Built in India, for the organisations the Act actually reaches

Why this exists

India's Digital Personal Data Protection Act reaches almost every organisation that handles personal data, and its operative obligations commence on 13 May 2027. Most organisations will meet that date with a folder of policies and a spreadsheet nobody owns. That is not compliance; it is a paper trail with gaps in it, and the gaps only become visible when somebody asks a question you cannot answer.

DPDPNiti exists to make the answer routine: which provisions reach you, what you decided to do about each one, who owns it, what proves it, and when that proof was last checked.

What we are not

We are not a law firm, and nothing in this product is legal advice. We are not a certification body, and we cannot make anyone compliant — compliance is something an organisation does, and software can only make the doing visible and provable. We have no relationship with, or endorsement from, any government body or regulator.

How we talk about the product

Everything described on this website is in the product today, or is marked “Coming” where it is not. Our regulatory content carries its source, its publication date and its retrieval date, and where it has not been reviewed by external counsel it says so — on this site and in the product. We would rather lose a deal to a competitor's longer feature list than win one on a sentence we cannot defend in a room full of privacy lawyers.