DPDP Act Compliance
Build data protection into the product, not around it.
We help Indian businesses make applications, data stores and AI systems ready for the Digital Personal Data Protection Act: map personal data, build consent and notices, handle access and erasure requests and set retention rules.
- Data mapping
- Consent and notices
- Access and erasure
Free 30-minute call with a senior specialist. Reply within one business day. Based in Jaipur, working with businesses across India.
- Discovery callFree 30 minutes with a senior specialist
- Scoped first phaseWritten scope, timeline and fixed price
- Build with weekly demosWorking software you can see every week
- Launch and supportGo-live with your team ready, then ongoing support
What does DPDP Act compliance mean for software?
The Digital Personal Data Protection Act, 2023 sets duties for organisations that process digital personal data in India, including notice, consent, security safeguards, handling of access and correction requests and breach response. For software, this means building consent, data mapping, retention and audit features into products. This is engineering guidance, not legal advice.
Last reviewed 30 October 2026 by the Stack18 delivery team in Jaipur.
You need this when…
Tap the ones that apply to you.
DPDP Act Compliance, end to end.
Each capability is delivered by the same team on the Agentic SDLC, with your approval at every critical step.
Data mapping and risk
Know what you hold and where it flows.
- Personal data inventory
- Flow map across systems and vendors
- Risk and priority list
Consent and notices
Capture and prove consent.
- Purpose-specific consent capture
- Notice display and versioning
- Consent withdrawal handling
Rights and retention
Handle requests on time.
- Access and correction workflows
- Erasure and retention rules
- Request tracking and SLA alerts
Security safeguards
Technical controls that stand up to review.
- Access control and encryption
- Audit logging
- Breach response runbook
AI and vendor controls
Keep AI and third parties inside the rules.
- PII redaction before AI calls
- Vendor data-processing review
- Model and prompt data policies
A typical engagement, step by step.
Senior people lead every phase. Specialised AI agents on the Agentic SDLC handle the repetitive work, and nothing ships without your approval.
Discovery
Map how data protection compliance works today, the systems and data involved, and agree the first measurable outcome.
Design
Design the workflows, roles, integrations and approval points for data protection compliance.
Build in weekly demos
Your team sees working data protection compliance software every week, with changes agreed in the open.
Launch and support
Data migration, training, go-live support and a measured 30-day review against the baseline.
Start small. Scale when it works.
Every engagement begins with a short, fixed-price step so you can judge the fit before committing further. See pricing.
Discovery Sprint
Teams deciding scope and priorities before they commit.
- Duration
- 2 weeks
- Pricing
- Fixed price
- Scoped plan and timeline
- Team and fixed price
- Process map or prototype
Fixed-scope first release
Teams that know what they need built.
- Duration
- Agreed in discovery
- Pricing
- Fixed price after discovery
- Written scope and acceptance criteria
- Weekly demos
- Handover with documentation
Transformation Pod
Multi-system programmes that run for years.
- Duration
- 12–36 months
- Pricing
- Annual contract
- Dedicated cross-functional team
- Quarterly business reviews
- One accountable partner
What we have shipped, and what a typical engagement looks like.
Delivered projects link to the full case study. Illustrative scenarios describe typical engagements and are not named client results.
Consumer app with customer data in several systems
- Challenge
- Consent stored as a checkbox; deletion requests handled ad hoc across databases.
- What we do
- Data map, consent records, a request workflow and retention rules built into the product.
Assessment in 2 weeks
Free personal data map review
Tell us what you collect. We outline where personal data sits, where the biggest gaps are and a sensible first fix. Engineering view, not legal advice.
- Where personal data flows
- Highest-risk gaps
- Suggested first step
We agree targets before we start.
Every engagement has a baseline and a target on the measures that matter to you, reported at every read-out.
DPDP Act Compliance questions.
Is this legal advice?
No. We provide engineering and implementation support. We recommend your legal counsel confirm obligations and timelines for your business.
What timelines apply?
The Act and its rules have phased timelines. We confirm the current dates with your counsel at the start of the engagement rather than assuming them.
Does it apply to our AI tools?
If AI systems process personal data of individuals in India, the same duties generally apply. We map AI data flows and add redaction and logging.
Can you retrofit an existing product?
Yes. We start with a data map and prioritise changes by risk, then build consent, request handling and retention into the product.
Do you offer certification?
No. We do not certify compliance. We build the technical controls and documentation your counsel and auditors can review.
Let's scope your DPDP Act Compliance project.
Tell us where you are and where you want to be. A senior specialist will reply within one business day with next steps.
- Free 30-minute consultation
- Indicative estimate after the call
- NDA available on request