An advanced DPDP assessment, built on governance-led intelligence research.

DPDPiq is an advanced DPDP assessment platform built on InfraVeritas360's governance-led intelligence research. It takes an organisation through 36 questions in six areas, records every answer exactly as given, and then shows the DPO / Management which parts of the DPDP position are backed by reviewed evidence and which are only statements. The result is a clear position by area, a data flow map, a list of contradictions and a 30/60/90-day plan built only from real gaps.

A readiness checklist usually sends 120 or more questions to one person and accepts the answers as written. DPDPiq routes each question to the person who actually knows the answer, ties every answer to evidence, and treats a position as established only after that evidence is reviewed. It also places answers side by side, so contradictions such as data said to stay in India while backups sit outside India come to the surface early.

A typical assessment takes three to five working days. The questions themselves are answered one at a time as a guided conversation, and most of the time goes into colleagues finding and sharing evidence. The dashboard updates within seven seconds of every confirmed answer, so the DPO / Management can see the position build up as the work moves forward.

At the end of the assessment the DPO / Management receives a position statement by area, an exposure register mapped to sections of the DPDP Act with an owner for each point, a six-stage data flow map, a list of contradictions with the question to settle each, a 30/60/90-day plan and a management report for sign-off. Answer records carry a SHA-256 fingerprint, and an evidence tracker is available in Excel.

A single percentage needs weights that nobody states, and it can hide which duty is actually weak. An organisation with a higher score can be in a weaker legal position than one with a lower score. DPDPiq therefore shows the position area by area, with the evidence behind it and the owner accountable for it, so decisions are made on facts rather than on a number.

The moment an answer is confirmed, the DPDPiq engine reads it and updates the position, the analysis, the data flow map and the plan within seven seconds. The DPO, the auditor and the implementation team all see the same picture at the same time, without waiting for a report to be written. Every figure on the dashboard traces back to a recorded answer.

Yes. Any question can be sent to the colleague who knows the answer, for example IT for hosting and backups or Marketing for website tracking. They receive a plain email, answer on a secure page without creating an account, and the DPO is always copied. Each contributor sees only the sections assigned to them, and every reply is recorded with date and time.

Yes. An answer can be revised up to two times, each time with a reason and a six-digit code sent to the work email. The earlier answer is never deleted. Both versions are sealed in the SHA-256 ledger, so auditors and Management can see what changed, when and why.

Every action in the plan comes from a real gap found in the assessment: a contradiction, an unresolved point, a missing piece of evidence or an area without an owner. Each action carries the finding behind it, a priority, a suggested owner, a target date and the condition that closes it. Nothing is added to the plan that the assessment did not find.

DPDPiq is built for the DPO / Management who must answer for the DPDP position, and for the people who work with them: CISOs, CIOs and CTOs, internal audit, audit and GRC firms, privacy practices and system integrators. Partners can run assessments for many clients from one Control Centre, with the same facts each client sees.

The Digital Personal Data Protection Act, 2023 is India's law on how organisations collect, use, share, store and delete digital personal data. It sets duties for Data Fiduciaries, gives rights to Data Principals, and is supported by the DPDP Rules, 2025. DPDP Insights explains what the Act means for each role and sector in plain words.

The DPDP Rules, 2025 were notified in November 2025, with most obligations for Data Fiduciaries applying from May 2027. Organisations are using the time in between to map their data, fix notices and consent, put processor contracts in place and prepare for breach reporting. Starting early leaves room to collect evidence rather than only write policies.

The Act applies to the processing of digital personal data within India, and to processing outside India where it is linked to offering goods or services to people in India. Almost every organisation that holds customer, employee or vendor contact data is covered in some way. DPDP Insights shows how it applies to your sector and role.

A Data Protection Officer based in India is mandatory for a Significant Data Fiduciary. Other organisations must still publish the contact of a person who can answer questions about personal data. In practice, many organisations name a DPO or a privacy lead early, because someone has to own the position and the plan.

A Significant Data Fiduciary is an organisation that the Government notifies as such, based on factors like the volume and sensitivity of personal data it processes and the risk to people. It has extra duties, including a DPO in India, periodic data protection impact assessments and an independent data audit.

A notice must tell the person, in clear and plain language, what personal data is collected, the specific purpose, how they can withdraw consent, how they can exercise their rights and how they can complain to the Data Protection Board. The notice should be shown at the point of collection, not after, and a record of what was shown should be kept.

Consent must be freely given, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and limited to the data needed for the stated purpose. Withdrawing consent must be as easy as giving it. Organisations should keep a record of each consent and each withdrawal, including when and how it happened.

Every personal data breach must be reported to the Data Protection Board and to each affected person, without delay. The DPDP Rules, 2025 add a more detailed report to the Board within 72 hours. Organisations need a tested way of knowing what happened, which data and people are involved, and who informs whom.

Personal data should be erased once the purpose is served and consent is withdrawn, unless a law requires it to be kept longer. Erasure has to reach backups, analytics copies and data held by processors, not only the main system. Many organisations first need a retention schedule by record type to make this possible.

Yes. The Data Fiduciary stays responsible for personal data it shares with any processor, including cloud, payroll, CRM and email providers. A valid contract with each processor, clear instructions and a way to confirm deletion are needed. DPDPiq brings vendor and processor answers together, so gaps in this chain are visible.

No. DPDPiq has no access to your systems at any stage. Only the answers and evidence your team chooses to record are held, and when DPDPiq is installed inside your infrastructure, even those stay within your own boundary. Only position statements leave it, and only if you share them.

Yes. DPDPiq can be installed on one PC or server in your premises and run without internet access. Only email codes and notifications go out. It can also be hosted by InfraVeritas360 or run fully offline, depending on how sensitive your environment is.

No. DPDPiq is isolated by policy. It does not use or connect to any AI model, LLM, Google service or outside API to determine assessment positions. The engine works on fixed, version-controlled rules, and a human governance team reviews evidence and completes the assessment with you.

Every uploaded file is virus-scanned and encrypted at rest with AES-256-GCM. Each answer and each change gets a SHA-256 fingerprint and a ledger entry, so it can be shown later that nothing was altered. Sign-in and every sensitive change need a one-time code sent to the work email.

No. DPDPiq does not certify compliance and is not legal advice. It gives the DPO / Management an honest, evidence-based position and a plan. It does not replace the independent data audit required for a Significant Data Fiduciary, and it supports the work of your auditors rather than standing in for it.

No. InfraVeritas360 is not a hardware supplier, software reseller, system integrator, implementation company, audit firm or certification body. DPDPiq gives everyone in the room the same evidence-based position, so auditors can focus on assurance and system integrators on implementation.

Yes. Partner packs let audit firms, GRC practices and system integrators run DPDPiq assessments for many clients from one Control Centre, with the same live figures each client sees, a discussion guide and a Meeting Room. Implementation, assurance and the client relationship stay with the partner.

When DPDPiq runs inside your infrastructure, the data never leaves it, so it stays under your own retention policy. When it is hosted, assessment data is kept only for the agreed period, and deletion can be requested, including evidence files and backups.

ISO 27001 and SOC 2 cover information security controls well, but the DPDP Act adds duties that those standards do not fully test, such as notice and consent at the point of collection, rights requests, processor chains and erasure at end of purpose. DPDPiq checks these against evidence, and the control map helps reuse evidence you already have.

Start the assessment from this page with your work email. The DPO begins with the organisation details and industry, then works through the questions, inviting colleagues where needed. You can also talk to us first on +91 98209 24360 or hello@infraveritas360.com.