The Industry Sells Comfort.
Be Cautious in DPDPA Implementation.
There is no shortage of firms that will hand you a DPDPA compliance certificate. There is a considerable shortage of firms that will build you a system that survives a Board inquiry. This page exists so you can see the difference before you engage either.
Consent Architecture
Banner-level cookie consent. A pop-up on the website. A checkbox that says "I agree." The compliance team breathes easy. The board signs off.
Full-stack consent lifecycle — from initial capture through granular withdrawal, downstream propagation, and audit-grade evidence trails. Consent is not a moment. It is an architecture. We build the plumbing that the Data Protection Board will actually examine.
Obligation Mapping
A compliance checklist. Perhaps a spreadsheet. Forty line-items ticked off by a junior associate. The client gets a "Compliance Certificate" on letterhead. Filed, forgotten.
Obligation topology — every statutory duty under DPDPA 2023 and the Draft Rules mapped to specific data flows, business processes, and accountability nodes within your organisation. Not a list of what the law says. A map of where your exposure lives.
Breach Preparedness
A template incident response policy. Perhaps a flowchart. No one has rehearsed it. No one knows which server logs matter. The CTO finds out when the regulator calls.
War-room tested protocols with 72-hour DPBI notification workflows, 6-hour CERT-In reporting pathways, forensic triage trees, privilege-protected communication channels, and quarterly simulation drills. When the breach happens, the only question is speed — not readiness.
Rights Fulfilment
An email ID on the privacy policy page: "For data subject requests, write to [email protected]." Someone in HR might respond within a fortnight.
Engineered rights-fulfilment engine — intake triage, identity verification, cross-system data retrieval, erasure propagation, response SLA tracking, and Board-defensible evidence of fulfilment. Because the DPBI does not accept "we’ll get back to you" as a defence.
Board Governance
A compliance summary presented at the quarterly board meeting. Two slides. No one asks difficult questions. The DPO was appointed last month and reports to the IT head.
Continuous governance architecture. Vibe Pulse Score (VPS) dashboards. Board-ready reporting cadence. Independent audit trails. DPO with direct board access. Compliance is not a quarterly topic — it is a continuous organisational posture that the Board owns.
“A privacy policy is not a privacy programme. A checklist is not a system. A certificate is not a defence. If your compliance cannot survive cross-examination, it is not compliance.”
Frequently Asked Questions
Ready to See the Difference in Practice?
A confidential assessment begins with one conversation. No obligations, no templates, no generic pitches.
Assess Your Posture