Software + consultancy-led implementation
DPDP compliance, made operational.
DPDP Ledger gives your organisation one system to assess obligations, assign remediation, manage Data Principal requests and maintain evidence—with implementation guidance from an experienced advisory team.
Registration requires email verification and consultancy approval. No card or online payment is required.
- Current regulatory status
- DPDP Rules 2025 notified
- Transition
- Phased commencement
- Main operational obligations
- Scheduled for May 2027
- Recommended next step
- Establish your processing record and implementation owners
Source: DPDP Act 2023, commencement notification and DPDP Rules 2025. See official references.
- Applicability first
- Named ownership
- Reviewable evidence
- Continuous operations
01 / The operating problem
Compliance is a programme. Not a policy download.
DPDP implementation spans business owners, technology systems, processors, notices, requests and incident response. A spreadsheet can record a decision; it cannot reliably run the programme around it.
- 01
Obligations remain abstract
Teams know the Act applies, but not which controls belong to which processing activity or business owner.
- 02
Evidence loses its context
Policies, screenshots, contracts and approvals sit across inboxes and shared drives without a clear review history.
- 03
Operational deadlines become inboxes
Rights requests, grievances and breaches need timestamps, escalation and closure evidence—not another unmanaged mailbox.
02 / The platform
One ledger of obligations, actions and evidence.
Build the record once, assign the work and preserve the history as your organisation changes.
- 01
Applicability and processing records
Assess relevant DPDP obligations and maintain records of processing activities, systems, purposes, Data Principal categories and transfers.
Operational record: Applicability decisions, processing register and ownership.
- 02
Controls, tasks and evidence
Convert applicable obligations into owned tasks and recurring controls. Link current evidence, review decisions and remediation history.
Operational record: Control register, evidence trail and risk actions.
- 03
Notice and consent governance
Version notices, track purposes and collection channels, and manage withdrawal-related work without treating consent as a one-time banner.
Operational record: Notice versions, consent-governance records and withdrawal actions.
- 04
Rights and grievances
Record access, correction, erasure, nomination and grievance workflows with verification status, ownership, communications and due-date escalation.
Operational record: Request register, response chronology and closure evidence.
- 05
Breach response
Capture the original awareness timestamp and coordinate affected-party and Board intimation work. Track initial actions separately from the detailed 72-hour reporting checkpoint.
Operational record: Incident chronology, notification record and intimation pack.
- 06
Processors, retention and enhanced obligations
Track processor safeguards, cross-border processing, retention decisions and conditional controls for children's data and Significant Data Fiduciaries.
Operational record: Vendor register, retention schedule and conditional review cycles.
04 / The advisory model
Technology keeps the record. Professionals guide the work.
DPDP Ledger is delivered through a consultancy-led engagement. Your team retains accountability for implementation; the advisory team provides structure, challenge and documented review within the agreed scope.
- 01
Establish scope
Understand the organisation, processing context, current programme and applicable obligations.
- 02
Build the record
Document processing activities, systems, processors, notices, retention and existing safeguards.
- 03
Implement and review
Assign remediation, provide evidence and record consultancy review decisions, exclusions and unresolved items.
- 04
Operate and reassess
Run recurring controls, rights and incident workflows, and reassess when systems, purposes or regulations change.
Consultancy review is not government approval or a certification of legal compliance. Formal legal opinions, where required, are provided or coordinated through appropriately qualified legal counsel under the applicable engagement.
05 / Regulatory reference
What the DPDP framework expects—and what the platform records.
The table below is a plain-language orientation, not a substitute for the legislation or advice on your specific processing activities.
| Area | Plain-language reference | DPDP Ledger workflow |
|---|---|---|
| Notice | Clear notice describing personal data, specified purposes and available rights/complaint methods | Notice drafting, versioning, approval and publication records |
| Consent and legitimate uses | Consent-based processing and applicable legitimate uses must be distinguished | Purpose, collection-channel and consent-governance records |
| Security safeguards | Appropriate technical and organisational safeguards, including processor-related controls | Control ownership, safeguard evidence and processor review |
| Personal data breaches | Affected-party intimation and staged Board reporting, including the detailed 72-hour checkpoint | Awareness timeline, escalation, templates and intimation packs |
| Retention and erasure | Purpose-based retention and erasure, with conditional statutory retention/inactivity requirements | Retention schedules, legal holds and deletion attestations |
| Rights and grievances | Access, correction, updating, erasure, nomination and effective grievance handling | Intake, verification, ownership, response and closure records |
| Children and guardians | Verifiable consent and related safeguards, subject to applicable exemptions | Conditional assessment, method records and supporting evidence |
| Significant Data Fiduciaries | Additional obligations such as DPO/auditor arrangements, DPIA, audits and technology due diligence | Conditional SDF workspace, annual cycles and review evidence |
| Cross-border processing | Transfers remain subject to applicable government orders and any notified restrictions | Transfer register and counsel-reviewed restriction records |
- Digital Personal Data Protection Act, 2023 — MeitY
- G.S.R. 843(E), commencement notification dated 13 November 2025 — MeitY
- G.S.R. 846(E), Digital Personal Data Protection Rules, 2025 — MeitY
- Government notification overview — Press Information Bureau, 14 November 2025 (secondary explanatory material)
Legal mapping — sections and rules
- Notice: DPDP Act section 5; DPDP Rules rule 3.
