Skip to content

DPDP Rules: substantive obligations take effect 13 May 2027 (computed).

DPDPNiti
All solutions

Solutions

Technology & services

Keep the vendors and sub-processors you rely on registered with their contract reference and review date, and run the controls on client data with owners and evidence.

The Act is written for anyone who processes digital personal data. Whether and how it applies to you is what our questionnaire answers.

Sectors on this page

  • IT Services & Consulting
  • BPO, BPM & Customer Operations
  • SaaS & Software Products
  • AI, Data & Emerging Technology
  • Cybersecurity & Identity

A few of the questions the readiness assessment asks

  1. For this processing, do you determine the purpose and means (Data Fiduciary), or do you process on someone else's behalf (Data Processor)?
  2. Does any third party process personal data on your behalf?
  3. Is every vendor that processes personal data on your behalf covered by a current written contract?
  4. Do encryption, access control, logging and backups cover every system holding personal data, including your vendors'?
  5. When someone withdraws consent, is their data actually erased everywhere — including at your vendors?
  6. Do your logs survive at least a year, and does your deletion tooling know not to erase below that floor?

From obligation to audit record

  1. Statutory obligations become controls with owners, evidence with reviewers, and a record you can put in front of an auditor.
  2. The place the compliance work actually happens: a control per obligation, an owner per control, evidence per requirement, and a queue where somebody reviews it.
  3. An append-only audit record behind every decision and every piece of evidence

What you record in DPDPNiti

  • Data flows recorded against the activity that relies on them, naming the vendor, the transfer method and whether the data crosses a border
  • Sub-processor register with the relationship, the contract and the review date
  • The controls you run on client data, each with an owner and the evidence behind it
  • The dashboard, downloadable as CSV

If you process personal data for your clients

A Data Fiduciary must protect personal data in its possession or control by taking reasonable security safeguards, including where a Data Processor acts on its behalf (Section 8(5)), and may engage a Data Processor only under a valid contract (Section 8(2)).

So the clients who entrust personal data to you ask how you protect it.

For processing you do for a client, DPDPNiti does not run a separate processor assessment. It gives you the controls, owners and evidence to show how you protect that data.

Where you decide the purpose yourself, for your own staff and customers for example, the assessment covers the Data Fiduciary obligations.

Frameworks carried beside the Act

  • CERT-In Directions on cyber incident reporting: carried for every organisation

On the roadmap

  • Sub-processor chainsComing
  • Cross-border transfer registerComing
  • Audit and evidence packsComing
  • Independent auditor workspaceComing
  • Vendor questionnairesComing

See it yourself

Open the live demo yourself: a few questions, and you are inside a working synthetic organisation.

Open the live demoPricing

See it against your own obligations

A walkthrough of the real product — the assessment, the controls, the evidence and the audit trail — with the roadmap shown as the roadmap.

Book a tailored demoEmail us instead

Scheduling opens Calendly, a third party who will see what you enter there. Email reaches us directly and this site records nothing either way.