DPDP Act & Rules 2025 · operating platform
Every enterprise can describe its DPDP obligations. Very few can prove they met them.
Policies, consent banners and a privacy notice are the easy half. The hard half is proving eighteen months later, to a regulator or a complainant which notice a person saw, that their withdrawal actually stopped processing, and that three separate breach clocks were run in parallel.
DETECTION-FIRST ARCHITECTURE
The Bridge consumes verified security signals. It does not substitute for them.
- 01Finding verified
- 02Data-impact triage
- 03Parallel clocks started
- 04Evidence and approvals
The product
Five screens that answer the questions an inquiry actually asks.
Every screen produces evidence as a by-product of doing the work. There is no compliance score anywhere in the product.
Exposure ledger
Statutory maximum per penalty band where gaps exist
Penalties apply per violation and can stack. A band shows maximum statutory exposure where at least one related control is non-compliant or partial it is not a prediction of any penalty.
If you cannot answer these from a system, you will be answering them from inboxes.
"Where is our personal data?"
Not the answer from a spreadsheet last updated in 2024. The forgotten S3 bucket of KYC scans. The analyst's CSV on a file share. The remarks column full of PAN numbers no schema documents.
"Which notice did this person actually see?"
Consent is only valid against the notice presented at the time. If your consent record is a boolean and a timestamp, you cannot prove what was disclosed and the burden of proof sits with you.
"They withdrew consent, did processing stop?"
Withdrawal that updates a database row but never reaches the marketing platform, the warehouse or the processor is not withdrawal. A receipt for a withdrawal that did not take effect is evidence against you.
"Who else has my data?"
Section 11 entitles a data principal to the identities of the other fiduciaries and processors their data was shared with. Most consent tools never modelled the onward-sharing graph.
"Erase me."
Your audit log is append-only. Your warehouse has forty derived tables. Your backups have 35-day retention. Your processor has its own copy. Erasure that stops at the first database is not erasure.
"A breach was detected at 02:14. What now?"
Three obligations, three clocks, running at once. Most incident-response plans track one. The one they forget is the one owed to the citizen.
"Show us your records."
RoPA, DPIA, retention schedule, cross-border register, processor contracts mapped to the processing they cover. Assembled after the fact from email threads, they read exactly like it.
Built to be operated, not presented
Six things, each of which produces evidence as a by-product of doing the work.
Select a capability to read how it works.
Find the data before you consent it.
If your data discovery starts with a survey, you are already behind. Trust Bridge scans your estate in metadata-only mode, proposes personal-data categories and identifies the systems you forgot you had.
No query is ever issued against a personal-data column by default.
In this capability
- Metadata-only scan across all connected stores
- Identifier validation not pattern matching
- Auto-proposed categories confirmed by a named human
- RoPA auto-populated from discovery output
Claim discipline
Every capability claim traces to a test you can re-run.
Green dashboards imply compliance nobody verified. We build the opposite way.
Evidence chain · erasure against an immutable log
01
Consent granted
8f21c9a4…
02
Notice v4.3 published
b40d7e12…
03
Erasure executed
key destroyed
04
Withdrawal dispatched
c71a03f9…
05
Chain verified
independent endpoint
Record 03 was erased: the chain stores a keyed reference and erasure destroys the key the record stays provable while becoming permanently unlinkable to the person.
There is no compliant state in this product.
No score, no grade, no green tick. A register with no open items means nothing is outstanding in the platform not that your organisation complies.
Not assessed, never clean.
Where our scanner has not examined a store it says not assessed, because absence of evidence from a bounded sample is not evidence of absence.
Nothing is asserted by a machine.
Discovery proposes a data category; a named human confirms it. Purposes are never inferred no scanner can observe why an organisation processes data.
We hold a pseudonymous reference, not your customer's identity.
The platform enforces and evidences compliance without ingesting names, PANs or Aadhaar numbers. A compliance tool that becomes a breach target has failed at its own job.
The honest register
What we do not claim.
Published deliberately. Ask every vendor on your shortlist for the same.
