DPDP compliance that starts with your liability, not our software
The DPDP Act sets penalties of up to ₹250 crore and asks one question when something goes wrong: what did you do, and how promptly. We start there. We map where your liability sits, fix what a contract or a process can fix, and deploy DPDP compliance software only where it reduces exposure.
The Data Protection Board and the Rules' definitions take effect.
Registration of Consent Managers with the Board begins (rule 4, s.6(9)).
Notice, consent, safeguards, breach intimation, retention, rights and grievance (rules 3, 5–16, 22–23).
Dates as published in the Gazette: Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), 13 November 2025, rule 1.
DPDP Act, at your counter: how Wekalp lowers your data liability
A short film on where data liability arises in day-to-day operations, and how Wekalp lowers it.
- Find itWhere personal data sits, without copying any of it.
- Consent and rightsPurpose-wise consent, withdrawal and requests on one record.
- Prove itSigned evidence for the Board, verifiable without our platform.
Liability first. Technology only where it earns its place
Most DPDP programmes begin with a tool. Ours begins with the question a regulator, a court or your board will ask: if a complaint lands tomorrow, where are you exposed, and what can you show?
- 01
Map the exposure
Where personal data enters, who acts on it, which section applies and what the Schedule says it could cost.
- 02
Choose the remedy
A notice, a contract clause, a procedure, a retention rule, or software. Each exposure gets the cheapest fix that closes it.
- 03
Deploy only what is needed
Consent, discovery, both, or neither. Inside your infrastructure, sized to your estate, not to our price list.
- 04
Keep the evidence
The Board weighs what you did and how promptly (s.33). The record of it is kept as the work happens, dated and signed.
By sectorManufacturingHospitalsClubsBFSI
The Act prices its obligations. Start with the expensive ones.
The Schedule to the Act sets the maximum penalty for each kind of failure. The amount actually imposed depends on what you did about it.
Reasonable security safeguards
Failing to take reasonable safeguards to prevent a breach, including at a processor.
Breach not intimated
Failing to inform the Board and each affected person of a personal data breach.
Children's data
Processing without verifiable parental consent, or tracking and targeting children.
Significant Data Fiduciary duties
DPO, independent audit and impact assessments, once notified as significant.
Everything else
Notice, consent, withdrawal, retention, rights and grievance: the obligations every fiduciary carries.
Our reading of the Act
Who is liable, at which point in the data's life, and how the Board decides the amount.
DPDP compliance software that answers what did you do, and how promptly
Ten checks against the Act, and a report you can sign
Each check is tied to its section. The period report downloads as a signed PDF that anyone can verify with the public key alone, so the answer to the Board is a file, not a reconstruction. See the consent platform.
When software is the answer, two parts, one record
Personal Data Discovery finds where personal data sits and builds the record of processing. The Consent & Rights Platform takes consent, tells your processors, answers requests and keeps the proof. Each works on its own.
Personal Data Discovery
- RegisterEvery system, and how it is known
- ScanRead-only, metadata only
- ClassifyIndian identifiers, by check digit
- RecordRecord of processing, versioned
- ActRetention, removal, incidents
Consent & Rights Platform
- DefinePurposes and versioned notices
- CollectWidget, forms, cookie banner
- RecordHash-chained ledger
- RelaySigned notices to processors
- ProveTen checks, signed exports
FOR THE
BOARD
Some DPDP problems have no software answer
A tool for a contract problem
Most processor exposure is closed by clauses: deletion on exit, breach notice to you, audit rights. That is drafting, not a platform.
Discovery for a three-system company
If your personal data sits in an HRMS, a CRM and a mailbox, a structured register does the job. We will say so.
Security dressed up as privacy
Safeguards under s.8(5) are your IT and security stack's job. We record incidents and evidence; we do not replace your firewall.
A legal opinion
Which basis a purpose rests on is a legal call. We work alongside your advisers, or bring ours: an established chartered accountancy firm with a litigation practice. The platform records what you decide.
Twenty questions. Ten minutes. Your exposure, by obligation.
No sign-up. Your answers stay in your browser. You see where liability sits and what each gap can cost; the detailed report shows what would reduce it.
DPDP compliance, answered
Do we need software to comply with the DPDP Act?
Not always. Notices, processor contracts, retention rules and a breach procedure carry much of the load. Software earns its place where consent is collected on several channels and used by several systems, or where personal data sits in more systems than anyone has listed.
What does the Data Protection Board look at when it sets a penalty?
Section 33 lists the factors, including the nature, gravity and duration of the breach, the type of personal data, whether it was repeated, what you gained or avoided, and what you did to mitigate it and how promptly. Evidence of what you did is what moves the amount. See how the amount is decided.
Can we use only consent management?
Yes. The Consent & Rights Platform runs on its own. Personal Data Discovery can be added later on the same record.
Does our data leave our infrastructure?
No, unless you choose the hosted option. Wekalp runs in your infrastructure with keys from your key store. Discovery keeps counts and column names, never values.
Is Wekalp a registered Consent Manager?
No. Wekalp is software for a data fiduciary taking consent for its own purposes. It is not a Consent Manager registered with the Board under section 6(9).
Find where your liability sits, then decide what to build.
Wekalp is software for data fiduciaries and is not a Consent Manager registered with the Data Protection Board under section 6(9) of the Act. Nothing on this site is legal advice.