The DPDP Operating System

The Complete Operating System for DPDP Governance

Statutory obligations become controls with owners, evidence with reviewers, and a record you can put in front of an auditor.

Book a tailored demo Explore the Engine

The Traceability Engine

From statute to evidence, in one unbroken chain

Follow any obligation through the full lifecycle. Select a stage to see how DPDPNiti links regulation to real, auditable proof.

Regulatory Act

DPDP Act, 2023

The statutory source. Provisions of the Act and the Rules are held as versioned content with the Gazette citation, the publication date and the retrieval date recorded against each one — and a summary is always labelled as our summary, never as the statute.

The actual product

Screens, not mock-ups

Captured from a synthetic organisation in the running product. Nothing here is drawn, composited or retouched.

The DPDPNiti dashboard: a compliance-readiness tile reading 65.4 with a Critical Gap chip and a note that the rating is capped by two blocking gaps; a control-coverage tile with a stacked bar and the counts 14 implemented, 2 in progress, 3 planned, 18 not started; and a five-by-five top-risks heat map. The grouped menu on the left shows Assess, Operate, Registers, Respond and Administration sections, with a count badge on Risks. — The dashboard. Nine tiles, each carrying the basis it was calculated on, every chart showing its number with a table view behind it — and every count is a door: it opens the register filtered to exactly what it counts.

A completed DPDP readiness result showing an overall rating, the sections it decomposes into, and a note that the rating is capped by a blocking gap. — The readiness result. Stored and versioned against the scoring model that produced it, decomposed by section, and showing where a blocking gap caps the rating regardless of the arithmetic.

The controls register listing adopted controls with their accountable owner and an implementation status of Implemented, In progress or Not started. — Controls, owners and status. Every obligation that applies has a control; every control has somebody accountable for it.

A single readiness gap opened in full: the obligation to intimate each affected Data Principal of a breach without delay, stated in plain language; a What-the-law-says panel citing Section 8(6) and Rule 7(1), labelled as an operational rendering rather than a quotation or legal advice; and a What-good-looks-like checklist covering breach detection, intimation with all required elements, and a breach response runbook. — One gap, in full. A blocking gap caps the rating however well everything else scores — and the screen shows the provision, why it reaches you, and what closing it would take, while labelling its own rendering of the law as a rendering rather than advice.

Core capabilities

Six modules running today, one opening at launch, and one on the roadmap

These are the product's own headings. Anything not in the product today is marked, so you can tell the difference without booking a call.

Sections 4–17, and the Rules

Applicability, assessment and readiness

Decide what the Act actually asks of your organisation, answer it once, and keep the answer — versioned, decomposed and defensible.

Scope questions drive applicability rules; a provision that cannot be decided from the rules says so instead of guessing
A stored, versioned readiness result with the scoring model recorded against it
Blocking gaps cap the rating regardless of the arithmetic, and the cap is shown
Re-assess later without destroying what the last one said

One application, one tenant boundary, one audit trail. Every module reads the same records rather than keeping its own copy.

Deployment and architecture

How it runs, stated plainly

One deployment model today and one on the roadmap — told apart on the page rather than in a sales call.

Deployment

Managed SaaS

The way DPDPNiti ships today: multi-tenant, hosted by us in India, updated continuously, with no infrastructure for your team to run.

Private deploymentComing

The same containers as an annual term licence for organisations whose policy requires their own infrastructure, with a signed licence file carrying the tenant, the tier and the entitlements. Designed and decided; not available today.

Regulatory content updates

The corpus of provisions, obligations and controls is versioned content with its own release trail, so the law moving does not mean your platform standing still.

Hosted in India

Production runs in the Mumbai region. The Act does not broadly mandate localisation today, and we do not claim it does — we host here because Indian buyers ask, and because transfer restrictions may yet arrive for Significant Data Fiduciaries.

Isolation enforced by the database

Row-level security on every tenant-owned table, with an application role that cannot bypass it and a separate, narrowly scoped role for tenant resolution. A forgotten WHERE clause returns nothing, not somebody else’s data.

A documented REST API

Every screen in the product is built on the same versioned REST API, published as an OpenAPI document, authenticated and permission-checked exactly as the interface is.

See it against your own obligations

A walkthrough of the real product — the assessment, the controls, the evidence and the audit trail — with the roadmap shown as the roadmap.

Book a tailored demo Email us instead

Scheduling opens Calendly, a third party who will see what you enter there. Email reaches us directly and this site records nothing either way.