GDPR and DPDP Act
Readiness Built on
Real Data Flows
GDPR and DPDP Act audit
One Privacy Programme for India's DPDP Act and the EU GDPR
iSpyCyber helps organisations understand what personal data they hold, why and where it goes, then builds the consent, notice, rights handling, breach response and security safeguards both regimes expect. Our assessments pair privacy expertise with technical testing, so your security safeguards are proven, not just documented.
Why organisations choose iSpyCyber
Data mapping first
We trace personal data across applications, vendors and cloud services to build records of processing that reflect reality.
Two regimes, one programme
Controls are mapped once to the DPDP Act 2023, the DPDP Rules and the GDPR, avoiding duplicate effort for organisations serving India and Europe.
Consent and notice that work
Consent flows, notices and withdrawal mechanisms reviewed in your actual applications, not only in policy documents.
Security safeguards tested
Access controls, encryption, logging and data exposure are verified through hands-on security testing.
Breach-ready
Breach detection, assessment and notification playbooks for the Data Protection Board of India and EU supervisory authorities.
Practical, not theoretical
Recommendations sized to your organisation and risk, prioritised so the most important obligations are met first.
Coverage
Privacy Obligations We Assess and Implement
Our reviews cover the obligations of data fiduciaries and controllers, and the processors that act for them.
Data discovery and mapping
Inventories of personal data, purposes, systems, vendors and cross-border transfers, and records of processing activities.
Lawful basis and consent
Lawful bases under GDPR, consent and legitimate uses under the DPDP Act, and consent manager readiness.
Notices and transparency
Clear, itemised privacy notices, language availability and notice timing across web, mobile and offline channels.
Rights handling
Access, correction, erasure, grievance redressal and nomination under the DPDP Act, and GDPR data subject rights, with response workflows.
Children's data
Verifiable parental consent, restrictions on tracking and targeted advertising, and age assurance approaches.
DPIA and risk assessment
Data protection impact assessments for high-risk processing and the periodic assessments expected of Significant Data Fiduciaries.
Security safeguards
Encryption, masking, access control, logging, retention of logs and security testing of systems that process personal data.
Breach management
Detection, assessment and notification to the Data Protection Board, EU supervisory authorities and affected individuals.
Processors and transfers
Processor contracts, vendor due diligence, retention and deletion, and cross-border transfer mechanisms.
Methodology
A Six-Phase Path from Data Map to Audit Readiness
Aligned to the DPDP Act 2023 and DPDP Rules, the GDPR and ISO/IEC 27701, and tailored to your data, sector and customers.
- DPDP Act 2023
- DPDP Rules
- EU GDPR
- ISO/IEC 27701
- ISO/IEC 29100
6–14
weeks for a typical readiness programme
6
lifecycle phases
2
regimes covered together
01
- Weeks 1–2
Scope and discover
Business units, applications, data categories and applicable regimes confirmed with your legal and technology teams.
Key activities
- Confirm which regimes apply and where
- Identify systems, vendors and data owners
- Agree interview plan and document requests
- Output: Agreed scope and applicability view
02
- Weeks 2–4
Map personal data
Personal data flows mapped from collection to deletion, including vendors and cross-border transfers.
Key activities
- Workshops with process and data owners
- Build records of processing activities
- Identify children's and high-risk processing
- Output: Data inventory and flow maps
03
- Weeks 3–6
Gap assessment
Obligations under each regime assessed against current notices, consent, rights handling and safeguards.
Key activities
- Review notices and consent journeys
- Test rights-request and breach workflows
- Review security safeguards and vendor contracts
- Output: Obligation-by-obligation gap report
04
- Weeks 5–12
Implement and remediate
Policies, notices, workflows and technical controls built or updated with your teams.
Key activities
- Draft privacy policy, notices and procedures
- Design consent and rights-request workflows
- Guide security and retention controls
- Output: Implemented privacy controls
05
- Weeks 10–13
DPIA and validation
Impact assessments completed for high-risk processing and safeguards validated through testing.
Key activities
- Run DPIAs for high-risk processing
- Security testing of key personal data systems
- Internal audit of implemented controls
- Output: DPIA reports and internal audit results
06
- Ongoing
Audit readiness and support
Evidence organised for regulators, customers and independent audits, with a plan to keep the programme current.
