OUR SERVICES
Our methodology is grounded in the ICAI DPCAC framework — the data protection compliance and audit standard developed by the Institute of Chartered Accountants of India with globally recognised ISACA-aligned audit and governance principles.
We follow a structured, evidence-based approach covering data governance, consent management, security controls, vendor risk, and incident response — helping organisations build practical compliance programmes that can withstand regulatory and audit scrutiny.
Step 1
Know Where You Stand
DPDPA Gap Assessment
We assess your current data practices across key compliance areas including data inventory, consent, privacy notices, data rights, retention, vendor risk, security safeguards, breach readiness, children’s data, and governance accountability.
Each area is evaluated against the DPDPA and Rules, maturity-rated, and risk-scored.
Deliverables:
- Personal data inventory — categories, systems, purposes, data flows
- Gap assessment across DPDPA compliance areas
- Maturity rating per area — Ad Hoc / Defined / Optimised
- Risk rating — Critical / High / Medium / Low, with potential regulatory exposure identified
- Prioritised action roadmap — phased with timelines
- Dedicated debrief session
Step 2
Build Your Compliance Programme
DPDPA Implementation Advisory
We work alongside your team to build a practical DPDPA compliance framework covering consent management, Section 8 obligations, data principal rights, vendor governance, and the documentation needed for management, audit, and regulatory readiness.
Deliverables:
- Consent architecture advisory as per Section 6
- Privacy Notice — Rule 3 compliant
- Core policy suite — Privacy Policy · Data Retention & Deletion Policy · Breach Response SOP · Data Principal Rights SOP
- Vendor risk classification and Data Processing Agreement advisory aligned with Section 8 obligations
- Employee awareness session
- Compliance evidence folder advisory
- 3 months post-advisory support
Step 3
Stay Protected
Virtual DPO & Ongoing Advisory
Practical ongoing privacy and compliance support — without the cost of a full-time in-house function.
Deliverables:
- Virtual DPO advisory support to the company-designated privacy point of contact
- Quarterly compliance reviews
- DPDP Act and Rules update briefings
- Breach response advisory, including notification guidance under applicable Rule 7 requirements
- Support for Data Principal requests — access, correction, erasure, and grievance handling in line with applicable DPDPA requirements
- Annual DPDPA compliance review report
- On-call advisory — WhatsApp / email within 24 business hours
Step 4
Independent DPDPA Audit & DPIA
For Significant Data Fiduciaries — Section 10, Rule 13
Significant Data Fiduciaries are required under Section 10(2)(b) to engage an independent data auditor and under Rule 13 to conduct an annual DPIA — with significant observations reported to the Data Protection Board and the Audit Committee.
The audit examines both design adequacy and operating effectiveness across all statutory compliance areas.
For Significant Data Fiduciaries
- Consent & Notice — Section 4–6, Rule 3
- Data Fiduciary obligations — Section 8, Rules 6–8
- Children’s data controls — Section 9, Rules 10–12
- Data Principal rights — Sections 11–14, Rule 14
- Data Processor oversight — Section 8(2)– (3)
- Technical and organisational measures — Rule 6
- Breach detection and notification readiness — Rule 7
- Governance and accountability framework — Section 8(4)
DPIA — Six-Step Methodology
- Step 1: Identify high-risk processing activities
- Step 2: Document processing — data categories, purposes, legal basis, data flows
- Step 3: Assess necessity and proportionality
- Step 4: Identify and score risks to Data Principal rights
- Step 5: Document mitigation measures — technical, organisational, procedural
- Step 6: Formal DPIA report with sign-off
Deliverables:
- Independent data audit report across all statutory areas
- DPIA report — as per ICAI methodology
- Significant observations report to the Data Protection Board — Rule 13(2)
- Audit Committee reporting
- Management action tracker with remediation timelines
Not sure where to begin?
Book a 30-minute advisory session — we will tell you exactly which step is right for your business today.
Our services are advisory and implementation-support oriented and do not constitute legal opinion or statutory certification unless specifically agreed in writing.