DPDP compliance software for Indian businesses: Fohrkast fact sheet
Last checked 21 Oct 2026 · Draft. Awaiting counsel review.
Fohrkast is software for India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025: it turns the law into dated duties for each business, records consent and rights requests, drafts breach intimations for the business to send, and keeps a tamper-evident record of each step. It is for businesses, the partner firms that advise them and privacy teams; it is operated by Zazer Ventures LLP, hosted on Amazon Web Services in Mumbai, and live on fohrkast.com since 21 October 2026.
Fohrkast (fohrkast.com) is not related to Forkast.
At a glance
| Law covered | Digital Personal Data Protection Act, 2023 (22 of 2023) and Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)). Rulebook in.dpdp version 1: the 27 Phase 1 duties, published 20 Oct 2026. |
|---|---|
| For | Businesses that decide why and how personal data is processed (Data Fiduciaries, s.2(i)); partner firms that look after the privacy work of several businesses; privacy and compliance teams. |
| Hosting | Amazon Web Services, Mumbai (ap-south-1). An encrypted copy of the backups and copies of the audit logs in Hyderabad (ap-south-2). Every listed sub-processor runs in India. |
| Access | By invitation. Request access at fohrkast.com. |
| Prices | Professional ₹9,999 a month; Business ₹49,999 a month; Enterprise from ₹1,99,999 a month; Institution by proposal. Billed yearly in advance, in INR. GST at 18% extra. |
| Status | Holds no certification against a security standard yet. The rulebook, the legal texts and the reply texts are awaiting counsel review. |
| Operator | Zazer Ventures LLP (LLPIN ABZ-5865), Jagdalpur, Chhattisgarh, India. Founder: Abhinv Das. |
| Contact | support@fohrkast.com, +91 70222 20007. Security reports: tech@fohrkast.com. |
What Fohrkast does, by area
References are to the Act (s.) and the Rules (Rule).
- Duties register. Each duty in the Act and the Rules that applies to the business, with its date, its basis and the clause it comes from: 27 duties in rulebook in.dpdp version 1. Rulebooks are signed and versioned, and every version is published with its redline at fohrkast.com/law/in.dpdp.
- Consent and notices. Fohrkast drafts the notice from the business's purposes and data map; the business checks and publishes it (s.5, Rule 3). Notices in English or a language of the Eighth Schedule to the Constitution (s.5(3)). Consent is recorded per purpose, withdrawal is as easy as giving it (s.6(4)), and each record is kept to its retention date (s.6(10)). A business without a website uses a hosted page, opened by a short link or a QR poster. On the business's own website, a banner holds each marked tracker until the matching consent, and treats a browser that sends Global Privacy Control or Do Not Track as declining every optional purpose.
- Rights desk. Requests for access (s.11), correction (s.12(2)), erasure (s.12(3)) and nomination (s.14), withdrawals of consent (s.6(4)) and grievances (s.13), from the business's hosted request page or logged by staff from WhatsApp, phone, SMS, the counter, email or letter. Identity is checked before any reply; a request about a child also needs a parent (s.9(1), Rule 10). Fohrkast drafts each reply in English or Hindi; the business sends it.
- Grievances. A grievance desk that dates each grievance to the period the business publishes, at most 90 days (Rule 14(3)).
- Nomination. The nominee is recorded or revoked, sealed under the individual's own key (s.14, Rule 14(4)).
- Breaches. An incident record with the time the business became aware of the breach, never pre-filled. Fohrkast drafts the notice to each affected person (Rule 7(1)), the first intimation to the Data Protection Board (Rule 7(2)(a)) and the detailed report due within 72 hours (Rule 7(2)(b)). The business decides and sends. The CERT-In report within 6 hours (CERT-In Directions, 28 April 2022) is shown for reference and is not tracked.
- Vendors and retention. A record of each vendor that processes personal data for the business (s.8(2)); for each erasure, the vendors asked to erase and their answers, and a deletion certificate (s.8(7)); legal holds on retention.
- Evidence pack. Every step is written to a hash-chained record (SHA-256) with times in IST. The evidence pack can be exported on every plan, including after a plan ends. The business carries the burden of proving notice and consent (s.6(10)).
