What DPDP compliance takes, and what you have to prove

No licence makes you compliant. You have to be able to prove it.

Each Data Fiduciary is responsible for its own compliance and must show it if a person complains or the Data Protection Board investigates. Your privacy policy only holds up if the practice behind it matches.

1. 1Assess

   Check yourself against every obligation in the Act and Rules.

   GRC Flow: Guided intake mapped to every obligation; AI-drafted gaps citing the exact section.

2. 2Fix

   Close the gaps: notices, consent, security, contracts, deletion, rights.

   GRC Flow: Risk register, readiness plan and tasks with owners and due dates.

3. 3Document

   Policies, a record of processing and evidence for each control.

   GRC Flow: Privacy notice, RoPA, breach playbook and DPA drafts; an evidence library checked by AI.

4. 4Prove

   Show it when a person complains or the Board investigates.

   GRC Flow: Controls that need evidence, human-reviewed findings and a tamper-evident audit log.

5. 5Keep it running

   Handle requests, consent changes and breaches on time.

   GRC Flow: Consent records, rights requests on a 90-day clock, breaches on a 72-hour clock, policy reviews.