ControlCase

IT Certifications, Continuous Compliance and Cybersecurity Services Provider

DPDP

Prepare your organization for
India's DPDP Act

The DPDP Act establishes India's comprehensive framework for protecting digital personal data, setting out the obligations of Data Fiduciaries and the rights of Data Principals. The DPDP Rules, 2025, fully operationalize the Act with an 18-month phased compliance timeline. ControlCase independently assesses your readiness against each obligation and tracks remediation until you are ready.

Schedule a Consultation

Assess Once, Comply to Many

Meet Seven Core Principles

The Act is guided by consent and transparency, purpose limitation, data minimization, accuracy, storage limitation, security safeguards, and accountability.

Use Your Transition Time

The DPDP Rules provide an 18-month phased compliance timeline, allowing organizations time to transition smoothly.

Breach Notification Readiness

In the event of a personal data breach, Data Fiduciaries must promptly inform affected individuals in plain language, covering the nature and consequences of the breach, remediation steps, and contact details.

One Assessment, Two Outcomes

DPDP Readiness and ISO/IEC 27701 Certification. ISO/IEC 27701:2025, published in October 2025, is now a standalone, certifiable Privacy Information Management System (PIMS) standard. Its controller and processor requirements cover much of what the DPDP Act asks for: privacy notices and consent, Data Principal rights, retention and disposal, privacy impact assessments, processor contracts and cross-border transfers. Rule 6's security safeguards align with ISO/IEC 27001 controls. As an ISO/IEC 27701 certification body, ControlCase can assess your DPDP readiness and your PIMS in one engagement, gathering evidence once. The result is an internationally recognised certificate alongside your DPDP assessment report. DPDP-specific requirements, such as the 72-hour report to the Data Protection Board, verifiable parental consent, the 90-day grievance window and one-year log retention, are tested in addition to the standard.

What is the DPDP Act?

What is the DPDP Act?

The Digital Personal Data Protection Act was enacted by the Parliament of India on 11 August 2023. It establishes a comprehensive framework for protecting digital personal data, defining the obligations of entities handling such data (Data Fiduciaries) and the rights and duties of individuals (Data Principals). It follows the SARAL design, meaning Simple, Accessible, Rational, and Actionable, using plain language and illustrations to support ease of understanding and compliance.

The Government of India notified the DPDP Rules, 2025 on 14 November 2025, marking full operationalization of the Act. The Rules require Data Fiduciaries to issue clear, simple, standalone consent notices explaining the specific purpose of collection and require that Consent Managers be Indian companies. The Data Protection Board functions as a fully digital institution where citizens file and track complaints online through a dedicated platform and mobile app, with appeals lying to the Appellate Tribunal, TDSAT.

Data Fiduciaries must obtain verifiable consent before processing children's personal data, with limited exemptions for essential purposes such as healthcare, education, and real-time safety. For people with disabilities who cannot make legal decisions even with support, consent must be provided by a lawful guardian verified under applicable laws.

Why Choose ControlCase for DPDP Assessment?

On-the-Ground India Presence
ControlCase serves clients globally from locations across North America, Europe, Latin America, Asia/Pacific, Australia, and the Middle East, and lists dedicated India contact numbers for both general and sales inquiries. DPDP is an Indian law with an Indian regulator, and local presence matters when the Data Protection Board operates as a fully digital institution.
An Established Privacy Assessment Practice
ControlCase already runs privacy assessments under ISO 27701:2025, GDPR and HIPAA as published services. DPDP's core obligations, consent and transparency, purpose limitation, data minimization, breach notification, and individual rights requests, map closely to what Ground ControlCase already covers.
One Audit and Control Mapping
ControlCase's Compliance Hub TM solution provides control mapping for other standards and regulations out of the box. For organizations subject to DPDP alongside GDPR, ISO 27701, ISO 27001, or PCI DSS, the One Audit approach aligns evidence collection across frameworks instead of running each assessment separately.
Built for a Phased Timeline
The DPDP Rules provide an 18-month phased compliance timeline, which suits a continuous approach rather than a single point-in-time audit. ControlCase's Continuous Compliance services are designed to reduce time, cost, and burden by making compliance an ongoing process.

Data Fiduciary Obligations Under DPDP

Who Must Comply and What Is Required?

