisor.
We mapped nine jurisdictions obligation by obligation. Not because it is impressive. Because your next regulator will ask you to prove exactly this.
Discuss cross border exposure →| Dimension | DPDPA (India) | GDPR (EU) | UK GDPR | PDPL (Saudi) | UAE Data Law | PDPA (Singapore) | PIPL (China) | LGPD (Brazil) | POPIA (S. Africa) |
|---|---|---|---|---|---|---|---|---|---|
| Consent Model | Free, specific, informed, unambiguous | 6 lawful bases incl. consent | Mirrors EU with UK variation | Explicit consent required | Consent or legitimate interest | Consent with deemed option | Separate consent for sensitive | 10 lawful bases | Justification conditions |
| Data Localisation | Transfer restricted by govt notification | Adequacy, SCCs, BCRs | UK adequacy, IDTA | Localisation with exceptions | Adequacy or contract | Transfer via prescribed means | Strict localisation | Adequacy or contract | Adequacy or binding rules |
| Breach Notification | To Board and Data Principal | 72 hours to DPA | 72 hours to ICO | Specified period to authority | Without undue delay | PDPC as soon as practicable | Immediate to authority | Reasonable time | As soon as reasonably possible |
| Maximum Penalty | ₹250 Cr per instance | €20M / 4% turnover | £17.5M / 4% turnover | SAR 5M | AED 10M | SGD 1M per breach | RMB 50M / 5% revenue | BRL 50M / 2% revenue | ZAR 10M / imprisonment |
| DPO Requirement | Significant Data Fiduciary only | Mandatory for certain | Mandatory for certain | Required for certain | Required for certain | Mandatory for prescribed | Threshold processing | Recommended | Information Officer |
| Children's Data | Verifiable parental consent, no tracking | Parental consent under 16 | Parental consent, varies | Parental consent required | Guardian consent | Consent for under 13 | Separate consent under 14 | Best interest standard | Competent person consent |
A hospital and a fintech face the same Act. They do not face the same obligations. A compliance programme that ignores sector context is a compliance programme that will fail under scrutiny.
Eighteen sectors. One law. No two implementations alike.Patient data, clinical trials
Banking, insurance, finance
Software, BPO, cloud
Retail, marketplace, D2C
Student data, platforms
Employee data, IoT
Subscriber data, CDR
Tenant data, RERA
Drug trials, registries
PNR data, profiling
Smart meters, consumer
Cargo data, ports
User profiling, content
Aadhaar, welfare data
Labour Codes overlap
Behaviour, geolocation
Farmer data, AgriTech
Due diligence, cap tables
Two hundred and fifty crore rupees. Per instance. Not per year. Not per breach. Per instance. That is not a fine. That is an extinction event for a mid sized company.
The organisations that understand this number are already talking to us. The ones that do not are still comparing compliance vendors.
DPDPA Section 33. Per instance. The number that changes boardroom conversations.
₹250 CrPer instance cap under ScheduleOver 2,000 enforcement actions since 2018. The penalty arc is documented. India will follow it.
2,086+GDPR enforcement actions to dateMost Indian organisations are treating DPDPA as a future obligation. The window is present tense.
<15%Estimated material readinessWe know the difference between a company that is reading about compliance and a company that is ready to act on it.
The first conversation is not a sales pitch. It is a structured review. We listen. We map. We tell you where you stand and what to do next.