- Consent and withdrawal: section 6; legitimate uses: section 7.
- General Data Fiduciary obligations: section 8; security safeguards: rule 6.
- Breach notification: section 8 and rule 7.
- Retention: section 8 and rule 8, with applicable schedules.
- Children: section 9 and rules 10–12.
- Significant Data Fiduciaries: section 10 and rule 13.
- Data Principal rights: sections 11–14 and rule 14.
- Cross-border transfer: section 16 and rule 15.
06 / Major timelines
Regulatory content reviewed: November 2026
Separate the statutory dates from your implementation plan.
- 11 AUG 2023
DPDP Act enacted
Parliament enacts the Digital Personal Data Protection Act, 2023.
- 13 NOV 2025
Rules notified; phased commencement begins
The DPDP Rules and commencement notification are published. Initial provisions, including the institutional framework, commence according to the notification.
- 13 NOV 2026
One-year provisions
The consent-manager-related provisions identified in the commencement notification reach their one-year commencement point.
- MAY 2027
Principal operational obligations
The main Data Fiduciary operating provisions are scheduled to commence eighteen months after Gazette publication. An exact day is displayed only after counsel confirms the calculation and current notification position.
- DPDP Ledger milestone — not a statutory deadline31 MAR 2027
DPDP Ledger planned client launch
This is DPDP Ledger's product/engagement milestone, not a statutory deadline. It is kept visually distinct from the statutory chronology.
Dates reflect the notified phased-commencement framework as last reviewed on 5 November 2026. Subsequent notifications or orders may change applicability or timing. Confirm your organisation's position with a qualified adviser.
07 / Your implementation window
Start with the record. Finish with an operating programme.
A sensible sequence reduces late remediation and gives business owners time to implement changes in source systems.
| Stage | Indicative focus | Tangible output |
|---|---|---|
| Establish | Applicability, processing inventory and ownership | Baseline record and priority gaps |
| Remediate | Notices, safeguards, contracts, retention and procedures | Assigned actions with reviewable evidence |
| Exercise | Rights, grievance and breach-response drills | Tested workflows and unresolved-action log |
| Operate | Recurring reviews, source-system changes and regulatory updates | Maintained programme and review history |
Timing depends on organisational complexity, client inputs and source-system remediation. Fixed completion in a specific number of days is not promised.
08 / Security by design
Compliance metadata belongs in the platform. Your production database does not.
DPDP Ledger is designed to store processing records, obligations, evidence and workflow history—not a copy of your customer or employee database. Tenant isolation, role-based access, audit history and encrypted storage are core product requirements.
- Tenant separation
- Server-side access controls isolate each client workspace.
- Controlled access
- Assigned consultancy teams and client roles receive only authorised access.
- Traceable activity
- Registration, review, evidence and workflow actions retain an audit history.
- Data minimisation
- Public intake and evidence workflows discourage unnecessary Data Principal information.
09 / Fit
Built for organisations that need accountability across teams.
DPDP Ledger is suited to organisations where customer, employee and vendor data moves across several systems—and where implementation requires coordination between leadership, compliance, IT and business owners.
Likely fit
- Public listed companies and private limited companies.
- Government-run companies and public sector undertakings, including Navratna and Maharatna enterprises.
- E-commerce, SaaS and consumer-service businesses.
- Professional-services and mid-market organisations.
- Teams with scattered compliance records and unclear ownership.
- Organisations seeking software plus guided implementation.
Requires a specialist scoping conversation
- Children's-data-heavy services.
- Organisations likely to be notified as Significant Data Fiduciaries.
- Complex international transfer environments.
- Businesses seeking a formal legal opinion rather than compliance operations support.
10 / Registration
Tell us about your organisation. We'll review the fit.
DPDP Ledger does not use self-serve pricing or instant tenant activation. Registration helps the consultancy understand your organisation and propose an appropriate software and services scope.
- 01
Submit the registration form
Provide business contact details, organisation information and a high-level view of your compliance needs. Do not submit customer datasets or identity documents.
- 02
Verify your email
Use the single-use verification link sent to your work email.
- 03
Consultancy review and activation
The team may request clarification, reject the application or approve it. Approval creates your client workspace and activation workflow.
Pricing and engagement scope are discussed after registration. No card or online payment is required.
FAQs
Questions we are usually asked first.
Does DPDP Ledger certify that my organisation is compliant?
No. The platform records readiness work, evidence and consultancy review. It does not provide government approval or a guarantee of legal compliance.
Is DPDP Ledger a law firm?
DPDP Ledger is a consultancy-led software and services offering. The scope of professional advice is defined in the engagement. Formal legal opinions require appropriately qualified legal counsel.
Is DPDP Ledger a Consent Manager under the DPDP framework?
No. The initial product supports notice and consent-governance records; it does not provide registered Consent Manager services.
Do you need a copy of our customer or employee database?
No. The platform is designed for compliance metadata and evidence. Avoid uploading raw production datasets or unnecessary identity documents.
Can the platform file a breach report directly with the Data Protection Board?
The initial product prepares and records intimation packs and filing details. It does not claim direct Board filing unless an official supported integration is introduced.
Why is pricing not listed?
The software and advisory scope depend on your organisation, processing environment and required support. Registration is the first step in defining that scope.
When should we start?
Before the operational provisions commence. Assessment, ownership and source-system remediation take time; the appropriate start depends on your current programme and applicability.