Data Protection: DPDP Act and GDPR Compliance

Who this is for

Small and medium technology companies, and other companies outside India, that need to comply with Indian law.

What we handle

DPDP Act gap assessments and compliance programs
Data protection impact assessments
Privacy notices, consent framework and cookie notices
Data processing agreements and cross-border transfer documentation
GDPR compliance mapping alongside Indian law
Data breach response planning and notification advice
Submissions before the Data Protection Board of India
Employee and vendor data protection training
Ongoing compliance support

How the work runs

Scope and confidentialityWe confirm the work in writing, under a non-disclosure agreement where you are outside India.
Map your dataWe record what personal data you collect, why, where it goes and who handles it.
Assess against the lawWe compare your practices with the Indian requirements, and map them to GDPR where that also applies to you.
Fix and documentWe prepare the notices, agreements and internal steps, and set priorities in order of risk.

Questions

Does the DPDP Act apply to foreign companies?

It can apply to companies collecting data in India and processing outside India where the processing relates to offering goods or services to individuals in India. Whether it applies depends on the facts and the organization’s activities.

Do we need both DPDP and GDPR compliance?

Possibly. A business with Indian data activities and EU-linked operations, customers or data flows may need to assess both. We advise on Indian law and map its requirements to GDPR, but we do not act as EU-law counsel.

What is a data protection impact assessment?

A structured assessment that helps identify and reduce privacy risk before or during a processing activity, product launch or technology deployment.