What we publish, and what it rests on.
Our work on the DPDP Act 2023 and the Rules, in the open. Every number is read off our own framework or the Schedule to the Act. Where we cannot prove something, we say so.
DPDP, EvidencedCompliance is a claim until evidence proves it
What the organisation told you is not what its evidence demonstrates. There is a sentence we built a company around, and it is not a slogan. It is the only honest description of how compliance works in practice. Everything else follows from keeping those two categories strictly apart.
Thu Oct 01 2026 · 5 min read
DPDP, EvidencedWe scored all 211 DPDP obligations. Here's where the penalty exposure actually sits
Everyone preparing for the Digital Personal Data Protection Act 2023 is working from a list. Almost nobody has sorted that list by where the statutory penalty exposure sits. We mapped every item to the Schedule to find the exact distribution.
Thu Oct 01 2026 · 4 min read
We ran our own tool on ourselvesWe pointed our DPDP scanner at our own website
There is a temptation, when you build a compliance tool, to run it on everyone else and never on yourself. We ran it on ourselves first.
Thu Oct 01 2026 · 2 min read
DPDP, EvidencedIndia's first DPDP penalty will be about paperwork, not privacy
Everyone imagines the first DPDP enforcement action as a data breach: a leak, a headline, a number. It will more likely be a file nobody can produce. Here is the argument, and the part of it you can check against the Act.
Thu Oct 01 2026 · 2 min read
DPDP, EvidencedA compliance report you can actually verify
Most compliance documents are unfalsifiable. You can read them, but you cannot check them. If someone hands you a PDF that states an audit took place, your only options are to believe it or doubt it.
Thu Oct 01 2026 · 2 min read
DPDP, EvidencedPresence is not operation — the ceiling we put on our own scanner
There is a specific kind of dishonesty that compliance software is prone to, and it is not fabricating data. It is conflating two findings that look alike: that a control is present, and that it operates. We built a hard ceiling into our engine to prevent it.
Thu Oct 01 2026 · 2 min read
We ran our own tool on ourselvesWe ran a DPDP audit on ourselves, and published the result
Building a DPDP audit engine puts you in an awkward position: you hold others to a standard you could easily exempt yourself from. So we audited ourselves. This is what a company selling DPDP compliance should expect to be asked, and what we found.
Thu Oct 01 2026 · 3 min read
DPDP, EvidencedDPDP is annual, not once — why your compliance decays
Most organisations treat compliance as a project with an end date. DPDP resists that, and the reason is structural: the evidence expires even when the policy does not.
Thu Oct 01 2026 · 2 min read
DPDP, EvidencedConsent notice is the obligation most organisations fail first
If you want to predict where an organisation's DPDP problem will surface, do not start with its database. Start with its consent notice. It is the first thing a data principal meets, the first thing a regulator can check without asking for anything, and the obligation most likely to be asserted rather than evidenced.
Thu Oct 01 2026 · 2 min read
DPDP, EvidencedSignificant Data Fiduciary — who it hits, and what changes
"Significant Data Fiduciary" (SDF) is the designation that matters most to large Indian organisations. It is also the one most often misunderstood as a badge you apply for. In practice, it is closer to a category you fall into.
Thu Oct 01 2026 · 2 min read
DPDP, EvidencedGDPR vs DPDP — the differences that will surprise Indian teams
Teams that have run a GDPR programme often assume they can reuse it for DPDP. Much of the shape is familiar, and that familiarity is the risk: the places where the two diverge are exactly the places a copied playbook fails. Here are the differences most likely to surprise.
Thu Oct 01 2026 · 2 min read
DPDP, EvidencedHow to become a DPDP auditor
There is no single government DPDP auditor certificate to collect. That absence is not a regulatory gap, but the nature of audit work under the Digital Personal Data Protection Act, 2023. What organisations require is someone who can evaluate statutory obligations against verifiable evidence and stand behind the result.
Thu Oct 01 2026 · 4 min read
Subscribe by RSS at /blog/feed.xml.