DPDP Act readiness for SaaS teams.
India's Digital Personal Data Protection Act, 2023 (DPDP Act) requires organisations that process digital personal data to give clear notice, obtain valid consent or rely on a permitted legitimate use, protect the data with reasonable security safeguards, report personal data breaches, and erase data when its purpose ends. Cognivus maps your data, finds the gaps and implements the technical safeguards.
Key obligations for a data fiduciary
- Notice and consent: a clear notice of what is collected and why, and consent that can be withdrawn as easily as it was given
- Reasonable security safeguards to prevent personal data breaches, including encryption or masking, access control, logging and backups
- Breach intimation to the Data Protection Board of India and to affected individuals
- Retention and erasure once the purpose is served
- Grievance redressal and published contact details
- Processors: a valid contract with every vendor that processes data on your behalf
- Additional duties for Significant Data Fiduciaries, including data protection impact assessments and audits
Timelines
The Digital Personal Data Protection Rules, 2025 were notified in November 2025, with most obligations phased in over the following 18 months. Penalties for failing to take reasonable security safeguards can reach ₹250 crore.
What we do
- Inventory the personal data you collect, where it flows and who processes it
- Assess security safeguards against the Act and the Rules, and rate the risks
- Draft the technical sections of notices, retention schedules and breach runbooks with your counsel
- Implement the safeguards: encryption, access control, logging, backups and deletion jobs
We don't give legal advice: legal interpretation stays with your counsel, and we make the systems match it.
Frequently asked questions
Does the DPDP Act apply to companies outside India?
It applies to processing of digital personal data within India, and to processing outside India where it relates to offering goods or services to people in India.
Is there a DPDP certification?
No. Compliance is demonstrated through your notices, records, safeguards and response to the Data Protection Board, not a certificate.
Do you give legal advice?
No. We work alongside your counsel: they interpret the law, and we make your systems and records match it.
Have a product to build or a system to secure?
Tell us what you need. You will receive a written proposal within one business day.