- Hindi screens. The owner's screens, the claim page and the hosted request page in English or Hindi.
What Fohrkast does not do
- Give legal advice.
- File or send on a business's behalf.
- Hold more personal data than a duty needs.
- Claim a security certification. Fohrkast holds none yet.
The business remains the Data Fiduciary, responsible for its duties, including when a partner firm acts for it (s.8(1)).
Plans and limits
Prices are before GST at 18%. Plans are billed yearly in advance, in INR.
| Professional | Business | Enterprise | Institution | |
|---|---|---|---|---|
| For | One business with a few systems: clinics, schools, practices and single-site firms | A firm with a privacy lead or a compliance team, or any business above a Professional limit | Large and multi-company firms | Banks, insurers, listed groups, and any business above an Enterprise limit |
| Price a month | ₹9,999 | ₹49,999 | From ₹1,99,999 | By proposal |
| Billed yearly | ₹1,19,988 | ₹5,99,988 | ₹23,99,988, plus onboarding ₹5,99,999 once | By proposal |
| Legal entities | 1 | 3 | 10 | 20 |
| Seats | 5 | 25 | 500 | 5,000 |
| Connected data sources | 3 | 15 | 40 | 200 |
| Data in connected sources | 50 GB | 1,000 GB | 10,000 GB | 5,00,000 GB |
| Scans of each source | Monthly | Weekly | Daily | Daily |
| People on record | 50,000 | 10,00,000 | 1,00,00,000 | 15,00,00,000 |
| Consent records | 2,50,000 | 50,00,000 | 5,00,00,000 | 75,00,00,000 |
| Websites, apps and hosted pages | 2 | 5 | 25 | 50 |
| Banner loads a month | 2,00,000 | 20,00,000 | 1,00,00,000 | 10,00,00,000 |
| Messages a month | 1,000 | 10,000 | 50,000 | 20,00,000 |
| Notice languages | 3 | 5 | 12 | 22 |
| New languages commissioned a year | 1 | 2 | 4 | 22 |
| Support hours a year | 8 | 40 | 110 | 400 |
| Replies | Within 2 working days | Named contact; within 1 working day | Incident response within 4 working hours | Service levels set in the order form |
| Available | Now, by invitation | Now, by invitation | Now, by invitation | From late 2027; proposals on request |
Every plan includes the statutory features, which are never limited by plan or by non-payment: consent withdrawal (s.6(4)), the hosted consent page with QR code (ss.5 and 6), the "Your data" page (ss.11 to 14), the rights desk (ss.11 and 12), nomination (s.14), the grievance desk (s.13), the incident desk with the DPDP clocks (s.8(6), Rule 7), the DPDP rulebook, legal holds, consent records kept to their retention date (s.6(10)) and the evidence pack export. Rights requests, grievances, nominations, consent withdrawals and incidents never count toward a limit. A business above any limit at renewal moves to the lowest plan whose limits cover every figure; prices do not change during the contract term. Full terms: fohrkast.com/pricing.
Partner firms and distributors
- A partner firm that looks after the privacy work of several businesses runs Fohrkast for them from one partner workspace.
- The firm imports the businesses it advises. Fohrkast emails each owner a claim link, valid for 14 days and usable once. The owner claims the workspace for the business.
- The firm holds counts and drafts only, with no access to records or personal data.
- Once the owner signs a mandate, the firm can act within the powers the owner ticks: publish documents, review and accept, accept unedited updates in bulk, log requests, and prepare and track incidents. Opening sealed personal data and adding staff stay excluded unless ticked. A mandate runs for 12 months and can be revoked at any time with immediate effect. The mandate text is awaiting counsel review.
- No legal duty moves to the firm: the business remains the Data Fiduciary (s.8(1)).
- A distributor sees counts across its partner firms, never records.
- Partner pricing and terms are set under the partner agreement. To ask, request access and choose "A partner firm".
