Digital Personal Data Protection Act 2023 and Rules 2025
DPDP compliance software for Indian businesses
Every Indian business that keeps personal data in digital form now has dated duties under the DPDP Act. The highest penalty is up to ₹250 crore.
- Collect
- Hold
- Share
- Respond
- Protect
- Prove
Where it hides
Personal data hides in ordinary places
A normal business holds personal data in more places than it lists. Fohrkast helps map each one.
- 01
The billing counter
Names, mobile numbers and bills, typed at every sale.
- 02
WhatsApp groups
Orders, photos and addresses shared by staff and customers.
- 03
Excel on the shop PC
Customer lists, credit entries and staff salaries in one file.
- 04
A delivery app
Addresses and phone numbers passed to a vendor.
- 05
CCTV
Faces of every customer and worker, kept for weeks.
The journey
One system for the DPDP duties
Six sections, in the order personal data moves through a business.
- 1
Collect
Notices and consent, recorded per purpose, with withdrawal as easy as giving it.
- 2
Hold
A map of every place personal data sits, and how long each kind is kept.
- 3
Share
Every vendor that handles personal data, with its contract and its answers.
- 4
Respond
Requests to see, correct or erase data, each with its clock.
- 5
Protect
Security safeguards, and the incident desk with the 72 hour report.
- 6
Prove
A tamper evident record of each step, exported as an evidence pack.
Breach mode
When a breach happens
The incident desk takes over the screen, starts the clock from the moment the business became aware, and drafts each notice. The business checks and sends them.
The detailed report to the Board is due within 72 hours of becoming aware (Rule 7(2)(b)).
- Contain
- Assess
- Notify the Board
- Notify people
- Close
- Draft: notice to each affected person (Rule 7(1))
- Draft: first intimation to the Board (Rule 7(2)(a))
- Draft: detailed report to the Board (Rule 7(2)(b))
The business reviews each draft and sends it.
Proof
How the record is kept
Records a business holds in Fohrkast, and Fohrkast's servers, backups and logs, are in India: in Mumbai, with backup and audit copies in Hyderabad.
- Personal details are sealed under a key for each person, and each opening is written to the audit trail.
- Every step is written to a hash chained record (SHA 256) with times in IST, sealed each night.
- The scanner runs in the business's own environment and sends labels and counts only.
Pilots and logos: not set. Trust
Extras
Extras, and what comes next
Named here, priced inside the product, based on the business's data and needs.
- Ad suppression sync
- Token vault
- Vendor gateway
- Priority support
- Round the clock breach hotline
- Managed privacy office
- Extra breach drills
- Escrow
- Expert desk
- AI gate and agent register
- Consent manager hub
- Partner network
Sectors
DPDP by sector
Pages for each kind of business. Draft pages wait on approval.
- Clinics and hospitals »
- D2C and ecommerce »
- SaaS and payroll providers »
- Partner firms »
- schools Draft
- hospitals Draft
- manufacturing units Draft
- shops and retail Draft
- fertility clinics Draft
- diagnostic labs Draft
- hotels and travel businesses Draft
- lenders Draft
- brokers and investment advisers Draft
- insurers and insurance brokers Draft
At no cost
Privacy Check
A look at a business's website, at no cost: missing notices, trackers that load before consent, and forms that ask for personal details without it.
Pricing
Plans, last
The statutory features are on every plan. Plans differ by size.
-
Professional
₹9,999
a month, GST extra
-
Business
₹49,999
a month, GST extra
-
Enterprise
From ₹1,99,999
a month, GST extra
-
Institution
From ₹7,99,999
a month, GST extra
Early access is open
Buying opens soon. Join early access and the team will contact you before then.