There is no such thing as DPDP certification.
No body issues it. Any vendor claiming to hold it, or to grant it to you, is misrepresenting the framework.
We are not a Consent Manager.
Under the Act that is a specific registered entity subject to Board registration and a net-worth threshold. Registration opens in November 2026. Our software is fiduciary-side infrastructure.
Software cannot make you compliant.
Compliance is a determination about your organisation's conduct. We give you the operating rails and the evidence; accountability under Section 8(1) stays with you, and it should.
Our control mapping is an operative reading, not settled law.
Versioned, cited and reviewed with Indian data-protection counsel. Where the Act is silent we say so rather than presenting our interpretation as statute.
We cannot see inside your organisation.
Encryption at rest, key custody, internal access reviews and log retention are invisible to external verification. Where we cannot see, we report that we cannot see.
Legal advice comes from your counsel.
We are engineers. We will not tell you whether a transfer corridor is lawful or whether a retention basis holds.
There is no such thing as DPDP certification.
No body issues it. Any vendor claiming to hold it, or to grant it to you, is misrepresenting the framework.
We are not a Consent Manager.
Under the Act that is a specific registered entity subject to Board registration and a net-worth threshold. Registration opens in November 2026. Our software is fiduciary-side infrastructure.
Software cannot make you compliant.
Compliance is a determination about your organisation's conduct. We give you the operating rails and the evidence; accountability under Section 8(1) stays with you, and it should.
Our control mapping is an operative reading, not settled law.
Versioned, cited and reviewed with Indian data-protection counsel. Where the Act is silent we say so rather than presenting our interpretation as statute.
We cannot see inside your organisation.
Encryption at rest, key custody, internal access reviews and log retention are invisible to external verification. Where we cannot see, we report that we cannot see.
Legal advice comes from your counsel.
We are engineers. We will not tell you whether a transfer corridor is lawful or whether a retention basis holds.
There is no such thing as DPDP certification.
No body issues it. Any vendor claiming to hold it, or to grant it to you, is misrepresenting the framework.
We are not a Consent Manager.
Under the Act that is a specific registered entity subject to Board registration and a net-worth threshold. Registration opens in November 2026. Our software is fiduciary-side infrastructure.
Software cannot make you compliant.
Compliance is a determination about your organisation's conduct. We give you the operating rails and the evidence; accountability under Section 8(1) stays with you, and it should.
Our control mapping is an operative reading, not settled law.
Versioned, cited and reviewed with Indian data-protection counsel. Where the Act is silent we say so rather than presenting our interpretation as statute.
We cannot see inside your organisation.
Encryption at rest, key custody, internal access reviews and log retention are invisible to external verification. Where we cannot see, we report that we cannot see.
Legal advice comes from your counsel.
We are engineers. We will not tell you whether a transfer corridor is lawful or whether a retention basis holds.
There is no such thing as DPDP certification.
No body issues it. Any vendor claiming to hold it, or to grant it to you, is misrepresenting the framework.
We are not a Consent Manager.
Under the Act that is a specific registered entity subject to Board registration and a net-worth threshold. Registration opens in November 2026. Our software is fiduciary-side infrastructure.
Software cannot make you compliant.
Compliance is a determination about your organisation's conduct. We give you the operating rails and the evidence; accountability under Section 8(1) stays with you, and it should.
Our control mapping is an operative reading, not settled law.
Versioned, cited and reviewed with Indian data-protection counsel. Where the Act is silent we say so rather than presenting our interpretation as statute.
We cannot see inside your organisation.
Encryption at rest, key custody, internal access reviews and log retention are invisible to external verification. Where we cannot see, we report that we cannot see.
Legal advice comes from your counsel.
We are engineers. We will not tell you whether a transfer corridor is lawful or whether a retention basis holds.
Questions we get asked
Turn your next cyber drill into an obligation drill.
Most incident-response drills test detection and containment. Almost none test whether the three DPDP clocks start, whether the right owner is paged for the data-principal intimation, or whether closure evidence would survive a Board inquiry.