The software side of DPDP compliance, built into your website, app and CRM.
The Digital Personal Data Protection Act 2023 and the DPDP Rules 2025 change how every business collects and uses personal data online. Most duties start in May 2027, and penalties go up to ₹250 crore (DPDP Act 2023, Schedule). We do the software and process work, with your lawyer: finding the data, fixing the forms, recording consent and getting your team ready for requests and breaches.
- Free 30-minute call
- Fixed quote in writing
- Code you own
What is DPDP compliance for a website or app?
DPDP compliance for a website or app means building it to support a business's duties under the Digital Personal Data Protection Act 2023 and the DPDP Rules 2025. That means clear notices, recorded consent, easy withdrawal, security safeguards, breach reporting, rights requests, retention limits and parental consent for children. Whether a business complies is decided with its lawyer.
Larger businesses already feel the pressure. Indian enterprises name regulation and compliance as their biggest barrier to AI adoption (39 per cent), and put security and compliance controls first among their investment priorities (68 per cent) (Deloitte, March 2026). The first step is small: a free DPDP gap review of your website, with a short list of what to fix.
What we build into your systems.
Not sure it is the right fit? Ask an engineer first.
Thirty minutes with a senior engineer, free and with no obligation. Bring the problem, not a brief.
What we will not do.
We do not certify compliance, and we are not your lawyer or your Data Protection Officer. Whether your business complies with the DPDP Act, and how the law applies to you, are decisions for you and your lawyer. Our part is the software and process work that supports those duties, with your lawyer reviewing the gap list, the notices and the contracts. When a question needs legal advice, we say so and stop there.
Read our guide to the DPDP ActReady for requests and incidents.
Until May 2027, today's rules still apply.
The rule on consent managers starts in November 2026 and the main DPDP duties in May 2027. Until then, section 43A of the IT Act 2000, the SPDI Rules 2011 and the CERT-In Directions of April 2022 still apply, including 6-hour incident reporting and 180-day logs. We plan the work so it supports your duties today and is ready for May 2027. Dates can change by notification, so we recheck them with your lawyer before planning.
How we handle security and dataHow the work runs.
A notice people can actually read.
Our own privacy policy is written the same way. It says what we collect, the basis for each use, how long we keep it, the rights people have and how to reach our Grievance Officer. Read it as a working example of a plain-language notice, then ask your lawyer what yours needs to say.
Read our privacy policyOften built alongside it.
Frequently asked questions.
When do the DPDP Rules apply?
In phases. The Rules were notified in November 2025, when the provisions on the Data Protection Board started. The rule on consent managers starts in November 2026, and the main duties, such as notice, consent, security, breach reporting and rights, start in May 2027. Until then, section 43A of the IT Act, the SPDI Rules and the CERT-In Directions apply.
Do small businesses need to comply?
Yes. The Act applies to any business that processes digital personal data, whatever its size, including through a contact form on a small website. The government can exempt notified classes of businesses, including some startups, from certain duties. Do not assume an exemption applies until your lawyer confirms that a notification covers you.
What is a consent manager?
A consent manager is a platform registered with the Data Protection Board of India that lets people give, review and withdraw their consent to different businesses from one place. It must be a company incorporated in India with a net worth of at least ₹2 crore. The rule on consent managers starts in November 2026.
Can you make us DPDP compliant?
No supplier can, and we will not claim to. We do the software and process work that supports your duties: data mapping, notices, consent logs, rights workflows, security safeguards and breach runbooks. Your lawyer advises on what the law requires of you, reviews our gap list and approves the notices. Compliance stays your decision.
How quickly must we report a data breach?
Under the CERT-In Directions, which apply today, report listed cyber incidents, including data breaches and data leaks, to CERT-In within 6 hours of noticing them. From May 2027, the DPDP Rules also require you to tell affected people and the Data Protection Board without delay, and to send the Board a detailed report within 72 hours.
How is it priced?
The free DPDP gap review of your website comes first. After it, you get a fixed, itemised quote in rupees for the fixes, with any GST shown separately, paid in milestones. Businesses with apps, CRMs and many vendors get a quote after a short discovery. Your lawyer's fees and any consent manager's charges are separate.
Still have a question? Call +91 99966 88404 and speak to an engineer.