DPDP: the framework that touches every other one.
Data privacy isn't a compliance checkbox anymore, it's a condition of doing business in India. Fast-moving product teams keep shipping new fields and new vendors faster than anyone can track what's actually personal data - and that gap is exactly where the DPB looks first.
What breaks here
Pseudonymization used as scope evasion
A hashed mobile number still identifies someone. DPDP's S2(t) test is about whether something CAN be identified, not what label you put on the field. India has roughly 4 billion possible mobile numbers - a rainbow table doesn't care which hash you chose.
xmobile_hash: { classification: "non-pii", basis: "sha256" }✓mobile_hash: { classification: "pii", basis: "S2(t) - identifiable via rainbow table" }The undisclosed recipient
A processor gets named in the DPA. It never gets named in the consent notice the user actually saw.
xShared with: [our verification partner]✓Shared with: Acme KYC Services Pvt Ltd, for identity verificationThe retention job that stopped
It ran fine for eight months. Nobody noticed when it silently stopped on release 14.
xlast_run: 2026-03-14 (142 days ago)✓last_run: today - schedule restored, backlog purgedSix motions, in DPDP's own language
Regulator Monitor
Every DPDP Rules amendment and MeitY notification, ingested the day it lands.
Compliant by Design
A PR that adds a new field touching personal data gets flagged before merge - not after the next audit.
Posture Drift
The masking field that flipped. The retention job that stopped. Reported as a delta, not rediscovered from scratch.
Interpretation
Letter: what S2(t) says. Spirit: what the Data Protection Board actually intends by “identifiable.” Both, cited.
Evidence Room
What's processed, on what basis, what changed. Assembled continuously, not scrambled together the week before a DPB inquiry.
Exceptions & Overrides
A deferred fix gets an owner and an expiry. Nothing rides to production as an anonymous “fix later.”
The modules doing the work
Every DPDP obligation below traces back to one of these five - not scattered across five different tools.
RoPA
Self-service processing-activity records, auto-connected to the live data inventory. Real-time compliance scoring, children's-data flags, and cross-border exposure alerts as processors change.
Smart DPIA
Feed in a PRD or a data-flow diagram and get a structured impact assessment - a 0-100 risk score, an Algorithm Risk Card, and a Board Report pre-formatted for Rule 13(2).
Breach Notification
The 72-hour clock starts itself, populated from the same data inventory. Board Phase 1/2 reports and Data Principal notifications run off the same workflow, not a separate scramble.
Consent Manager
Per-purpose consent, captured once and tracked through withdrawal, expiry, and renewal. A DSAR dashboard and grievance workflow sit on the same registry.
Data Discovery
Auto-classification across 100+ sources - Postgres, BigQuery, Databricks, and more - so RoPA, consent, and breach response all work off one inventory, not five spreadsheets.
Ready to get DPDP-ready?
Start Free Assessment
Run the free DPDP self-assessment on your own product - a maturity band and a prioritized gap list in 10 minutes.
Start the assessment →Review Results & Action Plan
See exactly what's flagged, cited to letter and spirit, with an owner, an effort tier, and what good looks like for each gap.
Launch & Stay Compliant
The Watch keeps running after launch - regulator monitor, posture drift, and the evidence room - so gaps get caught the day they open, not the week of an audit.