Skip to content

DPDP Rules: substantive obligations take effect 13 May 2027 (computed).

DPDPNiti
All solutions

Solutions

Consumer internet, commerce & gaming

Every rights request tracked from intake to closure, with its identity verification recorded, and erasure tracked with an owner — your systems do the deletion.

The Act is written for anyone who processes digital personal data. Whether and how it applies to you is what our questionnaire answers.

Sectors on this page

  • E-commerce & Marketplaces
  • D2C & Consumer Brands
  • Retail & Consumer Chains
  • Media, OTT & Digital Content
  • AdTech, MarTech & Consumer Analytics
  • Gaming & Interactive Entertainment

A few of the questions the readiness assessment asks

  1. Does any processing rely on the Data Principal's consent rather than only on a legitimate use?
  2. Does every consent request present a standalone notice itemising the data and the purpose?
  3. Can a Data Principal withdraw consent as easily as they gave it, and does processing actually stop?
  4. Can a Data Principal read your notice in English or in a language of the Eighth Schedule?
  5. Do you process the personal data of anyone under eighteen, or of a person with a disability who has a lawful guardian?
  6. Are tracking and targeted advertising switched off for users identified as children?
  7. Which of these best describes your service?
  8. How many registered users do you have in India?
  9. If you are an e-commerce entity, online gaming intermediary or social media intermediary of the size the Third Schedule sets, do you erase data after its period of inactivity?
  10. Does your inactivity-erasure process send a warning at least 48 hours beforehand?

The Third Schedule's three classes, e-commerce, online gaming and social media, are in the product's content with their user thresholds.

From obligation to audit record

  1. Statutory obligations become controls with owners, evidence with reviewers, and a record you can put in front of an auditor.
  2. The place the compliance work actually happens: a control per obligation, an owner per control, evidence per requirement, and a queue where somebody reviews it.
  3. An append-only audit record behind every decision and every piece of evidence

What you record in DPDPNiti

  • A rights request register with identity verification as a recorded step
  • Erasure tracked as work with an owner through to closure — DPDPNiti records the duty, your systems do the deletion
  • Marketing and personalisation registered as their own purposes, so a purpose can be answered for on its own

Frameworks carried beside the Act

  • CERT-In Directions on cyber incident reporting: carried for every organisation

On the roadmap

  • Advanced consentComing
  • Notice language packComing
  • Public rights request portalComing
  • Age assuranceComing

See it yourself

Open the live demo yourself: a few questions, and you are inside a working synthetic organisation.

Open the live demoPricing

See it against your own obligations

A walkthrough of the real product — the assessment, the controls, the evidence and the audit trail — with the roadmap shown as the roadmap.

Book a tailored demoEmail us instead

Scheduling opens Calendly, a third party who will see what you enter there. Email reaches us directly and this site records nothing either way.