Executive Summary: The Business Risk & Solution
Almost every Indian product company has a privacy policy. Very few can prove where their customers' personal data lives, who can read it, and whether an attacker can reach it. Under the Digital Personal Data Protection (DPDP) Act, 2023, that proof is no longer optional. The DPDP Rules were notified in November 2025, and their core obligations take effect in May 2027: reasonable security safeguards (Rule 6), personal data breach intimation (Rule 7) and data principal rights. Consent Manager registration opens even earlier, in November 2026.
The penalties are sized for boardrooms, not IT budgets. Failing to take reasonable security safeguards can cost up to ₹250 crore. Failing to notify the Data Protection Board and affected users of a breach can cost up to ₹200 crore. The Board will not judge your company by its policy documents. It will judge you after an incident, by asking what safeguards were actually in place.
The breaches that trigger these penalties rarely start with exotic zero-days. They start with an API that returns another customer's records when an ID is changed, a production database dump left in a staging bucket, logs that store phone numbers and PAN details in plain text, or a CRM vendor with read access to the whole database. A DPDP compliance programme built on penetration testing, not paperwork, finds these gaps before an attacker or a regulator does.
Technical Deep Dive & Architecture
An enterprise-grade DPDP engagement joins two disciplines that are usually sold separately: privacy compliance mapping and offensive security testing. Here is how the work runs.
1. Personal data discovery and data-flow mapping. We inventory every place personal data lives or passes through: primary databases, read replicas, analytics warehouses, object storage, backups, application logs, and third-party processors such as payment gateways, SMS and WhatsApp providers, CRMs and support desks. Each data set is classified by sensitivity: identifiers, financial data, location, and children's data (which needs verifiable parental consent under Section 9). The output is a data map and a record of processing that ties each data set to its lawful purpose.
2. Gap assessment against Rule 6 safeguards. Rule 6 spells out what "reasonable security safeguards" means in practice. That includes encryption, obfuscation, masking or virtual tokens; access control over the systems that hold personal data; logging and monitoring that can detect unauthorised access; backups for continued processing after a compromise; one-year retention of logs needed for investigation; and security clauses in every Data Processor contract. Each control is scored as present, partial or missing, with evidence.
3. VAPT focused on personal data paths. Generic scans miss the flaws that leak personal data. Manual testing targets the paths that touch it: broken object-level authorisation (IDOR/BOLA) on customer APIs, weak session and token handling, excessive data exposure in API responses, mass assignment, SSRF to cloud metadata services, public storage buckets and over-permissive IAM roles. Every finding comes with a proof of concept and is mapped to the personal data it exposes. Fixes are ranked by records exposed × exploitability, not by scanner severity alone.
4. Remediation engineering. The reference architecture we recommend is a PII vault. Personal data is isolated in a dedicated service or schema, encrypted at field level with AES-256-GCM using envelope encryption and KMS-managed keys. Application services store only tokens; only the vault can decrypt, and every decrypt is logged. Around the vault: role- and attribute-based access control with least privilege, PII scrubbing in logs and error trackers, masked data in non-production environments, and automated retention and erasure jobs tied to each processing purpose.
5. Breach-response readiness. Rule 7 requires you to inform every affected user without delay and to send the Board a detailed report within 72 hours of becoming aware of a breach. CERT-In's 2022 directions separately require incident reporting within 6 hours. That is only achievable with detection already in place (alerts on bulk exports and unusual decrypt volumes), a written runbook with pre-approved notification templates, and a tabletop exercise that proves the team can execute it.
6. Retest and evidence pack. A retest confirms each fix. The engagement closes with an evidence pack: data map, safeguards matrix, VAPT report with retest results, incident response runbook and processor contract checklist. This is the file you hand to the Board, an enterprise customer's security team or an auditor.
Cost Breakdown & Measurable ROI
- Direct Cost Savings: A DPDP readiness assessment with EthicsComputer starts at ₹85,000 + GST, and web application VAPT starts at ₹65,000 + GST. Compare that with the cost of a single incident: forensic investigation, customer notification, legal counsel, downtime and churn, before any penalty is even considered. Deleting stale personal data during the mapping phase also cuts storage costs and shrinks the blast radius of any future breach.
- Regulatory & Compliance Safety: Every control maps directly to DPDP Rules 6 and 7 and to the CERT-In directions, so you can show the Board documented, tested safeguards rather than intent. The same evidence largely overlaps with ISO/IEC 27001 Annex A and SOC 2 controls, so one programme serves several audits. It also shortens enterprise vendor security reviews, which are increasingly asking about DPDP readiness.
- Engineering Velocity: Once the PII vault, masking and access patterns exist, new features inherit them instead of needing a fresh privacy review each time. Security checks in CI (SAST, dependency and secret scanning, and DAST on staging) catch regressions before release. Masked production-like data lets developers debug real scenarios without touching real customer records.
5-Step Implementation Checklist
- Assign ownership and fix the scope. Name a senior owner for DPDP compliance and a grievance contact, then list every application, API, cloud account and vendor in scope.
- Build the personal data map. Document every store, flow and processor that touches personal data, along with its purpose and retention period.
- Run the gap assessment and VAPT together. Test the systems that hold personal data against Rule 6 safeguards and real-world attack techniques in the same engagement.
- Remediate by risk and retest. Fix encryption and tokenisation, access control, log hygiene and retention in order of records exposed, then verify every fix with a retest.
- Operationalise breach response. Publish a runbook covering the 6-hour CERT-In and 72-hour Board timelines, run a tabletop drill, and schedule quarterly re-testing and an annual review.
Frequently Asked Questions
Q1: We are already ISO 27001 certified. Do we still need a DPDP assessment?
Yes, but it is a delta assessment, not a restart. ISO 27001 covers information security broadly. DPDP adds obligations that are specific to personal data: notice and consent, purpose limitation, erasure, data principal rights, children's data, and breach intimation to both individuals and the Data Protection Board. Most of your security controls and evidence can be reused. The usual gaps are personal data mapping, consent records, retention and erasure, and the breach-notification workflow.
Q2: How much does a DPDP compliance engagement cost, and how long does it take?
DPDP readiness assessments start at ₹85,000 + 18% GST, and web application VAPT starts at ₹65,000 + GST. A combined scope is quoted after a short scoping call, because the effort depends on the number of applications, APIs, cloud accounts and data processors. For a single product, mapping and testing typically take three to four weeks. Remediation time depends on your team's capacity, and the retest follows once fixes are deployed.
Conclusion & Next Steps
May 2027 sounds distant until you plan the engineering work. Retrofitting field-level encryption, rebuilding access control and mapping every processor takes quarters, not weeks. Every month of delay also adds more personal data to systems that have never been tested. Companies that start now will meet the deadline with tested controls and an evidence pack ready. Companies that wait will meet it with a policy document and hope.
Start with a scoped assessment of your highest-risk application. Chat with our Lead Architect on WhatsApp, explore our DPDP Act compliance services and web application VAPT, or request a scope spec and proposal.