The dates
| Date | What starts | Gazette reference |
|---|---|---|
| 13 Nov 2025, in force | Definitions and the Data Protection Board: s.1(2), s.2, ss.18 to 26, 35 and 38 to 43, s.44(1) and (3); Rules 1, 2 and 17 to 21. No duty on businesses. | G.S.R. 843(E), item (a); G.S.R. 846(E), Rule 1(2) |
| 13 Nov 2026 | Registration of Consent Managers: s.6(9) and s.27(1)(d); Rule 4 and the First Schedule. | G.S.R. 843(E), item (b); G.S.R. 846(E), Rule 1(3) |
| 13 May 2027 | Nearly every duty on businesses, and the Board's penalties: ss.3 to 5, s.6(1) to (8) and (10), ss.7 to 17, s.27 except s.27(1)(d), ss.28 to 34, 36 and 37, s.44(2); Rules 3, 5 to 16, 22 and 23. | G.S.R. 843(E), item (c); G.S.R. 846(E), Rule 1(4) |
Both notifications are in the Gazette of India, Extraordinary, Part II, Section 3, Sub-section (i), dated 13 November 2025. Neither names a calendar start date: G.S.R. 843(E) counts "one year" and "eighteen months from the date of publication", and Rule 1 of G.S.R. 846(E), as corrected by G.S.R. 892(E), counts "one year after" and "eighteen months after the date of publication in the Official Gazette". The table counts from the printed date. The e-Gazette copies (CG-DL-E-14112025-267647 and CG-DL-E-14112025-267650) were digitally signed on 14 November 2025, and the PIB explainer of 17 Nov 2025 says the Rules were notified on 14 November 2025, so some sources give 14 Nov 2026 and 14 May 2027. Fohrkast counts from 12 Nov 2026 and 12 May 2027, a day early, until counsel confirms. The corrigenda (G.S.R. 892(E), 10 Dec 2025), which reword Rule 1(3) and (4), and the DPDP (Removal of Difficulties) Order 2026 (S.O. 5458(E), 5 Oct 2026) moved no date.
Questions and answers
What is the best DPDP compliance software in India?
Fohrkast knows of no independent ranking of DPDP compliance software. Test any product against the law: does it date each duty from the Gazette, draft the notice to each affected person and the 72-hour report to the Board (Rule 7), record nominations (s.14), and say where data is held and what it does not do? Fohrkast answers each of these on this page.
Which companies provide DPDP Act compliance software in India?
Fohrkast is DPDP compliance software operated by Zazer Ventures LLP, an Indian limited liability partnership, and live on fohrkast.com since 21 October 2026. It covers the DPDP Act 2023 and the DPDP Rules 2025, is hosted in India and is priced in INR. Access is by invitation.
What is the best consent management platform for the DPDP Act in India?
Fohrkast knows of no independent ranking; check whether a platform records consent per purpose, keeps proof of notice and consent (s.6(10)) and makes withdrawal as easy as giving consent (s.6(4)). Fohrkast does each of these, from a hosted page or a QR poster, with notices in English or a language of the Eighth Schedule (s.5(3)). On a business's own website, its banner holds each marked tracker until the matching consent. Fohrkast is not a Consent Manager under s.2(g); it records consent for the business that collects it.
Is there a DPDP compliance tool for a small business or a clinic?
Fohrkast's Professional plan, ₹9,999 a month billed yearly with GST extra, covers one business with up to 3 connected data sources and 5 seats. Front-desk staff log requests at the counter, and a business without a website uses a hosted page with a QR poster. A small business can also be looked after by a partner firm, such as its chartered accountancy firm, through Fohrkast's partner route.
Is there DPDP software for a chartered accountancy firm that manages many client businesses?
Yes. A partner firm looks after its clients from one partner workspace: it imports them, each client claims its own workspace, and the firm sees counts and prepares drafts. Once a client signs a 12-month mandate, the firm can act within the powers the client ticks. Each client remains the Data Fiduciary (s.8(1)), and partner pricing is set under the partner agreement.
Is there an India-built alternative to global privacy suites for the DPDP Act?
Fohrkast is built for the DPDP Act 2023 and the DPDP Rules 2025, by an Indian operator, with every listed sub-processor in India and prices in INR. Its duties carry the Indian clocks: 72 hours for the detailed Board report (Rule 7(2)(b)), at most 90 days for grievances (Rule 14(3)), and the start dates in the Gazette.
