DPDP software for partner firms
Last checked 22 Oct 2026 · Draft. Awaiting counsel review.
A partner firm that looks after the privacy work of several businesses runs Fohrkast for them from one partner workspace: it imports the businesses it advises, each owner claims the workspace for its business, and the firm sees counts and prepares drafts, with no access to records or personal data. No legal duty moves to the firm: each business remains the Data Fiduciary (s.8(1)), and partner pricing is set under the partner agreement.
How does the partner route work?
- The firm imports the businesses it advises. Fohrkast emails each owner a claim link, valid for 14 days and usable once. The owner claims the workspace for the business.
- The firm holds counts and drafts only, with no access to records or personal data.
- Once the owner signs a mandate, the firm can act within the powers the owner ticks: publish documents, review and accept, accept unedited updates in bulk, log requests, and prepare and track incidents. Opening sealed personal data and adding staff stay excluded unless ticked. A mandate runs for 12 months and can be revoked at any time with immediate effect. The mandate text is awaiting counsel review.
- A distributor sees counts across its partner firms, never records.
Which duties weigh most for the businesses a partner firm looks after?
- A published contact and request route. The business contact of the Data Protection Officer or of a person who answers questions, shown on the website or app and repeated in every reply to a rights request, and how people make a request (s.8(9), Rule 9, Rule 14(1)).
- Grievances. An easy route to complain and a published response period of at most 90 days (s.8(10), s.13, Rule 14(3)).
- Notice and consent. A notice before or with every consent request (s.5(1), Rule 3), withdrawal as easy as giving consent (s.6(4)), and proof of each notice and consent (s.6(10)).
- Rights requests. Access (s.11), correction (s.12(2)), erasure (s.12(3)) and nomination (s.14). Rule 14(3) caps the grievance period at 90 days, and the PIB explainer of 17 Nov 2025 applies 90 days to access, correction and erasure requests; Fohrkast dates them 90 days from receipt, a reading pending counsel.
- Breaches. Each affected person and the Board told without delay, and the detailed report to the Board within 72 hours of becoming aware (Rule 7(1), Rule 7(2)(a), Rule 7(2)(b)). Penalty up to ₹200 crore (s.33, