Skip to content

Scope, fee and working days are published on every engagement

support@corephysixlabs.com 7702752958 Track an order
CorePhysix Labs Technology lab
Start a project
01 / WEB Web & App Engineering 5 engagements · from ₹24,999 02 / CLD Cloud & DevOps 5 engagements · from ₹12,999 03 / DAT Data & AI 5 engagements · from ₹14,999 04 / UXD Product Design & UX 5 engagements · from ₹14,999 05 / API APIs & Integrations 5 engagements · from ₹18,999 06 / SEC Security & Compliance 5 engagements · from ₹12,999 07 / QAT QA & Test Automation 5 engagements · from ₹12,999 08 / SUP Managed Support 5 engagements · from ₹8,999 09 / ADV Tech Advisory 12 engagements · from ₹100

Not sure where to start?

Book a short advisory session and let a specialist point you to the right engagement.

See advisory sessions Full catalogue

Specification SEC·102

SEC · Security & Compliance Defined scope Fixed fee

DPDP Act Readiness Review

A gap assessment against the DPDP Act, 2023 covering consent, retention, notices and breach handling, with a prioritised remediation plan.

Fee · GST incl.
₹22,999
Duration
15 working days
Deliverables
7

01 Overview

Few product teams can say where all their customers' personal data sits, yet the Digital Personal Data Protection Act, 2023 holds Indian businesses accountable for every copy. We trace it across databases, analytics, support inboxes, marketing tools and the spreadsheets saved on individual laptops, then test your consent flows, retention practice and processor contracts against the Act's obligations. The output is a remediation plan with effort estimates. This is an engineering-led review, not legal advice, and we point out plainly where a lawyer should take over.

02 Deliverables

7 items

What you receive at handover

  1. D01 Inventory of personal data held across your systems, vendors and storage locations
  2. D02 Data flow maps from collection through processing and sharing to deletion
  3. D03 Gap assessment against DPDP Act obligations, rated by severity
  4. D04 Review of consent notices and consent capture, with rewritten wording
  5. D05 Proposed retention schedule for each category of data
  6. D06 Data principal rights process for access, correction and erasure
  7. D07 Breach notification procedure and a remediation plan with effort estimates

03 Outcomes

What should be true once it ships

  • A clear record of where personal data sits across your organisation
  • Consent and retention practices you can defend rather than assume
  • A prioritised plan in place of a vague sense of exposure

04 Process

How the 4 stages run

  1. Discover System owners are interviewed and personal data is located, including shadow copies
  2. Map Data flows are documented from collection to deletion
  3. Assess Current practice is compared with the Act clause by clause
  4. Plan Gaps are prioritised with owners, effort and a suggested order

05 Fit & inputs

A good fit for

  • Indian businesses that hold customer personal data, at any volume
  • Products serving users in India that are widening the data they collect
  • Teams whose privacy policy was adapted from another website years ago

What we need from you

  • Short interviews with the owner of each system
  • Your present privacy policy, list of vendors and consent screens
  • A person with the authority to own the remediation plan afterwards

These inputs are collected through the technical brief in your dashboard after payment. The duration is counted from when they arrive.

06 Answers

Questions about this engagement

No. It is a technical and process readiness review. We work alongside your legal counsel and flag anything that needs their judgement.

The inventory and data flow maps support both. A full GDPR assessment is additional scope, which we quote separately.

Yes. Obligations grow with volume and sensitivity, but they apply from the first data principal.

This is technology work delivered digitally — nothing is shipped. Work is delivered into systems you control within the duration stated above, and the delivery and refund policies set out what happens if a date is missed.

REL Related

Often considered alongside.

All Security & Compliance
SEC — Security & Compliance SEC·101

Web Application VAPT

Manual penetration testing of your web application with evidence for each finding and a retest, so real risks are fixed and proven fixed.

Manual penetration test of authentication, authorisation and business logic

Fixed fee · GST incl.

₹29,999

Duration

12 working days

View scope
SEC — Security & Compliance SEC·104

Cloud IAM Permissions Audit

Every cloud identity checked against what it actually uses, with over-broad permissions tightened in safe batches to limit breach impact.

Inventory of all users, roles, service accounts and access keys

Fixed fee · GST incl.

₹18,999

Duration

10 working days

View scope

GST included

₹22,999

Next step

Have a system that needs building, fixing or securing?

Explore the catalogue Describe the problem