Category 1
Data Fiduciaries

All entities handling digital personal data must issue standalone, clear consent notices, display contact information for a designated officer or Data Protection Officer, notify individuals of personal data breaches, and respond to Data Principal requests within 90 days.

Category 2
Significant Data Fiduciaries

Enhanced obligations include independent audits, impact assessments, and stronger due diligence for deployed technologies. They must also comply with government-specified restrictions on certain categories of data, including localization where required.

Category 3
Consent Managers

Entities that help individuals manage their permissions. These must be Indian companies.

The Act applies to every Data Fiduciary processing digital personal data in India, and to processing outside India connected with offering goods or services to people in India. The Rules phase in over 18 months from notification.

ControlCase DPDP Assessment Process

STEP 01
Scoping and Documentation
ControlCase collects the documentation needed to define scope: a personal data inventory and data flow diagrams, privacy notices and consent records, network diagrams of systems processing personal data, encryption and key management policy, access control policy, logging and monitoring procedures, data retention and erasure procedures, backup and recovery plans, incident response and breach notification procedures, grievance redressal procedures, and Data Processor contracts. Standard templates are provided on request.
STEP 02
Environment and Control Review
ControlCase reviews the technology and security features of systems processing personal data, maps data flows to Data Processors and any transfers outside India, examines access points and network components for security shortcomings, and verifies that documented controls meet each applicable obligation in the Act and Rules. This includes interviews with company personnel to determine what is in place and where remediation is required.
STEP 03
Vulnerability and Penetration Testing
ControlCase runs vulnerability scans and penetration tests against systems processing personal data to validate that the reasonable security safeguards required by Rule 6 have been attained.
STEP 04
Remediation Plan and Tracking
Gap analysis findings become a remediation plan identifying the obligations and controls to address, prioritized by penalty exposure and the 13 May 2027 deadline. ControlCase then tracks all remediation efforts and provides a monthly status report while you implement the controls.
STEP 05
Onsite Assessment and Quality Assurance
ControlCase deploys an assessment team to carry out the onsite portion of the assessment, including a breach-response walkthrough against the 72-hour reporting requirement, then completes its internal quality assurance procedures before any report is issued.
STEP 06
Assessment Report and Readiness Statement
ControlCase issues your DPDP Data Protection Impact Assessment Report, with findings mapped to each section of the Act and Rule, an executive summary for your board, and, for Significant Data Fiduciaries, observations structured to support the annual report to the Data Protection Board under Rule 13.
STEP 01
Scoping and Documentation
ControlCase collects the documentation needed to define scope: a personal data inventory and data flow diagrams, privacy notices and consent records, network diagrams of systems processing personal data, encryption and key management policy, access control policy, logging and monitoring procedures, data retention and erasure procedures, backup and recovery plans, incident response and breach notification procedures, grievance redressal procedures, and Data Processor contracts. Standard templates are provided on request.
STEP 02
Environment and Control Review
ControlCase reviews the technology and security features of systems processing personal data, maps data flows to Data Processors and any transfers outside India, examines access points and network components for security shortcomings, and verifies that documented controls meet each applicable obligation in the Act and Rules. This includes interviews with company personnel to determine what is in place and where remediation is required.
STEP 03
Vulnerability and Penetration Testing
ControlCase runs vulnerability scans and penetration tests against systems processing personal data to validate that the reasonable security safeguards required by Rule 6 have been attained.
STEP 04
Remediation Plan and Tracking
Gap analysis findings become a remediation plan identifying the obligations and controls to address, prioritized by penalty exposure and the 13 May 2027 deadline. ControlCase then tracks all remediation efforts and provides a monthly status report while you implement the controls.
STEP 05
Onsite Assessment and Quality Assurance
ControlCase deploys an assessment team to carry out the onsite portion of the assessment, including a breach-response walkthrough against the 72-hour reporting requirement, then completes its internal quality assurance procedures before any report is issued.
STEP 06
Assessment Report and Readiness Statement
ControlCase issues your DPDP Data Protection Impact Assessment Report, with findings mapped to each section of the Act and Rule, an executive summary for your board, and, for Significant Data Fiduciaries, observations structured to support the annual report to the Data Protection Board under Rule 13.

Ready to Prepare for DPDP Compliance?

Book Expert Time
Chat with an Advisor Available now
Chat with our representative
Compliance Advisor
Compliance Advisor HUMAN · LIVE
Online now · Replies within 2 minutes
Privacy Policy
Powered by HubSpot