DPDP Act 2023 · Rules 2025
DPDP Act compliance
A practical privacy programme for data mapping, consent governance, breach readiness and audit-ready documentation. Full compliance under the DPDP Rules is due on 13 May 2027.
- Data mapping
- Consent
- Principal rights
- Breach readiness
- DPO support
Privacy readiness
DPDP compliance built for operational reality.
Zoffec helps organisations understand where personal data lives, how it is used, what consent and notices are needed, and how to create evidence for accountability.
- Know where personal data lives
- Consent and notices that match real processing
- Evidence for accountability, not promises
7
Phase playbook
7-phase playbook
Move from uncertainty to privacy accountability.
Open each phase to see what we do and the documents you keep. Most organisations start with phases 1 and 2.
What we do: Assess gaps, identify high-risk systems, and create a remediation roadmap.
The Result: Clear visibility of risk exposure and prioritized actions instead of jargon.
Deliverables
- Gap Assessment Report
- Risk Heatmap
Zoffec DPDP services
A full privacy programme, not just a checklist.
DPDP gap assessment
Assess data practices, notices, consent, vendors, security controls and documentation gaps.
Data discovery & mapping
Map personal data flows across systems, teams, processors, vendors and retention points.
DPO as a service
Privacy leadership for governance, principal requests, escalation and compliance tracking.
Security safeguards
Security controls, monitoring, incident workflow and breach response expectations.
Policy & agreement review
Privacy notices, agreements, consent wording, processor terms and internal policies.
Readiness check
Could you prove DPDP compliance today?
If any of these has no named owner or written evidence, that's where to start.
- Data ownership
- Consent governance
- Principal rights
- Breach response
- Vendor oversight
- Audit evidence
01When do we need to be DPDP compliant?
The DPDP Rules 2025 were notified on 13 November 2025, with full compliance due by 13 May 2027. Some provisions, such as the consent manager framework, apply earlier.
02Does the DPDP Act apply to our business?
It applies to any organisation processing digital personal data of people in India, including employee and customer data.
03What is DPO as a service?
A named privacy lead who handles governance, data principal requests and compliance tracking, without a full-time hire.
04Where should we start?
With phases 1 and 2: a readiness assessment and data discovery. They show where the biggest risks are.
Let's talk
Start with a readiness assessment.
Tell us roughly what personal data you hold and which systems it passes through. We'll propose a scope for phases 1 and 2.