Loading…
A focused 12-week DPDP sprint covers data flow, Schedule I, consent + rights workflow, breach runbook, vendor risk, DPA, grievance officer.
Pre-Series B Indian SaaS startups complete in 12 weeks. Larger orgs typically need 16-20 weeks.
Run the free first scan to baseline your current DPDP posture: VAPT against Schedule I technical safeguards, data flow inventory, current consent capture review, current rights workflow review, vendor risk surface scan. 30-minute scoping call to define the 12-week engagement plan, owner, executive sponsor, cadence. Deliverable: gap analysis report + scoped sprint plan.
The foundation of the entire DPDP programme. Map every personal data flow: where data enters the system (forms, integrations, APIs), where it is stored (databases, files, caches, backups), who has access (humans, services, agents), where it is shared (third parties, processors, sub-processors), what is the retention period, what is the lawful basis (consent, contract, legal obligation). Output: a data flow diagram + a personal data inventory table. This phase often surfaces unexpected data flows (a forgotten analytics integration, a stale CSV export job, a third-party support tool with broad access).
Implement and document the 7 Schedule I obligations: appropriate technical/organisational measures (encryption, key management, secure SDLC), reasonable security safeguards (access control, network segmentation, vulnerability management), breach response capability, audit cadence, retention limits, vendor/processor risk management, logging and audit trail. The Bachao.AI VAPT report provides direct evidence for obligations 1, 2, 4. Other obligations require workflow and policy work in this phase.
Build the consent capture flow with audit trail, and the data principal rights workflow (access, correction, erasure, grievance, nomination). Includes: in-product Privacy Center UI, identity verification for external requests, request handler backend, erasure cascade across all data stores, grievance officer escalation path, Data Protection Board referral path. Test with synthetic principal requests before declaring complete.
Author the breach response runbook with hour-by-hour playbook aligned to DPDP's 72-hour Board notification clock and CERT-In's 6-hour cybersecurity incident clock. Pre-populate the 5-field Board notification template. Establish forensic firm relationship. Run a tabletop exercise to stress-test the runbook with a simulated breach. Iterate on gaps surfaced.
Build the sub-processor registry (typically 10-30 entries for an Indian SaaS). Audit each sub-processor for DPDP alignment. Draft the data processor DPA template per Section 8 obligations. Get fiduciary customer authorisation for the current sub-processor list. Set up change notification workflow (typically 30 days notice before adding a new sub-processor). Output: sub-processor registry + DPA template + change notification process.
Appoint the grievance officer, publish contact + escalation SLA on the website (typically 14 days response). Reference the Data Protection Board referral path in the grievance policy. If a Significant Data Fiduciary (SDF), appoint the Data Protection Officer per Section 10 (or contract DPO-as-a-Service). Brief leadership and board on the new programme.
Final VAPT re-test to confirm remediation of Schedule I findings. Final review of every deliverable. Internal audit dry-run against DPDP requirements. Document handover pack assembled: data flow diagram, personal data inventory, VAPT report, gap analysis, consent + rights workflow documentation, breach runbook + tabletop report, sub-processor registry + DPA template, grievance officer process. You are now audit-ready for DPDP enforcement.
Annual VAPT cycles to maintain Schedule I obligation 4 evidence. Quarterly DPDP gap review to catch drift. Annual tabletop exercise to keep the breach runbook fresh. Monthly review of sub-processor list for changes. Continuous evidence collection if pursuing SOC 2 / ISO 27001 in parallel. Bachao.AI's annual programme covers the technical and security layer; legal layer continues with your partner law firm.
Free first scan + gap analysis kicks off Week 0. Audit-ready by Week 12, with buffer to May 2027 enforcement.
Bachao.AI covers your entire security surface — from code to cloud to compliance.