Frameworks · India regulatory
DPDP Act compliance, run as a living system
The Digital Personal Data Protection Act is India's comprehensive personal data law. It obliges data fiduciaries to lawful processing on consent or legitimate use, notice, data principal rights, security safeguards, breach notification and governance of data processors.
Who it applies to
Any organisation processing digital personal data in India, and organisations outside India processing data of individuals in India, with additional duties for significant data fiduciaries.
What it demands
Consent & notice
Consent records with itemised notice, withdrawal handling and consent manager interoperability.
Data principal rights
Access, correction, erasure and grievance redress within prescribed timelines.
Security safeguards
Reasonable security safeguards and breach notification to the Board and affected principals.
Processor governance
Contracts and oversight for data processors, with accountability remaining with the fiduciary.
How Compli-Once runs it
- 1
DPDP modelled control by control beside your security frameworks, sharing evidence where it applies.
- 2
The data inventory and processing records live in the evidence vault, linked, versioned and expiry-tracked.
- 3
Processors are vendors in third-party risk: assessed on evidence, scored, reassessed on a cadence.
What you already satisfy
DPDP Act overlaps with frameworks you may already run. The crosswalk quantifies existing coverage on day one, before you plan a single task.
Implement once, satisfy many
In a representative demonstration environment, 61% of a newly adopted regulatory framework was already satisfied by the existing ISO 27001 programme.
Illustrative, computed live per tenant in the platform.
Frequently asked questions
What is the DPDP Act?
The Digital Personal Data Protection Act is India's personal data protection law. It requires lawful processing on consent or legitimate use, notice, data principal rights, reasonable security safeguards, breach notification and governance of data processors.
Does DPDP compliance share work with ISO 27001?
Substantially. Security safeguard obligations overlap with ISO 27001 controls, and the crosswalk maps them so one implementation serves both. DPDP-specific duties like consent records carry their own controls.
How are data processors managed?
Processors are vendors in the third-party risk module: tiered by criticality, assessed through a portal on evidence, scored automatically and reassessed on a cadence you set.
How is DPDP readiness evidenced?
As a computed control coverage figure with a gap list and owners. The consent records, processing inventory and safeguards evidence sit in the vault, linked to the controls they prove.