Legal
Disclaimers
DPDP Done is an audit engine built by Cyber Vigilance Group. We are precise about what it does and does not prove.
Not a legal opinion
DPDP Done does not give legal advice. Get independent legal counsel on your specific position.
Not a certification scheme
Completing an audit with DPDP Done confers no statutory certification, accreditation or regulatory clearance. The Data Protection Board of India is the sole regulatory authority under the Act.
What certified means
A certified report was issued through DPDP Done by a subscribed auditor. Its PAdES signature proves the document has not changed since issue, and the registry records that it was issued under a valid subscription. It is not a government certification.
Automated assessment is preliminary
An automated assessment is a preliminary, evidence-based analysis. It does not replace a professional audit by a qualified practitioner, nor legal advice.
The Act and the Rules prevail
Where anything in this product conflicts with the statutory text, the statutory text wins. Auditors must read the governing provisions directly.
Your data
The engine stores what it needs to run an engagement and certify a report. Certified reports are committed by hash, so DPDP Done does not store the report body or your client's evidence.
Sector rules are separate
DPDP Done covers the DPDP Act and Rules. Sector regulators such as the RBI, IRDAI or health regulators can impose additional obligations that are outside scope here.