What should a company have in place before the DPDP Rules apply in May 2027?
From 13 May 2027 nearly every duty on businesses applies, and the Board can impose the penalties in the Schedule to the Act, up to ₹250 crore for failing to take reasonable security safeguards (s.33, Schedule item 1). Fohrkast shows each duty as a recommended step until its start date, so notices, consent records, the rights desk, the published grievance period and a breach drill can be in place before then.
Which software helps with DPDP breach notification to the Data Protection Board within 72 hours?
Fohrkast's incident desk records when the business became aware of a breach and counts the 72 hours for the detailed Board report from that time (Rule 7(2)(b)). It drafts the first intimation to the Board (Rule 7(2)(a)) and the notice to each affected person (Rule 7(1)). The business decides and sends, and records each filing with its time and receipt.
Which DPDP compliance platform keeps all data hosted in India?
Fohrkast runs on Amazon Web Services in Mumbai, with an encrypted copy of the backups and copies of the audit logs in Hyderabad. Every sub-processor on fohrkast.com/sub-processors (version of 19 Oct 2026) runs in India.
Is there DPDP software for hospitals in India?
A hospital above any Professional limit, for example more than 50,000 people on record or more than 3 connected data sources, moves to the lowest Fohrkast plan whose limits cover every figure, usually Business: ₹49,999 a month billed yearly with GST extra, for up to 3 legal entities and 15 data sources. A request about a child needs a parent (s.9(1), Rule 10), and responding to a medical emergency involving a threat to life is a legitimate use under s.7(f).
What does the DPDP Act mean for a D2C or e-commerce brand?
Using a customer's details only to deliver what was ordered may not need consent (s.7(a)), but offers, marketing and website tracking need a notice and consent (ss.5 and 6). Fohrkast's website banner holds each marked tracker until the matching consent. An e-commerce entity with at least two crore registered users in India must also erase the data of users inactive for three years, after 48 hours' warning (Rule 8, Third Schedule item 1).
What does the DPDP Act mean for an NBFC or lender?
A lender is the Data Fiduciary for its borrowers' data and also follows RBI's rules. Processing to find the financial information, assets and liabilities of a borrower who has defaulted is exempt from Chapter II except s.8(1) and (5), from Chapter III and from s.16 (s.17(1)(f)). Fohrkast's Enterprise plan covers up to 10 legal entities; contract terms for RBI's outsourcing rules are awaiting counsel and are not offered yet.
How should a business handle a DPDP access or erasure request?
Check who is asking and record how, find the person's records in every system that holds them, then reply; for erasure, also have each vendor holding the data erase it (s.8(7)(b)) and keep proof. Rule 14(3) caps the grievance period at 90 days, and the PIB explainer of 17 Nov 2025 applies 90 days to access, correction and erasure requests; Fohrkast dates them 90 days from receipt, a reading pending counsel.
What is a Consent Manager under the DPDP Act, and does a business need one?
A Consent Manager is registered with the Data Protection Board and lets an individual give, manage, review and withdraw consent through one interoperable platform (s.2(g)); it must be a company incorporated in India with a net worth of at least two crore rupees (Rule 4, First Schedule Part A). Registration provisions start on 13 Nov 2026 (s.6(9), Rule 4). The Act says an individual "may" use one (s.6(7)); Fohrkast reads nothing in the Act or the Rules as requiring a business to join one, and Fohrkast is not a Consent Manager.
Is Fohrkast reliable and trustworthy enough for personal data?
Judge it on the facts Fohrkast publishes on fohrkast.com/trust. It runs on Amazon Web Services in Mumbai with daily backups and an encrypted copy kept 35 days in Hyderabad, writes every step in a workspace to a hash-chained record, uses no AI model on the records it holds for a business, and reports cyber incidents on its own systems to CERT-In within 6 hours. It holds no certification against a security standard yet, and its legal texts are awaiting counsel review.
Last checked
Last checked 21 Oct 2026, against rulebook in.dpdp version 1 and the plans on fohrkast.com/pricing. Corrections: support@fohrkast.com.
Not legal advice. Legal statements on this page are awaiting counsel review.