Comply DP

Operationalize DPDP compliance across your enterprise.

Discover personal data, automate ROPA, manage consent, and prove DPDP readiness in one system.

Discovered Tools

Tools detected across your org's data sources.

ToolCategorySourceStatus
GitLab (self-managed)CodebaseCode scan (Git)Detected
Salesforce Financial Services CloudCRMConnectionConnected
KarzaKYCCode scan (Git)Detected
SignzyKYCCode scan (Git)Detected
PerfiosData aggregationCode scan (Git)Detected
RazorpayPaymentsCode scan (Git)Detected
WhatsApp Business APIMessagingCode scan (Git)Detected
ClevertapEngagementCode scan (Git)Detected
Adobe AnalyticsAnalyticsCode scan (Git)Detected
BFSI

India data residency, Mumbai region

DSCI member DSCI/AM/2026/064

ISO certified

VPC or on-prem agent for regulated buyers

DPA available

The operating gap

The statute is in force. The operating system is not.

Legal obligations

Notices, consent, rights, and breach clocks are live duties, not a 2027 project.

Data discovery

You cannot honour a principal or notify a breach if you cannot see where personal data sits.

Continuous compliance

A one-time memo decays. Processing changes every time you ship.

Legal writes the notice. Engineering ships the form. If those two tracks never meet, consent is theatre and ROPA is a spreadsheet that is already wrong. DPDP is an operating problem that sits between both desks.

  1. In force today

    Core obligations already apply to fiduciaries processing digital personal data.

  2. Circa Q1 2027

    Consent Manager registration window under the published rules.

  3. May 2027

    Full enforcement. Penalties up to ₹250 crore.

How the work runs

One path from inventory to continuous control

  1. 01

    Discover data

  2. 02

    Map personal data

  3. 03

    Generate ROPA

  4. 04

    Gap assessment

  5. 05

    Remediation

  6. 06

    Continuous compliance

What the work produces

From connection to attested finding

0

vendors discovered

0

personal-data fields

Attested

Sources

Vendors

Fields

Attestation

GitLab

self-managed

Salesforce

PostgreSQL

Razorpay

Karza

Signzy

Clevertap

pan_number

aadhaar_ref

account_no

mobile

ifsc

field names only, no values

Priya S

DPO · 6 Sep

BFSIIllustrative example

Data discovery

Find personal data across systems, stores, and code.

ROPA

Keep a living record of every processing activity.

Consent management

Capture, withdraw, and prove consent against the Act.

Vendor assessment

Know which processors touch personal data, and on what terms.

Breach Resolution

Contain the incident, notify the Board in 72 hours, and keep the evidence.

Parent / Guardian Consent

Verify a parent or guardian before processing anyone under 18.

Why ComplyDP

I

A reasoning layer that executes the statute, not a checklist someone typed in.

Gaps cite the section they fail. The Act is applied as rules that run, not a control label copied from a workbook.

II

Discovery that reads your systems and code, not just your website surface.

Personal data is found in repos, stores, and processors. A scan of the marketing site is not an inventory.

III

Deployable where your data already lives, including on-premise for regulated environments.

Mumbai region by default. VPC or on-prem agent when the data cannot leave your perimeter.

Checks written by legal and engineering together. Two published DPDP practitioner guides. Supreme Court practice.

How teams run the work

D2C commerce

Challenge
Consent sat in three tools. No one could produce an inventory of what checkout, pixels, and support each held.
Solution
Discovery, ROPA, and consent were run as one path so legal and storefront engineering shared the same map.
Outcome
Ranked gaps and a single operating view instead of a month of legal ping-pong.

Multi-product SaaS

Challenge
Legal drafted notices. Engineering shipped features. Vendor lists lived in a spreadsheet that lagged every new integration.
Solution
A shared workflow mapped processors and processing against the same register both teams could update.
Outcome
Audit-ready evidence without a separate compliance project each quarter.
DSCIGoogle CloudNvidia InceptionDepartment of Science & TechnologyT-Hub

Pricing

Priced by entities monitored and connected systems

See full pricing

D2C/Playbook

D2C and eCommerce

SaaS/Playbook

SaaS platforms

Regulated/Playbook

Fintech, health, EdTech

Budget/Whitepaper

CFO guide to DPDP budgeting

Operations/Templates

Notice, consent, and breach pack

Market/Report

India DPDP preparedness report

Ready to operationalize DPDP compliance?

DPDP compliance FAQ

Does DPDP apply to my startup?▼

If you process digital personal data about individuals in India - customers, users, or employees - you should assume DPDP may apply and run a short applicability review. Size alone is not a safe exemption.

What is the DPDP breach notification deadline?▼

Notify the Data Protection Board of India and affected Data Principals within 72 hours of detecting a personal data breach. Our guide breaks down the hour-by-hour timeline, templates, and common failure points. Read the 72-hour breach guide

What are DPDP penalties?▼

Penalties vary by breach type and can reach very large statutory caps (for example, up to ₹250 crore for certain failures in the published penalty framework). Your exposure depends on facts and governance.

What is the DPDP compliance deadline?▼

Rules are phased. Full enforcement for many operational obligations is tied to timelines published under the framework; we surface May 13, 2027 as the full enforcement milestone on this page for planning purposes.

What is a Significant Data Fiduciary (SDF)?▼

SDFs are a class of Data Fiduciaries designated based on volume, sensitivity, risk, and related factors. They carry additional duties such as appointing a Data Protection Officer and undertaking audits as prescribed.

Do I need a consent manager?▼

Consent Managers are relevant where the framework expects users to manage consent through an authorized manager. Whether you must use one depends on your processing model and regulatory guidance - verify against your facts.

How fast can I get a coverage verdict?▼

Our DPDP risk snapshot is designed to take about 10 minutes and returns a coverage-style verdict, exposure score, and prioritized gaps.