// dpdp
DPDP security gap assessment
India's Digital Personal Data Protection Act makes security of personal data a legal duty. We review where your controls stand against it — well before the 13 May 2027 compliance deadline — and give you a prioritised plan to close the gaps.
// scope
What's in scope
We scope every engagement in person-days against your real attack surface. Here's what a typical test of this kind covers.
- Personal data inventory and data-flow mapping
- Access controls and least-privilege review
- Encryption at rest and in transit
- Retention limits and deletion processes
- Consent and purpose-limitation in your systems
- Breach detection and response readiness
- Review of your incident-reporting plan against CERT-In timelines
- Grievance-handling and data-principal rights workflows
- Formal legal advice (we assess security controls, not legal opinion)
- Full ISO 27001 certification audit (we align, we don't certify)
// method
How we test it
Manual-first, grounded in our five-stage methodology. Scanners cover ground; a person reproduces and proves every finding.
- 01
Discover
Workshops and reviews to map what personal data you hold, where it lives and who can reach it.
- 02
Assess
Measure your technical and organisational controls against DPDP's security obligations.
- 03
Report & plan
A gap report with risk-ranked actions and a realistic roadmap to the 2027 deadline.
// deliverables
What you get
A report a developer can act on and a manager can understand — plus a free retest to confirm the fixes.
- Data inventory and data-flow diagram
- Gap assessment against DPDP security obligations
- Risk-ranked remediation roadmap with owners and effort
- Breach-response and CERT-In reporting checklist
- A readout for leadership and the technical team
// faq
Common questions
Is this legal advice?
No. We assess and improve the security controls DPDP requires. For legal interpretation, pair us with your counsel — we work well alongside legal teams.
How does this relate to a pentest?
A pentest proves whether controls actually hold up. Many clients run the DPDP assessment first, then a pentest on the systems handling personal data.
We're a small team — is this overkill?
No. We scale the assessment to your size. The point is a clear, affordable path to compliance, not a 200-page binder.
Beat the DPDP deadline
Share your targets and timeline and we'll reply with a scope and a quote. Most scoping calls take thirty minutes.