FAQ
Questions we get asked
About the law, our products, where your data is kept and how to buy. If your question isn’t here, email us.
The DPDP Act
Does the DPDP Act apply to us?
If you handle digital personal data in India, yes, whatever your size or sector. It also applies to organisations outside India that sell goods or services to people in India.
When do the obligations become enforceable?
The Consent Manager provisions apply from 13 November 2026. The core obligations (notice, security, breach reporting, retention, rights and children's protections) apply from 13 May 2027.
What are the penalties?
Up to ₹250 crore for not keeping data safe, and up to ₹200 crore each for not reporting a breach and for mishandling children's data.
We already follow RBI, IRDAI or health-sector rules. Is that enough?
Not on its own. The Act adds to your sector rules. Where they disagree, the stricter one usually wins, and working that out is most of the job.
Is a privacy policy on our website enough?
No. The Act says you must tell people what you collect and why before you collect it, and let them withdraw as easily as they agreed. Your systems either do this or they don't, and a policy can't show which.
The platform
Do we have to buy every product?
No. Each product works on its own. Most teams start with the PII Scanner and Assessments to see where they stand, then add other products where the gaps are.
We already have a vault, or a consent tool. Can we keep it?
Yes. We connect to it and test it the same way we test ours. You don't have to switch to prove compliance.
Does using the platform make us compliant?
No tool can do that on its own. The platform shows what applies to you, tests what can be tested and keeps the proof. Compliance is what your organisation does with it.
How long does it take to get started?
A first scan and assessment can be done in days. Connecting systems for testing depends on how many you have and who looks after them.
Data, hosting and security
Where is our data hosted?
You choose: on your servers run by your team, on your servers run by ours, or in our cloud in India. The contract says where it runs and who else can access it.
Who holds the encryption keys?
On your servers, the keys stay in your own key service and never reach us. In our cloud, every customer has their own keys, kept in India and changed automatically.
Can you see our compliance results?
Only if we run the service for you, and then only as the agreement allows. We never compare customers or pool their data.
Is the platform itself certified?
We list our security measures in the agreement rather than point to a badge. Ask us about any certification you need and we'll answer in writing.
Buying
How is it priced?
By the products you use, how you run them and how many systems you have. We'd rather see your setup in a short session than quote from a form.
What happens in a demo?
45 minutes on your own material. Bring a notice or consent form you use today and we'll check it live.
Products
PII Scanner
Does the scanner copy our data anywhere?
No. It reads a small sample where the data sits, works out what kind of data it is, and records the result with the value hidden. Only the list of findings leaves the machine, never the data.
Can we run it without connecting to the cloud service?
Yes. You can export the results as an encrypted file and upload it by hand. This suits networks with no internet access.
What if it flags something that isn't personal data?
You mark it as a wrong match and say why. The reason is kept, so the next person can see the decision.
Data Map
Do we have to fill the map in by hand?
Partly. The scanner fills in where data is kept. Why you use it and who you share it with are business decisions, so someone has to confirm them. Sector templates mean you start from a draft.
How is this different from a spreadsheet register?
The map is linked to everything else. Tests run against the systems on it, and consents are checked against the reasons on it.
Privacy Vault
Do our applications have to change?
A little. Where an app stored the real value, it stores a token instead and asks the vault only when it needs the real value. Most screens and reports work fine with tokens or partly hidden values.
Who can see the real value?
Only people and systems your rules allow, for a stated reason. Everyone else sees a hidden value or nothing. Every look at a real value is recorded in a log that can't be changed.
Can we search on encrypted fields?
Yes, for exact matches and searches on the start of a value, without unlocking the whole table. You can also make sure a value such as an email address is unique.
Is it only for personal data?
No. Any field you declare can go in: bank details, health records, API secrets, contract terms.
Retention & Erasure
What if the DPDP Act says delete and another law says keep?
Both apply. You keep what the other law requires, for as long as it requires, and use it only for that. The record shows which law and until when.
Does erasure cover backups?
With the Privacy Vault, yes. Each person's data is locked with its own key. Deleting it destroys the key, so old backups can't be read. Systems outside the vault are tracked and tested separately.
Consent Manager
Is this a registered Consent Manager under the Act?
No. Under the Act, a Consent Manager is a company registered with the Data Protection Board. This product is the record and tools you use to manage consent yourself. It can work alongside a registered Consent Manager.
Do we have to replace our sign-up forms?
No. Your forms stay as they are. They send us a message when someone agrees, and we record it with the purpose and notice version.
What happens when someone withdraws?
The consent ends, the person gets a receipt, and every system that relied on it is told. Live Testing can check that those systems really stopped.
Privacy Centre
Do our customers need an account?
No password. They sign in with a one-time code sent to the email or phone number you hold for them.
Are the translations reviewed?
English is reviewed. Other languages are marked as machine translations on every page until a native speaker has checked them.
Assessments
Is this a questionnaire?
It starts like one. But where something can be tested on your systems, Live Testing does that, and a test result counts for more than an answer.
Can we compare our score with other companies?
No, on purpose. We never look across customers. Your results are yours alone.
Live Testing
Will tests change production data?
Each test says what it needs and what it touches before you run it. You choose which systems are connected and which tests run. Nothing runs on a system you haven't connected.
What if a system has no API?
Someone checks by hand and records who checked, what they saw and when. It counts, and it's labelled as a manual check.
Breach Response
Who has to be told about a breach?
Under the Act, the Data Protection Board and each person affected. Your sector regulator may also need to know, often sooner.
Vendor Risk
Can we contract our liability away to a vendor?
No. You stay responsible for what a supplier does with the data you give them. A contract can decide what you claim back from them, not what the Board holds you to.
Answers about the law are a plain-English summary of the Act, not legal advice.
Still have a question?
Ask us in a short call. We'll answer with your own setup in front of us.