Key activities
- Compile accountability evidence packs
- Support customer and independent audits
- Set a periodic review and training calendar
- Output: Accountability evidence pack
Effort distribution
Where the programme time goes
Most of the effort goes into understanding your data and building workable controls around it. Percentages are indicative for a first-time programme.
Quality built into every phase
Grounded in real data flows
Findings follow how data actually moves.
Safeguards verified
Security controls are tested, not assumed.
Mapped to each obligation
Every control links to the provisions it meets.
Clear on legal boundaries
Legal interpretation stays with your counsel.
Engagement options
Choose the Privacy Support That Fits Your Stage
From a first view of your obligations to an embedded, ongoing privacy function, every option uses the same methodology.
Gap assessment
A data mapping exercise and review against the DPDP Act, DPDP Rules and GDPR, with a prioritised remediation plan. Best for understanding where you stand and what to fix first.
Full readiness programme
Data mapping, gap assessment, policies, notices, consent and rights workflows, DPIAs and security testing. Best for organisations building a privacy programme or preparing for customer and independent audits.
Ongoing compliance support
Periodic internal audits, DPIAs for new processing, vendor reviews, training and breach readiness exercises. Best for keeping the programme current as products and regulations change.
Not sure which option you need?
Our specialists will recommend an approach based on where you operate, the data you process and your customers’ expectations.
Deliverables
A Privacy Programme You Can Demonstrate
Clear priorities for leadership, workable procedures for teams and accountability evidence for regulators and customers.
Gap report
Status against each obligation under the DPDP Act and GDPR, with risks, priorities and an executive summary.
Policies and notices
Privacy policy, notices, consent language, retention schedule, rights-request and breach procedures.
Evidence packs
Data inventory, records of processing, DPIAs, consent records design and security test results, ready for review.
Remediation roadmap
A sequenced plan with owners and dates, prioritising the obligations that carry the greatest risk.
Aligned with the privacy and security frameworks you work to
- DPDP Act 2023
- DPDP Rules
- EU GDPR
- UK GDPR
- ISO/IEC 27701
- ISO/IEC 27001
- ISO/IEC 29100
- SOC 2 Privacy
- RBI data guidelines
- HIPAA
iSpyCyber provides privacy readiness, gap assessment, implementation, internal audit and security testing. We do not provide legal advice, and compliance determinations rest with regulators, independent data auditors and your legal counsel.
Privacy readiness for every industry
The basics
Does iSpyCyber certify us as GDPR or DPDP Act compliant?
No. There is no single compliance certificate we can issue under either law. Compliance is ultimately judged by regulators such as the Data Protection Board of India and EU supervisory authorities. Where the DPDP Act requires an independent data audit, for example for Significant Data Fiduciaries, we prepare you for it through gap assessment, implementation, internal audit and evidence preparation. We are not a law firm, so legal interpretations should be confirmed with your counsel.
Who does the DPDP Act apply to?
It applies to processing of digital personal data within India, and to processing outside India where it relates to offering goods or services to individuals in India. Data fiduciaries carry the main obligations, and data processors act on their behalf under contract.
We already comply with GDPR. Are we ready for the DPDP Act?
A GDPR programme is a strong starting point, but the regimes differ. The DPDP Act relies mainly on consent and specified legitimate uses rather than a range of lawful bases, has its own rules for children’s data, consent managers and breach notification, and grants rights such as nomination. We map what you already have and close the differences.
What is a DPIA and when do we need one?
A data protection impact assessment identifies and reduces risks from processing personal data. GDPR requires one for high-risk processing, and the DPDP Act requires periodic assessments from organisations notified as Significant Data Fiduciaries. Many organisations run them for any new high-risk product or vendor.
Working with us
How do you handle data principal and data subject rights?
We review how requests are received, verified, tracked and fulfilled across your systems, then design workflows and templates that meet the response expectations of each regime.
What happens if we suffer a personal data breach?
The DPDP framework requires notification to the Data Protection Board and affected data principals, and GDPR generally requires notification to the supervisory authority within 72 hours where the breach poses a risk. We build and test breach playbooks so your teams know exactly what to do.
How long does a privacy readiness programme take?
A gap assessment usually takes three to five weeks. A full programme typically runs six to fourteen weeks, depending on the number of systems, business units and jurisdictions in scope.
Get started
Know Your Data.
Protect It Like You Promised.
Talk to our privacy specialists about a scoped GDPR and DPDP Act readiness review for your organisation.
- ISO/IEC 27001 and ISO 9001 certified
- 40+ enterprise and government clients
- 15+ countries