Turn DPDP obligations into everyday operations.
iConsent helps organisations meet India’s Digital Personal Data Protection Act and Rules through connected workflows for notice, consent, rights, data visibility, risk and evidence, so compliance is something you run, not something you document once.
- Built around the DPDP Act, 2023 and DPDP Rules, 2025
- Obligations mapped to working workflows
- Evidence recorded as part of normal operations
Compliance Overview
| Obligation | Status | Owner | |
|---|---|---|---|
| Notice & Consent | On track | Legal | |
| Data Principal Rights | On track | Privacy Team | |
| Grievance Redressal | On track | Compliance | |
| Children’s Data | Review | Product | |
| Retention & Erasure | In progress | IT |
The compliance clock is already running.
The Government has notified the DPDP Rules, and together with the related notifications this means phased implementation of the DPDP Act and Rules over the next 18 months, i.e. by May 2027. Organisations that start now have time to build working processes rather than rushing to document them.
- November 2025
Foundations
The Rules are notified and a Data Protection Board is established, responsible for investigating breaches of DPDP and imposing penalties based on the intensity and nature of the violation.
- November 2026
Consent Managers
Provisions for registered Consent Managers come into effect.
- May 2027
Full obligations
The substantive duties apply, including notice and consent, breach reporting, reasonable security safeguards, verifiable consent for children’s data, the obligations on Significant Data Fiduciaries, and the rules on cross-border transfer.
From legal requirement to working control.
Each DPDP obligation needs an owner, a process and evidence. Here is how the iConsent suite supports them.
| DPDP obligation | How iConsent supports it |
|---|---|
| Notice | Publish clear, itemised notices linked to data categories, purposes and journeys, with version history. |
| Consent | Capture specific, informed consent purpose by purpose, with source, channel and timestamp. |
| Withdrawal | Give Data Principals a withdrawal route as easy as giving consent, and sync the decision to connected systems. |
| Data Principal rights | Receive, verify, route and close access, correction and erasure requests with a full audit trail. |
| Grievance redressal | Track grievances from receipt to resolution against defined timelines. |
| Children’s data | Identify children’s data through classification and support verifiable parental consent journeys. |
| Existing data | Notify existing Data Principals about data already collected and offer a withdrawal route. |
| Retention & erasure | Apply retention expectations by data category and track deletion actions. |
| Security safeguards | Assess security and vendor risks, assign treatments and record evidence. |
| Significant Data Fiduciary duties | Support periodic DPIAs, risk assessments and audit preparation. |
| Accountability | Keep notice versions, consent events, rights actions and administrative changes in one evidence record. |
Compliance as a continuous cycle.
- 01
Assess
Discover personal data, classify it and map processing activities in RoPA.
- 02
Implement
Publish notices, configure consent journeys and connect systems through APIs.
- 03
Operate
Handle consent changes, rights requests and grievances as daily workflows.
- 04
Evidence
Record every notice version, decision and action automatically.
- 05
Review
Reassess risk, update records and adapt as the business and regulations change.
Every module plays a part.
iConsent
Notice, consent, preferences, withdrawal, rights and grievance workflows.
iDiscovery
Find where personal data lives across systems and repositories.
Data Classification
Understand what the data is, how sensitive it is and why it exists.
RoPA
Maintain a living record of processing activities.
Risk Assessment & DPIA
Evaluate privacy and organisational risk and track treatment.
Cookie Management
Manage cookie consent and preferences on your websites.
A consistent way to compare risks.
Every risk is scored on likelihood and impact to produce an inherent risk rating. Once treatments are in place, a residual rating shows what risk remains, so leadership can decide whether it sits within the organisation’s appetite.
Be ready when someone asks for proof.
Regulators, auditors and enterprise customers increasingly ask organisations to show what they did, not just what their policy says. iConsent keeps the evidence as part of normal operations.
Evidence Record
Technology supports compliance. People own it.
No platform makes an organisation compliant on its own. iConsent gives your teams the workflows, records and visibility to meet DPDP obligations, while legal interpretation, policy decisions and accountability remain with your organisation and its advisers.
DPOs & privacy teams
One view of obligations, actions and evidence.
Legal & compliance
Clear records to support advice, audits and regulatory queries.
IT & security
Defined integrations and risk treatments to implement.
Business teams
Simple workflows that fit into existing journeys.
FAQs
No platform can guarantee compliance on its own. iConsent provides the workflows, controls and evidence your teams need, while legal interpretation and accountability remain with your organisation.
Implementation of the DPDP Act and Rules is phased over 18 months from notification, running to May 2027. Most substantive obligations, including notice, consent, rights and security safeguards, apply at the end of that period.
Yes. Retrospective consent outreach lets you notify existing Data Principals about data already collected and offer a route to withdraw.
No. Many organisations start with discovery, RoPA and consent, then add classification, risk and cookie management as their programme matures.
Make compliance something you can show, not just say.
See how the iConsent suite turns DPDP obligations into connected, evidenced workflows.
