DPDP Act compliance · GRC software
DPDP Act compliance, ready before May 2027.
India's Digital Personal Data Protection Act and the DPDP Rules 2025 apply to almost every company that handles personal data of people in India. AEGIS maps the DPDP obligations onto the same controls as SOC 2 and ISO 27001, so you get ready once and stay ready.
Every framework on every plan, priced by team size. You choose your auditor.
The basics
What is the DPDP Act?
The Digital Personal Data Protection Act, 2023 is India's data protection law. It governs how organisations (data fiduciaries) collect and process digital personal data of individuals (data principals), and it applies to processing outside India too when you offer goods or services to people in India.
The DPDP Rules 2025 were notified on 13 November 2025 and phase the law in. The Data Protection Board took effect at once, consent manager registration opens after twelve months, and most obligations on businesses apply after eighteen months, from 13 May 2027.
Requirements
What the DPDP Act and Rules ask for
These are the obligations most startups and scale-ups need to build for. Significant Data Fiduciaries have extra duties.
- Notice and consentA clear, itemised notice and free, specific consent before processing, as easy to withdraw as to give.
- Reasonable security safeguardsMeasures such as encryption, access control, logging and monitoring to prevent personal data breaches.
- Breach notificationTell the Data Protection Board and affected people about a personal data breach, with a detailed report to the Board within 72 hours.
- Retention and erasureErase personal data once the purpose is served or consent is withdrawn.
- Children's dataVerifiable parental consent before processing a child's personal data.
- Rights and grievancesLet people access, correct and erase their data, and answer grievances on time.
- ProcessorsMake sure every data processor working for you is bound to the same safeguards.
- Significant Data FiduciariesA Data Protection Officer in India, data protection impact assessments and periodic audits.
Explained
Is there a DPDP certification?
No. There is no official DPDP certificate. Compliance is shown through your notices, consent records, security safeguards and breach procedures, and, for Significant Data Fiduciaries, through periodic independent audits.
What you can do is build the program and the evidence before May 2027. AEGIS maps DPDP onto the same control set as ISO 27001 and SOC 2, so the security safeguards you evidence for one count for the others.
Checklist
DPDP Act checklist
What an auditor or regulator will want to see. AEGIS generates each of these as a control, policy or evidence task, with an owner.
- Data map: know which personal data you hold, where it sits and why you process it.
- Notices: itemised notices in clear language for every processing purpose.
- Consent records: proof of consent and of withdrawal, kept with the data.
- Security safeguards: encryption, access control, logs and monitoring, with evidence.
- Breach plan: a tested procedure to notify the Board and affected people.
- Retention schedule: when each data set is erased, and proof that it was.
- Processor contracts: every processor bound to the same safeguards.
- Grievance route: a published contact and a process to answer requests.
With AEGIS
Get DPDP Act ready, then stay ready.
Gets you compliant
From zero to ready
- A short security interview scopes the DPDP Act for your company, with a reason for every control.
- Controls, policies, risk register and evidence backlog are generated in an afternoon.
- AI drafts each policy in your real context; a person on your team approves it.
- Evidence collects from your cloud, code, identity and devices.
Keeps you compliant
Current every day after
- Checks keep running and evidence keeps collecting after the audit.
- Access reviews, training and policy sign-offs come round on schedule, with owners.
- A control that drifts shows up before your next audit, and a check that cannot run never counts as a pass.
- The DPDP Act shares one control set with every other framework, all included on every plan.
Your auditor, your choice
Pick the auditor that fits your buyers.
DPDP has no certification body, but Significant Data Fiduciaries need periodic independent audits, and buyers increasingly ask for one. If you want an independent DPDP assessment, you choose the firm, tier 1, 2 or 3, and AEGIS gives them read-only access to your evidence.
Works with Nexus Void
Security work that becomes DPDP Act evidence.
VAPT
Penetration testing
Reasonable security safeguards are where the largest DPDP penalty sits. A VAPT report shows those safeguards were tested, and files into AEGIS as evidence.
Explore VAPTARGUS
Code security
Personal data leaks often start in code: hardcoded secrets, exposed endpoints, vulnerable dependencies. ARGUS finds them, and its findings become risks and evidence in AEGIS.
Explore ARGUSOther frameworks
One control set, every framework included.
Questions
DPDP Act questions, answered.
When does the DPDP Act come into force?
The DPDP Rules 2025 were notified on 13 November 2025. The Data Protection Board took effect immediately, consent manager registration follows after twelve months, and most obligations on businesses apply from 13 May 2027.
Who does the DPDP Act apply to?
Any organisation processing digital personal data in India, and organisations outside India that process personal data to offer goods or services to people in India.
What are the DPDP Act penalties?
The Data Protection Board can impose penalties of up to ₹250 crore for failing to take reasonable security safeguards, with lower caps for other breaches of the Act.
Is there a DPDP certification?
No. There is no official DPDP certificate. You show compliance through your notices, consent records, safeguards and breach procedures, and Significant Data Fiduciaries need periodic audits.
How is DPDP different from GDPR?
Both protect personal data and share ideas such as consent and data rights. DPDP is narrower in places, for example it relies mainly on consent and a short list of legitimate uses. AEGIS supports both on one control set.
Does AEGIS cover the DPDP Rules?
Yes. AEGIS supports India's DPDP Act and Rules alongside SOC 2, ISO 27001, GDPR and the other frameworks, all included on every plan.
Updated 22 October 2026 by the Nexus Void team.
DPDP Act with AEGIS
Get DPDP Act ready, and keep it that way.
Tell us who is asking for it and we will show you the path, and which auditors fit.