The Digital Personal Data Protection Act, 2023 is India's first comprehensive data-protection law. GTC builds the consent flows, drafts the privacy notice and grievance-redressal mechanism, sets up your data-fiduciary obligations, and prepares you for enforcement as the DPDP Rules come into force. We build the programme and keep it current as the Data Protection Board issues guidance.
From $1,200 Quoted by data-fiduciary type and processing volume after a free scoping call
Consent rebuilt
To the DPDP standard
SDF assessed
DPO + DPIA where needed
Rules-ready
As the DPDP Rules land
Trusted by founders and brands worldwide
How it works
A 60-minute review of your data processing. What personal data do you handle, who are the data principals, what is the legal basis for each activity, and are you a Significant Data Fiduciary? We map the gap against the Act.
We draft the privacy notice, rebuild your consent flows for valid consent, set up the grievance-redressal mechanism, and prepare the breach-notification playbook — integrated into your product.
DPDP enforcement is still ramping up. An optional monthly retainer keeps you ahead of Data Protection Board rules and guidance, and updates the programme as the DPDP Rules are notified.
What it costs
India DPDP Compliance starts from $1,200. Every DPDP engagement is quoted up front after a free scoping call, once your data-fiduciary type and processing volume are known. A starter programme for a small data fiduciary is scoped differently from a full mid-size programme with cross-border flows or a Significant Data Fiduciary advisory with an ongoing DPO retainer. GTC's fee renders as the live anchor above and is confirmed in writing before any work begins; any government or registration fees are passed through at cost.
What's included
No GTC fee is committed until your data-fiduciary type and scope are confirmed and you have approved the quote. Compliance under the DPDP Act is ongoing; the optional retainer keeps the programme current as the Rules are notified.
Get started
Tell us about your data processing and a GTC attorney will scope your DPDP compliance and email you a quote after a free scoping call.
Brand details
Your company or product name.
India's Digital Personal Data Protection Act 2023 (DPDP) governs the personal data of people in India.
Under DPDP a Data Fiduciary decides the purpose and means of processing (like a controller); a Data Processor only processes on a Fiduciary's instructions.
High-volume processors may be classed as a Significant Data Fiduciary, with extra duties such as a Data Protection Officer and audits.
Children's data has strict consent rules under DPDP.
Why GTC
DPDP is consent-centric. We audit your consent collection and rebuild it where the current consent is not free, specific, informed, unconditional, and unambiguous — the standard the Act requires.
If you are designated an SDF, the DPO appointment, Data Protection Impact Assessment, and audit duties attach. We advise on whether you are likely in scope and set up the obligations that follow.
We assess your Section 16 cross-border transfer position and wire up the data-principal rights workflow — access, correction, erasure, and nomination — so requests are handled within the Act.
We scope the work by data-fiduciary type and processing volume and quote it in writing before any work begins. Our fee renders as the live anchor above; government fees are passed through at cost.
Your Customer Success Team
Every GTC client gets a dedicated Account Manager and a Senior Account Manager who learn your business and stay with you from first email to final filing. They are named people who pick up the phone and already know your matter, so every step moves forward without delay.
Your day-to-day point of contact, who coordinates every matter, keeps things moving, and already knows your file. They have your full history, so you start every conversation where the last one left off.
Senior oversight on strategy and escalations, stepping in as your needs grow, so every important detail stays on track.
A named person, on email or a call, at every step.
How we compare
| What you get | GTC | Online filing services | Doing it yourself |
|---|---|---|---|
| Privacy notice and consent flows drafted to the DPDP Act's own consent standard | |||
| Significant Data Fiduciary assessment with DPO and DPIA obligations set up where required | |||
| Grievance-redressal mechanism built per DPDP §13(1)(c), not a placeholder clause | |||
| Cross-border transfer position assessed under Section 16 restrictions | |||
| Breach-notification playbook with a Data Protection Board notification template | |||
| Programme kept current as the DPDP Rules are notified and Board guidance issues |
Privacy notice and consent flows drafted to the DPDP Act's own consent standard
Significant Data Fiduciary assessment with DPO and DPIA obligations set up where required
Grievance-redressal mechanism built per DPDP §13(1)(c), not a placeholder clause
Cross-border transfer position assessed under Section 16 restrictions
Breach-notification playbook with a Data Protection Board notification template
Programme kept current as the DPDP Rules are notified and Board guidance issues
Timeline
Most data fiduciaries reach a compliant posture in three to six weeks. Significant Data Fiduciaries with cross-border flows take longer, and we scope that up front.
We map what personal data you process, who your data principals are, the legal basis for each processing activity, and whether you are a Significant Data Fiduciary.
Privacy notice, consent flows, grievance-redressal mechanism, children's-data parental-consent flows, and breach playbook drafted and integrated into your product.
The Section 16 transfer assessment and the data-principal rights workflow — access, correction, erasure, and nomination — wired up and tested.
An optional monthly advisory keeps you current as the DPDP Rules are notified and the Data Protection Board issues guidance.
In their words
One accountable team across every practice, operating since 2016.
India DPDP Compliance FAQ
Ready to get DPDP-compliant
Tell us about your data processing. We will map the gap against the DPDP Act, draft your privacy notice and consent flows, set up the grievance-redressal mechanism and breach playbook, and prepare you for enforcement as the Rules come into force — then keep the programme current as the Data Protection Board issues guidance.
Cookies help us improve the site.We use cookies to improve your experience, analyze site traffic, and personalize content. Learn more