← KM CIPHER  |  InfoSanrakshan DPDPA Compliance Platform
DPDPA Rules notified · Nov 13, 2025 · Enforcement active

DPDPA compliance your
business actually needs —
without the Big-4 bill

India's data protection law is in force. Penalties reach ₹250 crore. InfoSanrakshan gives Indian startups and SMBs a complete, automated compliance platform — at a fraction of what consultants charge.

₹250 Cr
Max penalty per breach
May 2027
Full enforcement deadline
Low
Industry readiness (EY, Feb 2026)
7 Days
To respond to rights requests
Section 8 — Security safeguards mandatory NOW · Section 11 — Consent notices required for all data collection · Section 13 — Rights requests: 7-day response window · Section 9 — Children's data: verifiable parental consent mandatory · Rule 7 — Breach notification to Data Protection Board within 72 hours · Section 8 — Security safeguards mandatory NOW · Section 11 — Consent notices required for all data collection · Section 13 — Rights requests: 7-day response window · Section 9 — Children's data: verifiable parental consent mandatory · Rule 7 — Breach notification to Data Protection Board within 72 hours ·

The clock started
November 13, 2025

The DPDPA isn't upcoming legislation anymore. It's the law of India — and the Data Protection Board is operational and accepting complaints today.

MAXIMUM PENALTY

₹250
Crore

per incident of non-compliance

Unlike GDPR, the DPDPA applies to all companies processing digital data of Indian residents — including foreign companies serving Indian users. There is no SMB exemption.
  • Sec 8 No security safeguards — encryption, access control, breach protocols. Penalty: up to ₹250 Cr.
  • Sec 11 Missing consent notices — collecting data without clear, plain-language consent. Penalty: up to ₹200 Cr.
  • Sec 13 Ignoring rights requests — failing to respond to access/erasure/correction requests within 7 days. Penalty: up to ₹150 Cr.
  • Sec 9 Children's data violations — processing child data without verifiable parental consent. Penalty: up to ₹200 Cr.
  • Rule 7 Breach non-notification — failing to notify Data Protection Board and affected users within 72 hours of a breach.
AUG 2023
DPDPA receives Presidential assent
JAN 2025
DPDP Rules 2025 notified
NOV 2025 ← NOW
Data Protection Board operational — enforcement active
NOV 2026
Consent manager obligations live
MAY 2027
Full enforcement — DPO, DPIA, penalties at scale

Compliant in 4 steps,
not 4 months

Most companies spend 6–9 months on a DPDPA programme with Big-4 consultants. InfoSanrakshan automates 80% of it in days.

STEP 01

Data discovery

We scan your databases, cloud storage, and SaaS apps to find all personal data and auto-generate your Record of Processing Activities (RoPA).

STEP 02

Consent management

Deploy our 2-line JS consent widget to your website. Cryptographic timestamping, 22-language support via Bhashini, and automatic withdrawal flows.

STEP 03

Rights portal

A self-serve portal for your users to submit access, correction, and erasure requests. OTP-verified, auto-routed, SLA-tracked — generates audit-ready closure PDFs.

STEP 04

Live compliance score

A real-time dashboard showing your compliance posture across every DPDPA obligation — green, amber, or red. Board-ready reporting, always up to date.

Every obligation.
One platform.

Six integrated modules covering the complete DPDPA compliance lifecycle — from data discovery to breach notification.

✓ Included in all plans

Data discovery & RoPA

AI-powered scan of your databases, cloud storage, and SaaS to build a complete data inventory and Record of Processing Activities.

  • Structured + unstructured data scanning
  • Auto-classification (PII, sensitive, child data)
  • Data flow mapping + third-party processor registry
✓ Included in all plans

Consent management SDK

A drop-in 2-line JS widget that makes your consent collection legally watertight — cryptographically stamped and court-admissible.

  • 22 Indian languages via Bhashini API
  • Purpose-specific consent with version control
  • Re-consent campaigns on policy change
✓ Included in all plans

Data principal rights portal

A branded portal where your users submit access, correction, erasure, and nomination requests — fully automated from receipt to closure.

  • OTP-verified identity for all requests
  • 7-day SLA countdown with team alerts
  • Regulator-ready closure PDFs auto-generated
Growth & Enterprise plans

Breach notification engine

When a breach happens, you have 72 hours to notify the Data Protection Board and affected users. We automate the entire workflow.

  • SIEM integration (ArcSight, Sentinel, Splunk)
  • Auto-drafted Board notifications in prescribed format
  • Multi-lingual user notification templates
Enterprise plan

DPO-as-a-Service

Don't need a full-time Data Protection Officer yet? Our fractional DPO service gives you a CISSP-certified privacy lead on retainer.

  • Monthly privacy health check and board reporting
  • Regulator liaison and Data Protection Board interface
  • Policy updates as DPDPA rules evolve
Coming Q3 2026

AI-powered DPIA generator

Automate your Data Protection Impact Assessments for high-risk processing activities — guided interviews, AI drafting, legal review workflow.

  • DPDPA + ISO 27001 + SOC2 cross-mapping
  • AI gap analysis with remediation roadmap
  • Continuous compliance monitoring score

Built for Indian startups.
Priced accordingly.

