Your servers, your team
You run it on your servers. We never see your data.
DPDP compliance for India
Know your data. Protect it. Prove it.
DPDP Vault helps you follow India’s data protection law. We check your real systems, not just your paperwork, and keep the proof.
Why now
The deadline is close and the fines are big
The DPDP Act applies to every organisation that holds personal data about people in India. Big or small.
13 November 2026
Consent rules start. Get your consent process ready first.
13 May 2027
The rest of the law starts. The full law applies. Every part of it can be enforced.
₹250 CrPoor security. Not keeping data safe, including at your suppliers.
₹200 CrNot reporting a breach. Not telling the regulator or the people affected.
₹200 CrChildren's data. Not getting a parent's consent when you should.
₹150 CrLarge data holders. Missing the extra rules for organisations the government names.
These are the highest fines. The real amount depends on how serious the problem is.
Products
Pick what you need
Each product does one job. Use one, or use them all together.
See all products
The problem
Deleting data is harder than it looks
A customer asks you to delete their data. Your app deletes it and says it’s done.
But copies are often left behind in other systems. Nobody notices until the customer asks what you still have.
Under the law, you must prove it. A policy document is not proof.
How it works
Four simple steps
We do most of the work on your real systems, not on forms.
Find your data
We find the personal data in your systems, including copies you forgot about.
See where it goes
We record which systems and suppliers use the data, and why.
Fix and test
We find the gaps. Then we test your systems to check the fixes really work.
Keep the proof
Every test is saved with a date. When someone asks for proof, you have it.
Privacy Vault
Keep personal data in one safe place
The vault stores the real data in one safe place. Your other systems get a code instead. Your apps keep working, and only the right people see the real data.
- Fewer copies to protect. Fewer copies means fewer places for a leak to start.
- Easy deletion. When a customer says stop, the vault deletes their data everywhere and checks it worked.
- Quick answers. When a customer asks what you hold, you search once instead of asking ten teams.
Common mistakes
Four things that catch people out
Data doesn't fully delete
Your app deletes the record, but copies stay in backups, reports and suppliers' systems.
Two laws can disagree
One law says delete. Another says keep it for years. You need to follow both and write down why.
A data leak has several deadlines
Different people must be told at different times. The earliest deadline is the one that counts.
Your regulator still matters
Your industry's rules still apply. Where they are stricter, they win.
Your industry
Your industry has its own rules too
You still follow your industry’s rules. Where they are stricter, they win.
BFSI & FinTechHealthcare & pharmaEducation & EdTechE-commerce & retailIT & SaaSTelecomManufacturingTravel & hospitalityProfessional services
Deployment
Run it your way
On your servers or in our cloud in India. It’s the same product either way.
Your servers, our team
It runs on your servers. We look after it for you.
Our cloud
We host and run it for you in India.
Does the DPDP Act apply to us?
If you handle digital personal data in India, yes, whatever your size or sector. It also applies to organisations outside India that sell goods or services to people in India.
When do the obligations become enforceable?
The Consent Manager provisions apply from 13 November 2026. The core obligations (notice, security, breach reporting, retention, rights and children's protections) apply from 13 May 2027.
Do we have to buy every product?
No. Each product works on its own. Most teams start with the PII Scanner and Assessments to see where they stand, then add other products where the gaps are.
We already have a vault, or a consent tool. Can we keep it?
Yes. We connect to it and test it the same way we test ours. You don't have to switch to prove compliance.
See it working on your own systems
A 45-minute working session. Bring a notice or consent form you use today and we will check it with you.