DPDP Act compliance for software teams
Most of this is engineering work, not policy work — and the engineering is where teams are least prepared.
Consent, retention, deletion, and breach notification are things your systems either do or do not do. A policy document does not implement any of them.
Typical timeline: Assessment in 2–3 weeks, remediation phased
Deletion has to reach every one of these
These are the signs this is worth doing
If several of these are true, this is usually where the fastest return sits.
India's Digital Personal Data Protection Act sets out obligations that will feel familiar to anyone who has dealt with GDPR: a lawful basis for processing, consent that is specific and withdrawable, purpose limitation, retention limits, rights for individuals to access and erase their data, and breach notification.
Implementation has been staged, and the detail sits in rules notified separately from the Act itself. Timelines and specifics have moved, and any page quoting a date will age badly — confirm the current position with your legal adviser. What is not in doubt is the direction, or that the technical work takes months rather than weeks.
That technical work is the part teams underestimate. A policy can be written in a week. Being able to actually delete someone's data, everywhere, on request, is a systems problem.
What has to be true of your systems
Each of these is an engineering task, and each is where we usually find the gap.
You know where personal data is
A real inventory: which tables, which fields, which logs, which third parties. Most teams discover personal data in places nobody had considered — support tickets, analytics events, error traces, exports on someone's laptop.
Consent is recorded as evidence
Not a checkbox that set a boolean. What was consented to, when, in what wording, and how it was withdrawn — stored so it can be produced later.
Retention actually expires
Defined periods per data category, enforced by something that runs, not by intention. Data kept indefinitely because nothing deletes it is the default state of almost every system.
Deletion reaches everywhere
Including logs, search indexes, caches, analytics, backups, and processors. Deleting a row and leaving the same person in six other places is not deletion.
The two that catch everyone
Backups and logs. Almost nobody has thought about either, and both contain personal data.
Backups are genuinely hard, because a backup you can edit is not a reliable backup. The workable position is documented: define a backup retention window, ensure deletions are re-applied if a restore ever happens, and be able to explain that process. Trying to surgically erase individuals from historical backups usually creates a worse problem than it solves.
Logs are more tractable and more often ignored. Application logs routinely capture emails, phone numbers, full request bodies, and identifiers, then get shipped to a platform that retains them for a year. The fix is redaction at the point of logging plus a retention policy on the platform — a few days of work that removes a large part of the exposure.
What the assessment produces
- A data inventory: every store holding personal data, including logs, backups, and third parties.
- A processing map — what is collected, why, on what basis, and how long it is kept.
- A gap list against the Act's obligations, ranked by exposure rather than by ease.
- A remediation plan with the engineering work sized.
- Practical designs for consent capture, retention enforcement, and deletion.
- A breach detection and notification process you could actually execute under time pressure.
The question that decides whether you are compliant is not whether you have a policy. It is what happens, technically, when someone asks you to delete their data.
We would rather tell you now than three weeks into a project. This work is usually the wrong call if any of the following describes you.
- Businesses holding no personal data beyond their own employees — the obligations are far lighter and this would be disproportionate.
- Teams looking only for a policy document. That is legal work, and a policy without the engineering behind it is a liability rather than a defence.
- Anyone wanting a certificate. There is no DPDP certification to buy; there is only whether your systems do what the Act requires.
The systems involved
We integrate rather than replace wherever it makes sense. These are the systems this work most commonly touches.
DPDP Act compliance — questions we get asked
Is this the same as GDPR compliance?
The concepts overlap substantially — consent, purpose limitation, retention, individual rights, breach notification. The specifics differ, and if you already meet GDPR you are a long way toward this. The engineering work is largely the same work.
Do we need a Data Protection Officer?
That obligation attaches to entities designated as Significant Data Fiduciaries rather than to everyone. Whether it applies to you is a legal question for your adviser, not an engineering one.
What about data we hold in backups?
The workable approach is a documented backup retention window plus a process that re-applies deletions if a restore occurs. Attempting to edit individuals out of historical backups tends to compromise the backups themselves.
How long does remediation take?
The assessment is two to three weeks. Remediation depends entirely on how much personal data is scattered — a well-structured system might be a few weeks, one with data in logs, exports, and four SaaS tools is a few months.
The services this work sits inside
Where this comes up most
The sectors where we most often do this work, and where the payback is usually clearest.
Others worth reading
Aadhaar and PAN verification, integrated
Identity verification is a solved problem technically. What determines whether it is done well is what you store afterwards, and what you deliberately do not.
Read itComplianceGST e-invoicing, integrated properly
E-invoicing is straightforward to comply with badly — by uploading on a portal — and only slightly harder to do properly, as part of the invoice being raised.
Read itThinking about dpdp act compliance?
Start with a short conversation. We will tell you honestly whether this is the right place to begin, or whether something else pays back faster.