A DPDP compliance platform covering every penalised obligation end to end, with every module reading the same map of your systems.
The number is always higher than the first answer, and every obligation in the Act depends on it.
A patient appears in the HIS, in billing, in pathology, in the pharmacy log, and on a paper case sheet at the counter.
A user appears in your production database, your CRM, your support desk, your analytics tool, and last week’s CSV export.
A candidate appears in the ATS, in the background-check vendor, in payroll if hired, and in a recruiter’s local spreadsheet.
The provisions that carry a penalty, each mapped to the module that meets it. The test for any DPDP automation platform: does every one have something behind it?
Keep the personal data you hold secure, with safeguards that are reasonable for what it is.
Data RegistryTell the Board without delay when a breach happens, and give the full particulars within 72 hours.
Breach ManagementGet verifiable consent from a parent before processing any child’s data.
Consent ManagementIf you are named a Significant Data Fiduciary: impact assessments, annual audit, algorithmic diligence.
Data RegistryTake consent that is free, specific and informed — and as easy to withdraw as it was to give.
Consent ManagementGive an itemised notice, in plain language, in the languages the Act requires.
Consent ManagementLet people see, correct, erase and nominate — and answer their grievances within the period.
DSR AutomationStay accountable for every processor acting on your behalf, under a written contract.
Vendor GovernancePenalties are the maximums in the Act’s Schedule and are assessed per contravention.
The same three movements, whichever module you are in.
Find out what is missing, ranked by what it costs you rather than by what is easiest to fix.
Close each gap with the clause it satisfies attached, so the work and the reason stay together.
Every action writes itself to the record as it happens. The pack is generated, not assembled.
Point tools each keep their own copy of your estate, so one system gets described five times and drifts four ways. Here there is one record.
Building a record of processing from a blank spreadsheet is what turns DPDP into a six-month project. You start from something already filled in.
Pick your hospital system, your CRM, your HRMS from a catalogue that already knows what they typically hold and how sensitive it is. Indian and global, by sector.
A hospital starts with the categories, activities and retention norms a hospital has — then edits what is different, rather than beginning at nothing.
We hold the shape of your estate — which systems, which categories, which purposes. No agents on your servers, no database credentials, no copies of anyone’s data.
Not a list of features — the whole obligation, from the first moment it applies to the evidence you hand over at the end.
Start from a vetted template rather than a blank page, publish it behind a compliance gate that will not let a non-compliant notice go live, and collect consent through a widget, a QR code, a call centre or a CSV import — all writing to the same append-only log. Withdrawal is one tap and lands in a queue with the clock already running. How consent management works
Your customers file from a branded portal with no account and no fee. Identity is verified before anything is disclosed. The request then fans out across every system your registry says holds that person’s data — which is what turns erasure from a promise into something you can show. Clocks run from the moment it lands. How rights requests are handled
The hard part of a breach is not the form, it is knowing who was in it. Because the registry already knows what each system holds, the affected cohort is derived rather than guessed. Both Rule 7 obligations are tracked separately — the immediate intimation and the full particulars at 72 hours — so neither is missed while attention is on the other. How a breach is scoped and filed
You stay accountable for every processor acting on your behalf, so the register tracks the agreement as well as the relationship. When a DPA expires or a vendor is found handling more than it was contracted for, sharing to that vendor is flagged and blocked rather than quietly continuing. How processors are governed
This is the map everything else reads. You are confirming rather than authoring: pick your systems from a catalogue that already knows what they typically hold, adjust what is different about yours, and the record of processing assembles itself. Metadata only — the records themselves never move. How the registry is built
Data that has done its job has to go, but not everything can be erased on request — a live grievance or a statutory hold outranks it. Legal holds are honoured automatically, the pre-erasure notice goes out before anything is destroyed, and the audit trail of what was erased survives the erasure itself.
The architecture is the point. We can govern your data precisely because we do not keep a copy of it.
Answer a few questions about how your organisation works and get a ranked gap list with your exposure in rupees — free, and yours to keep.
Sees everything, owns the queues, signs off the evidence. The account that answers to the Board.
Department owners confirm what their own systems hold and answer the questions that belong to them — nothing more.
An external adviser — ours or your own — works inside your tenant, with what they do recorded as theirs.
Receives an evidence pack they can verify independently, without an account and without asking you for anything.
This is not a six-month implementation, and you do not need every module on day one.
Run the free Scorecard, declare your first systems from the catalogue, and publish a notice from a vetted template. No procurement needed to get this far.
Drop the consent widget onto your site, publish the rights portal link, and start the queues. One script tag and one signed link.
Work the phased plan — vendors, retention, breach readiness — with the evidence assembling itself as you go. Re-score whenever you want to see the movement.
The Scorecard takes five minutes and needs no login. From signing up, a first consent notice can be live the same afternoon — you pick a vetted template, fill in your details and publish. The registry and the phased plan are the work of the first week or two, and you are confirming a pre-filled map rather than drawing one from nothing.
It does the work that has a clock on it. A retention date arrives and the pre-erasure notice goes out on its own; a consent is withdrawn and every downstream purpose stops; a rights request lands and the tasks fan out to each system that holds the person’s data; a breach is declared and the 72-hour Board clock starts running with the filing half-drafted. What DPDP compliance automation does not do is decide anything a person should be deciding — approving an erasure, judging a grievance, signing a Board filing. Those stay with your named people, and the platform records who did them and when. That line is the difference between privacy automation you can defend to the Board and a system that acted on its own and left nobody accountable.
No, and this is deliberate. We hold the shape of your estate — which systems you run, what categories of data they hold, which purposes they serve, who owns them. No agents on your servers, no database credentials, no copies of anyone’s records. The one exception is consent itself, where we hold the record of what was agreed, and the person is identified by a one-way hash rather than by name.
On infrastructure in India — data at rest and backups both stay in-country, which is what makes the residency conversation short. We are ISO 27001 certified. Inside your account, access is by role, and the audit log is append-only at the database level: the system will refuse an edit or a delete on it, which is enforcement rather than policy.
No. Consent, rights requests and breach logging all work from day one. The registry makes them better — a rights request that knows which systems to look in, a breach that knows who was affected — so most teams do it in the first month. You can start with the two or three systems that matter and grow the map as you go.
Over 300 systems are recognised out of the box — Indian and global, by sector — so you pick your hospital system, CRM or HRMS from a catalogue that already knows what it typically holds and how sensitive that is. Which of those you connect live, versus declare and manage, depends on your stack; that is a conversation for the demo rather than a claim on a page.
Yes. External advisors get their own access to the account they are engaged on, and an auditor gets a read-only view with the evidence and its hashes. That matters for Rule 13, which requires an independent data auditor — they need to verify your programme without us or you standing between them and the record.
You take it with you. The evidence pack is a set of ordinary files — the audit log, the notices and their versions, withdrawal and grievance records, vendor coverage — with a SHA-256 manifest anyone can re-verify independently. It is designed to be readable and checkable without our software, because evidence that only works inside one vendor’s product is not much use in front of the Board.
All ten compliance modules on this page are live and in use: consent, data principal rights, breach, vendor governance, data registry, retention and erasure, assessments, audit and evidence, the scorecard and the trust centre. The AI suite is in development and marked as such wherever it appears — we would rather show you a shipping product than a roadmap.
Real client quotes, attributed by role and sector — we never name a client.
Working across
Start with the free Scorecard, or have someone walk you through the platform with your systems on the screen.
Thank you — we have it. Someone will reply by email, usually within one working day.
Nothing else is needed from you. If it is urgent, email tushar@ruleexpert.com and it will reach the same people.
RuleExpert