Governance, Risk & Compliance
A DPDP Act compliance consultant in India is dealing with a regime that is genuinely different from GDPR, not a translation of it. The Digital Personal Data Protection Act, 2023 is built around notice and consent, it introduces the Consent Manager, it treats verifiable parental consent for children as a hard requirement, and its penalties are set per duty in a Schedule rather than as a percentage of turnover.
If you have already done GDPR work, a great deal transfers: the data inventory, the security measures, the rights machinery. What does not transfer is the specific shape of Indian obligations: the itemised notice, the grievance redressal officer, the reporting of every personal data breach without a risk threshold, and the additional duties that attach if you are notified as a Significant Data Fiduciary.
We work from the data inventory outward, the same way, and build the obligations the Act actually imposes on a Data Fiduciary. Where you also serve EU customers, run it alongside GDPR on one governance layer; where you want it certifiable, ISO 27701 is the management system.
Why you need it
01 / 06The Act is built around consent as the primary ground for processing, supported by an itemised notice describing the personal data and the purpose, available in English and in the Eighth Schedule languages. Consent must be free, specific, informed, unconditional, unambiguous and as easy to withdraw as to give.
The Act requires a Data Fiduciary to give intimation of a personal data breach to the Data Protection Board and to each affected Data Principal. There is no materiality threshold of the kind GDPR provides, which makes detection and an actual reporting process a compliance requirement rather than a good practice.
Processing a child's personal data requires verifiable consent from a parent or lawful guardian, and tracking, behavioural monitoring and targeted advertising directed at children are prohibited. Any consumer service with users under eighteen has to solve this deliberately.
Entities notified as Significant Data Fiduciaries must appoint a Data Protection Officer based in India, appoint an independent data auditor, and carry out periodic data protection impact assessments and audits. Whether you are notified depends on volume, sensitivity and risk factors under the Act.
Instrument
02 / 06The Schedule to the Act sets a separate maximum penalty for each duty. Select the ones you could not evidence today.
What we deliver
03 / 06Every category of digital personal data you process, its source, purpose, recipients, storage location and retention, and a determination of your role as Data Fiduciary or Data Processor for each activity, since the duties differ.
Itemised notice meeting the Act's requirements, consent capture that is specific to purpose, withdrawal that is as easy as giving and actually propagates through your systems, and a consent record that can be produced as evidence. Includes readiness for Consent Manager integration.
Procedures for the rights the Act grants (access to information about processing, correction, completion, updating and erasure, grievance redressal, and nomination) with the timelines tracked and responses evidenced.
A published, working grievance mechanism with a responsible person, defined response timelines, and records. A Data Principal must exhaust this before approaching the Data Protection Board, which makes it both an obligation and your first line of defence.
The detection capability to know a breach has occurred, and the process to give intimation to the Board and to affected Data Principals, because a reporting obligation without monitoring behind it cannot be met.
Where you are notified or expect to be: an India-based Data Protection Officer, independent data auditor arrangements, periodic data protection impact assessments and audits, and the additional governance those duties imply.
How we run it
04 / 06Identifying and classifying the digital personal data you collect, process and store, with data flows and a Fiduciary or Processor determination per activity. Interview-led, because the flows that matter are rarely documented.
Weeks 1-4Reasonable security safeguards to prevent a personal data breach (encryption, access control, logging, retention and deletion) proportionate to the data and evidenced, since the Act imposes this as a distinct duty with its own penalty.
Months 1-3Itemised notices describing the personal data and the purpose, available in English and the Eighth Schedule languages, with internal policies that make the notice accurate.
Month 2Consent capture meeting the Act's standard, granular by purpose, recorded as evidence, withdrawable as easily as given, with the downstream deletion and processing-stop that withdrawal implies.
Months 2-3Request handling for access, correction, erasure and nomination, plus a published grievance mechanism with a named responsible person and tracked timelines.
Month 3Periodic review of processing against consent and notice, breach detection and reporting readiness, and, for Significant Data Fiduciaries, impact assessments and independent audits on the required cadence.
OngoingKey benefits
05 / 06A record of what each Data Principal was told and agreed to, when, and what happened when they withdrew, which is the evidence the Board would ask for.
Detection and a defined intimation process, so an obligation that applies to every breach can actually be met rather than discovered as a gap during one.
A working grievance mechanism handles issues internally, which is both a duty under the Act and the step a Data Principal must exhaust first.
Tools we use
06 / 06No “latest tech tools”. These are the ones your report will cite, alongside the manual work that a tool cannot do for you.
Legislation
Privacy operations
Rights and grievance
Breach readiness
Mapping
Included in this service
Most Indian organisations of any scale are not facing the DPDP Act alone. They have EU customers under GDPR, perhaps Californian users, and sector rules from the RBI, SEBI or IRDAI on top. Running a separate programme for each is how privacy teams end up maintaining four inventories that disagree.
The governance layer underneath is common: one data inventory serving every regime, a privacy risk methodology and register, ownership of personal data assigned by business function, retention and deletion enforced technically, privacy review embedded in product delivery, and vendor and sub-processor governance for everyone downstream.
Built once, each regime becomes a gap analysis against that baseline. The DPDP Act's distinct requirements (itemised notice, the consent architecture, grievance redressal, breach intimation without a threshold) are then additions to a known position rather than the start of another discovery exercise.
Why Aphelion
SharedDarshap Nayak, formerly of KPMG, holds a master’s degree in cybersecurity and more than seven years in security operations. Jaimin Somani brings fifteen-plus years of academic and hands-on VAPT. Hemang Desai is an ICT network specialist from Australia. You will meet them, not a logo.
Meet the teamEvery finding arrives with the reproduction steps, the affected asset and the fix, ranked by what it actually reaches in your environment, not by a CVSS number copied from a scanner. You get the report and the raw output, not a summary of a summary.
See how we testAhmedabad and Sharjah, working the same methodology on the same tooling. Indian data-residency requirements and UAE delivery are both ordinary here, and the AphelioNYX AD Pen-Test module runs entirely inside your perimeter when regulation says it must.
The platformInvent a statistic to make a slide land. Publish your name as a client without written permission. Print an award badge nobody awarded. Founded in 2024. We say so, and we attribute experience to the people who have it.
Ask us anythingAcross the globe, and across eight industries. We name a client only with their written permission.
AphelioNYX is SOC 2, ISO and GDPR compliant; attestations are available on request under NDA. We would rather hand you the report than print a badge.
Questions
FAQNext door
RelatedA personalised walkthrough and a free readiness assessment against the frameworks you are actually being asked for. Pick a time that suits you, or write to us. We reply within one business day.