Data discovery and mapping
What personal data you collect, why, where it is stored, who can access it and how long you keep it.
DPDP Act · India
DPDP Act compliance consulting for businesses
India's Digital Personal Data Protection Act places obligations on organisations that process digital personal data of individuals in India. We map your data, fix consent and notice practices, set up data-principal rights and breach response, and keep your programme current as rules are notified.
Data mapping
Consent & notice
Data-principal rights
Grievance handling
Security safeguards
Children's data
Breach response
Stays current
Notice and consent
Clear notices and valid, withdrawable consent — including special care for children's data.
Data principal rights
Processes for access, correction, erasure and grievance requests, with owners and response times.
Security safeguards
Access control, encryption, logging and testing — practical safeguards matched to your systems.
Breach response
Detection, assessment and notification procedures, so your team knows what to do in the first hour.
Vendor and processor management
Contracts and assessments for everyone who processes data for you — cloud, CRM, WhatsApp, telephony and more.
Retention and deletion
Schedules and automated deletion, so data is not kept longer than needed.
Governance
Roles, training and records — so privacy has an owner and evidence exists.
Discovery and data mapping
We interview your team and systems owners, and build the map: what personal data you collect, why, where it lives, who can access it and how long it is kept.
Gap review
We review consent notices, forms, apps, contracts and vendor arrangements against the obligations, and deliver a prioritised action list.
Fix and build
Rewritten notices and consent flows, rights-request processes, breach response plan, vendor contract updates, retention schedules — drafted and tailored to how you actually operate.
Train and hand over
Your team learns to run the programme: handling requests, applying retention, escalating incidents. Records and evidence are organised for future review.
Keep current
We track notified rules and timelines, and update your programme as requirements land.
Hospitals and clinics
Patient data is sensitive health data; consent and access control are non-negotiable.
Schools and colleges
Student data — much of it children's data — needs verifiable parental consent and careful retention.
E-commerce and marketplaces
Customer records, addresses, payment references and marketing lists all fall in scope.
SaaS and IT companies
Enterprise customers now ask about your privacy posture during vendor onboarding.
Fintech and insurance
KYC documents, financial records and partner data-sharing require disciplined governance.
Startups scaling up
Getting notices, consent and retention right early is far cheaper than fixing them later.
DPDP Act
It is India's data protection law. If you process personal data of individuals in India, it likely applies.
Data mapping, consent management, privacy notices, data-principal rights processes, breach response, vendor management, retention and deletion schedules, and governance.
ISO 27001 is about managing information security as a system. The DPDP Act is about how personal data is handled — consent, rights, retention, breach duties. Many safeguards overlap, and we run combined programmes when it saves time.
The Act gives special care to children's data, including verifiable parental consent. Schools, apps and services used by minors should review this first.
It depends on how much data you hold and how systems are arranged. After a short scoping call we give you a fixed-scope plan and timeline.
Yes. Because we build software as well as advise, consent flows, retention jobs, access controls and logging can be implemented by the same team — including in our hospital, school and e-commerce platforms.
We review and update contracts and run assessments for the processors you rely on — cloud, CRM, WhatsApp providers, telephony and others.
We track the current rules and timelines as they are notified and update your programme accordingly.
“CyberSwipe developed our website at stresshealing.in and everything has been great. We are happy with the work they delivered.”
“CyberSwipe built the full stack behind Youvabot — CRM, WhatsApp bot, calling bot and the Android app, and everything has been great.”
“CyberSwipe developed the complete Kingermart platform — e-commerce website, app and everything behind them, and everything has been great.”