Understanding the Difference
in DPDPA Implementation.
There is no shortage of firms that will provide a DPDPA compliance certificate. There is a considerable shortage of firms that will build a system capable of withstanding a Board inquiry. This page presents the distinction so you can make an informed decision.
Consent Architecture
Banner-level cookie consent. A pop-up on the website. A checkbox that says “I agree.” The compliance team considers it done. The board signs off.
Full-stack consent lifecycle — from initial capture through granular withdrawal, downstream propagation, and audit-grade evidence trails. Consent is not a single moment. It is an architecture that the Data Protection Board will actually examine.
Obligation Mapping
A compliance checklist. Perhaps a spreadsheet. Forty line-items reviewed by an associate. The client receives a certificate on letterhead. Filed and not revisited.
Obligation topology — every statutory duty under DPDPA 2023 and the DPDP Rules mapped to specific data flows, business processes, and accountability nodes within your organisation. Not a list of what the law says — a map of where your exposure lies.
Breach Preparedness
A template incident response policy. Perhaps a flowchart. Rarely rehearsed. The relevant teams find out the specifics when the situation arises.
Tested protocols with 72-hour DPBI notification workflows, 6-hour CERT-In reporting pathways, forensic triage trees, privilege-protected communication channels, and quarterly simulation drills. When a breach occurs, the question is speed of response — not readiness.
Rights Fulfilment
An email address on the privacy policy page: “For data subject requests, write to [email protected].” Someone in the organisation may respond within a reasonable period.
Structured rights-fulfilment process — intake triage, identity verification, cross-system data retrieval, erasure propagation, response SLA tracking, and Board-defensible evidence of fulfilment. The DPBI expects documented fulfilment, not informal acknowledgement.
Board Governance
A compliance summary presented at the quarterly board meeting. A few slides. The DPO was appointed recently and reports to the IT head.
Continuous governance architecture. Inviolum Pulse Score (VPS) dashboards. Board-ready reporting cadence. Independent audit trails. DPO with direct board access. Compliance is not a quarterly topic — it is a continuous organisational posture that the Board is responsible for.
“A privacy policy is not a privacy programme. A checklist is not a system. A certificate is not a defence. If your compliance cannot withstand scrutiny, it requires re-examination.”
Frequently Asked Questions
See the Difference in Practice
A confidential assessment begins with one conversation. No obligations, no templates, no generic proposals.
Assess Your Posture