Stratgik — technology strategy and business systems engineering.
Delivery across the USA, UK, UAE and India.
DPDP Act 2023Rules notified 13 November 2025
India's Digital Personal Data Protection Act applies to every business that collects a name, phone number or email. We map your data, fix your notices and consent, and set it up inside your website and systems, at a price built for Indian businesses, not multinationals.
No size limit. It applies to
What is at stake
The Data Protection Board decides the amount based on how serious the failure was, how long it went on and what you did to fix it. These are the upper limits in the Schedule to the Act.
The largest one is not about paperwork. It is for failing to take reasonable security measures that would have prevented a breach.
Failing to take reasonable security safeguards to prevent a personal data breach
Failing to inform the Board and affected people about a breach
Failing the additional obligations for children's data
Failing the additional obligations of a Significant Data Fiduciary
Any other breach of the Act or Rules, such as notice, consent or rights requests
What the law asks, in plain words
Most businesses already do some of these. The gaps are usually in consent records, breach readiness and deletion.
Tell people, item by item and in plain language, what you collect and why. English or any of the 22 languages in the Constitution's Eighth Schedule.
Free, specific and unambiguous, for a stated purpose. Withdrawing it must be as easy as giving it. Pre-ticked boxes do not count.
Encryption or masking, access control, and logs kept for at least one year so misuse can be detected and investigated.
Tell affected people without delay, and send a detailed report to the Data Protection Board within 72 hours.
Verifiable parental consent for anyone under 18. No tracking, behavioural monitoring or targeted advertising aimed at children.
Let people access, correct and erase their data, and raise a grievance. Publish how, and respond within 90 days.
Erase data once its purpose is over. Large ecommerce, social media and gaming platforms must erase after 3 years of inactivity, with 48 hours' notice.
You stay responsible for data your CRM, payment, cloud and marketing vendors process for you. Your contracts must say so.
Free self-check
Ten questions, two minutes. Answer honestly; nothing is sent anywhere unless you ask for the report.
How we get you compliant
A typical small or mid-sized business with one website and a handful of systems takes three to five weeks.
Discover
Website forms, app, CRM, WhatsApp Business, Excel sheets, email, payroll, vendors. This is usually where forgotten copies turn up.
Decide
Each gap is scored against the penalty it attracts and the effort to fix it, so the ₹250 crore risks get fixed before the cosmetic ones.
Implement
Notices, consent capture and logs, a rights request page, access controls, retention rules, vendor clauses. Working on WordPress, Shopify, custom apps and common CRMs.
Hand over
A live session for the staff who handle data, a breach playbook with named owners, and a practice run of the 72-hour report.
Pricing
For businesses with one website or app and up to 5 systems holding personal data. Larger scope is quoted in writing before you pay anything.
Know exactly where you stand and what to fix first.
₹14,999one-time
+ GST
Report in 7 working days
Choose Readiness AuditRecommended
We do the work, in your website and systems, not just on paper.
₹49,999one-time
+ GST
Typically 3 to 5 weeks
Choose Compliance SetupStay compliant as your business, vendors and the rules change.
₹7,999per month
+ GST
Cancel any month
Choose DPDP CareData protection impact assessments, independent audit preparation, DPO support, consent integration across apps and multiple systems, cross-border transfer review.
Your options
A template gives you a privacy policy. It does not put consent on your forms, keep a log, or tell anyone what to do at 2 a.m. when a breach happens.
A clear line: Stratgik is a technology firm, not a law firm. We implement and operate compliance in your systems. Where you need a legal opinion, we work alongside your lawyer.
Free readiness call
Tell us a little about your business. We will reply within one working day with a time for a free 20-minute call and a fixed quote.
Questions
Have a question about your situation? Ask on WhatsApp and an engineer will answer.
Ask on WhatsAppYes. The Act has no turnover or size threshold. If you collect digital personal data of people in India, such as a name, phone number or email through a website, app or WhatsApp, it applies. The government can exempt some classes of businesses, such as notified startups, from certain provisions, but no business should assume it qualifies without checking.
The DPDP Rules were notified on 13 November 2025. Consent Manager registration starts on 13 November 2026, and the main obligations on notice, consent, security, breach reporting, retention and rights requests become enforceable on 13 May 2027, when the Data Protection Board can impose penalties.
It is a strong start, but not the same law. DPDP has its own notice format, consent rules, 72-hour breach reporting to the Indian Board, parental consent for everyone under 18, and specific retention and erasure rules. A readiness audit usually finds a short list of India-specific gaps.
Only Significant Data Fiduciaries, a category the government notifies based on volume and sensitivity of data, must appoint a DPO based in India. Every other business must publish the contact details of a person who can answer questions about its processing of personal data.
No. Stratgik is a technology firm. We map your data, write plain-language notices and processes based on the Act and Rules, and implement consent, logging, security and rights handling in your systems. If you need a legal opinion, we work alongside your lawyer.
Websites on WordPress, Shopify, Wix and custom code, mobile apps, and common CRMs and tools such as Zoho, HubSpot, Salesforce, Google Workspace and WhatsApp Business. If a system cannot support something, we tell you and propose a workaround.
The prices are fixed for businesses with one website or app and up to five systems holding personal data. GST at 18% is added to the invoice. For larger scope we send a written quote before any work starts.
Clients on DPDP Care get their notices and processes updated when the rules or official guidance change. Audit and Setup clients get a note from us when a change affects them, with a quote if work is needed.
A readiness audit takes 7 working days. Every month you wait leaves less time to fix what it finds.
The Stratgik model
Four stages, in order. Most businesses need them one at a time.
