tecsxpert
← All frameworks
India · DPDP Act 2023

DPDP Act 2023, operationalized.

India's Digital Personal Data Protection Act is now in force. tecsxpert ships an India-resident DPDP control set, consent workflows, breach-notification timers and DPB-ready evidence packs — out of the box.

Get DPDP-ready Download DPDP guide (PDF)
What's covered

Every DPDP obligation, mapped to a control.

Lawful processing & consent (§4–§7)

Granular consent capture, withdrawal workflows, purpose limitation tracking, consent notice templates in 22 Indian languages.

Data fiduciary obligations (§8)

Accuracy controls, retention schedules with auto-purge, processor agreements, accountability documentation.

Breach notification (§8(6))

Automated 72-hour breach timer, DPB-ready notification templates, post-mortem documentation.

Significant data fiduciary (§10)

DPIA workflows, independent data auditor scheduling, DPO appointment register, periodic audit calendar.

Data principal rights (§11–§14)

Access, correction, erasure and nomination workflows. SLA tracking. Grievance officer routing.

Cross-border transfer (§16)

Country-allowlist tracking, transfer impact assessments, audit trail of every cross-border processing event.

Crosswalk

DPDP doesn't live alone.

In tecsxpert, every DPDP control is crosswalked to GDPR, ISO 27701, and ISO 27001. Evidence you collect for DPDP feeds the rest of your program automatically — and vice versa.

See the crosswalk
DPDP Act §
GDPR Article
ISO 27701 §
§6 Notice
Art. 13–14
A.7.2
§7 Consent
Art. 6, 7
A.7.2.2
§8(5) Reasonable security
Art. 32
A.7.4
§8(6) Breach
Art. 33
A.7.4.7
§11 Right to access
Art. 15
A.7.3.3
§13 Right to erasure
Art. 17
A.7.3.5
§16 Cross-border
Ch. V
A.7.5
Indian data residency

Your DPDP evidence stays in India.

tecsxpert runs an in-region deployment in Mumbai for DPDP customers. Personal data and evidence stay within India, with India-resident DPO support included for Managed GRC engagements.

Talk to the India team
Frequently asked questions

DPDP Act questions, answered.

Who does the DPDP Act 2023 apply to?

The Digital Personal Data Protection Act 2023 applies to any entity (Data Fiduciary) that processes the personal data of individuals in India, regardless of where the entity is located. This includes Indian companies, startups, and foreign companies that collect or process data of Indian citizens.

What is the breach notification timeline under DPDP Act?

Under Section 8(6) of the DPDP Act, Data Fiduciaries must notify the Data Protection Board of India and affected Data Principals of a personal data breach without undue delay. Regulations are expected to specify a 72-hour notification window, consistent with GDPR Article 33.

What is a Significant Data Fiduciary under the DPDP Act?

A Significant Data Fiduciary (SDF) is a Data Fiduciary designated by the Central Government based on the volume and sensitivity of personal data processed, risk to Data Principals, national security implications, or public order. SDFs face additional obligations including mandatory Data Protection Impact Assessments (DPIAs), Data Protection Officers, and periodic independent audits.

How does tecsxpert help with DPDP Act compliance?

Tecsxpert provides a pre-built DPDP Act control set covering all obligations from Sections 4–16, including consent management workflows, breach notification timers, data principal rights portals, cross-border transfer tracking, and DPB-ready evidence packs. The platform runs on India-resident infrastructure in Mumbai and crosswalks DPDP controls to GDPR and ISO 27001 automatically.

DPDP Act

Get DPDP-ready before the next milestone.

30-minute walkthrough on your real stack. No slideware. Bring your AWS account or GitHub org if you want to see live findings.

Book a demoSee pricing