Big-4 DPDPA engagements start at ₹25 lakh. Enterprise platforms start at ₹12.5 lakh/year. InfoSanrakshan starts at ₹2,499/month.

Starter
2,499
per month · billed annually (₹24,999/yr)
  • Consent SDK (unlimited consents)
  • Basic RoPA template & wizard
  • Data principal rights portal
  • DPDPA readiness score dashboard
  • 1 data scan per quarter
  • Email support
  • Breach notification engine
  • SIEM integrations
  • DPO-as-a-Service
Start Free Trial
Enterprise
Custom
₹25,000/mo onwards · annual contract
  • Everything in Growth
  • Fractional DPO-as-a-Service
  • Unlimited DPIAs
  • Custom SIEM integrations
  • White-label portal option
  • Board-level compliance reports
  • Dedicated compliance manager
  • RBI / SEBI controls mapping
  • SLA: 1-hour critical response
Talk to Us →

All plans include a 14-day free trial · No credit card required to start

Trusted by Indian
tech founders

"

We thought DPDPA compliance would take us 4 months and a legal retainer. InfoSanrakshan had us live with consent management and a rights portal in a week. The readiness score alone saved us from two critical gaps we didn't know existed.

RS
Rahul Sharma
CTO · Bengaluru-based fintech startup
"

We're a 40-person D2C brand handling lakhs of customer records. The RoPA wizard made us realise we had three vendors processing our data with no contracts. InfoSanrakshan flagged it immediately. That alone justified the annual subscription.

PM
Priya Menon
Co-founder · D2C brand, Mumbai
"

Our enterprise client in Germany asked us for DPDPA compliance proof before signing. InfoSanrakshan generated a board-ready compliance report in minutes. Signed the contract the same week. ROI was immediate.

AK
Aditya Kumar
CEO · SaaS company, Hyderabad

DPDPA compliance with a
security engineer's precision

InfoSanrakshan is built by Krishna Muduli, CISSP — a cybersecurity lead engineer with 12 years building security systems at OpenText, Bridgestone, and Motorola. He's spent his career making security automated, measurable, and audit-ready.

Most DPDPA tools are built by lawyers or compliance consultants who bolt technology on. InfoSanrakshan was designed the other way — security architecture first, compliance framework second.

CISSP certified — International Information System Security Certification
12 years across SIEM, SAST/DAST, cloud security, AWS, threat intelligence
Pursuing AAISM (Advanced AI Security Management, ISACA)
Breach notification system integrates with ArcSight, Sentinel, Splunk — not just webhooks
Your DPDPA readiness — typical SMB
34 / 100
Consent management12%
Data mapping (RoPA)8%
Rights portal0%
Security safeguards55%
Breach readiness70%

Everything you need to know

Does DPDPA apply to my startup?
Yes — if your company processes digital personal data of Indian residents, DPDPA applies to you regardless of company size. Unlike GDPR, there is no small business exemption. This includes processing employee data, customer data, or user data collected via your website or app. Foreign companies serving Indian users are also covered.
We're a 15-person startup. Are we really at risk?
The Data Protection Board is operational and accepting complaints from users (data principals) today. Even small companies can be investigated if a user complains. The penalties scale with the nature and gravity of the violation — but basic obligations like consent notices, rights responses, and security safeguards apply to all companies. Non-compliance creates a liability that grows as your company does.
How is InfoSanrakshan different from OneTrust or Scrut?
OneTrust and TrustArc are GDPR-first platforms — DPDPA is an afterthought add-on that doesn't account for India-specific requirements like Bhashini-language consent, the Account Aggregator framework, or RBI/SEBI overlap. Scrut and Sprinto focus on SOC2/ISO27001. InfoSanrakshan is the only platform built specifically for DPDPA from the ground up — with breach notification that integrates with Indian SIEMs, and pricing designed for Indian SMBs (₹2,499/mo vs ₹12.5L/yr).
What is DPO-as-a-Service and do I need it?
A Data Protection Officer (DPO) is mandatory for companies designated as "Significant Data Fiduciaries" — expected to be notified in 2026 for the largest data processors. Even if you don't legally require a DPO yet, having a qualified privacy lead on retainer protects you when the government sends a notice or a user files a complaint. Our DPO-as-a-Service gives you a CISSP-certified privacy lead at ₹15,000/month, versus the cost of hiring a full-time DPO (₹25–50L/yr salary).
How long does it take to get compliant?
Most customers complete the foundational compliance layer (consent SDK live, RoPA documented, rights portal deployed, score dashboard green on the must-have items) within 5–10 working days. Full compliance including breach readiness and vendor risk management typically takes 3–4 weeks. Compare this to 4–6 months with a consulting firm.
Is my data stored in India?
Yes. All customer data processed by InfoSanrakshan is stored on AWS Mumbai (ap-south-1) region. This is intentional — we designed for data residency from day one, because we're a DPDPA compliance platform and non-residency would be a contradiction. Your consent logs, RoPA, and audit trails never leave India.

Get your DPDPA readiness
score in 5 minutes. Free.

Answer 20 questions about how your company handles personal data. Get a detailed score across every DPDPA obligation, a gap report, and a remediation roadmap — no credit card required.

14-day free trial · No credit card · Setup in under 10 minutes · Data stored in India