A client's board asks who owns data protection.
If they are a Significant Data Fiduciary, they must appoint an India-based DPO and commission an independent audit every year. That audit is a new engagement, and it recurs.
For auditors
Turn DPDP into a service line.
For audit practices. Run client engagements on the framework the engine already holds, and hand over a signed report carrying your firm's name.
The opportunity
The clients will ask. The firm that answers first wins the work.
13 May 2027
when the substantive obligations bite, with no grace period
Every year
Significant Data Fiduciaries must commission an independent audit
₹250 cr
the top penalty tier in the Schedule
72 hours
to report a breach to the Data Protection Board
13 Nov 2025
The Rules are notified
The Act and the Rules are operational, and the Data Protection Board is established.
13 Nov 2026
Consent Managers
Registration opens and the Consent Manager ecosystem goes live.
13 May 2027
Full obligations
Notice, consent, security, breach reporting, rights, and the SDF annual audit all begin.
The service line, and what the market charges
Priced like the market already prices it.
Indicative published market pricing from Indian DPDP practices, not ours. It is here so a partner can see the shape of the opportunity before deciding anything.
DPDP is a law and not a certification scheme. There is no government certificate to sell, and we would not pretend otherwise.
What it looks like
Three ways the phone rings.
01
02
A client gets a breach notice.
The 72-hour clock to the Board starts. The firm that already mapped that client's data onboards the response, and writes the playbook for the next one.
03
A client's website collects more than it admits.
A scan shows trackers firing before consent. That is a finding, a remediation plan, and a reason for the board to fund the whole programme.
Why DPDP Done changes the economics
A junior can run the fieldwork. A partner reviews it.
The framework is already inside
199 obligations, 18 domains, the framework's own test methods, the scoring and the report. Your agent drives it, so the work is structured before anyone starts.
Working papers that hold up
Every artefact is hashed on receipt, and every sufficiency verdict must quote the passage it relied on. The judgement and the evidence can never disagree.
Your firm's name on the report
Set the firm profile once, and every certified report carries your name, registration and logo alongside the engine.
Delivery in days, not weeks
The fieldwork runs in your agent, on your machine. You reach the first finding in about ten minutes, not after a fortnight of templates.
How an engagement runs
Six steps, framework-ordered.
01 ScopeCreate the engagement for the client. Work out which of the 18 domains apply, ranked by risk.
02 WorkAssess the obligations one by one. Weak answers raise evidence requests automatically.
03 EvidenceRequest the proof, attach it, and record a verdict that quotes the passage it relied on.
04 FindRaise findings with their DP-F code, provision and penalty tier, and build a 30/60/90 plan.
05 CertifyIssue the report. It is signed, recorded, and carries your firm's name, registration and logo.
06 Hand overGive the client the report. Your working papers carry hashes and quoted evidence.
What DPDP Done costs a practice
See pricingFree to start. Pro for unlimited. A practice plan on request.
Talk to us
Bring DPDP to your clients.
Tell us about your practice and the clients you have in mind. We will come back within one working day with how a first engagement would run.
You bringThe clients and the engagement relationship
We bringThe framework, the evidence discipline, the engine and the report
They getA signed report, and a clear picture of their gaps