Founding-customer offer:25% off your first year on annual plans confirmed before 31 March 2027.Talk to us
INDIA · DPDP ACT
DPDP obligations apply from May 2027. Know where you stand now.
Fortress maps the personal data you hold to the DPDP obligations and shows the gaps, in one workspace.
Talk to a specialist first — we set up your workspace with you.
Or take the free DPDP readiness checkWhat you have to do
The four obligations we see organisations start with.
- 01
Serve a clear notice: what personal data is collected, the purpose, and how to withdraw consent.
DPDP Act - 02
Provide the rights of access, correction and erasure, grievance redressal and nomination.
DPDP Act - 03
Apply reasonable security safeguards to protect personal data.
DPDP Act - 04
Report personal data breaches to the Data Protection Board and to affected data principals.
DPDP Act
Source: DPDP Act, 2023 — see /frameworks/dpdp for the full list of requirements.
How Risknox handles it
Four modules carry the DPDP program in Fortress.
Data inventory
Find where personal data sits. The scan agent reports counts and locations only, never the data itself.
Processing records (RoPA)
Every processing activity, with maker-checker approval.
Consent
Notices and consent records, so the consent you rely on can be shown.
Rights requests
Access, correction, erasure and grievance, each with its due date.
What it costs
Talk to us for pricing.
Pricing depends on the programs you run and the number of seats. We scope it on a short call.
Book a 20-minute walkthroughBook a walkthrough
Twenty minutes on your DPDP position.
We look at where your personal data sits, which obligations you can evidence today, and what to fix first. No slides.
Questions we get asked
When do DPDP obligations start?+
The DPDP Rules were notified in November 2025 and bring obligations into force in stages: Consent Manager provisions from November 2026, and most remaining obligations from May 2027. Confirm the current position with counsel before relying on a date.
Does the DPDP Act apply to my company?+
If you process digital personal data in India, yes, regardless of where you are incorporated. The Act covers processing carried out in India and processing abroad that is connected to offering goods or services to people in India.
What is the difference between a Data Fiduciary and a Data Processor?+
A Data Fiduciary decides the purpose and means of processing and carries the Act’s obligations. A Processor handles data only on the Fiduciary’s instructions, under a valid contract. The same company can be both, for different data.
Can we start with DPDP alone?+
Yes. Fortress DPDP covers DPDP only: inventory, processing records, rights, breach and DPIA. Other programs can be added to the same workspace later, and shared controls are not re-entered.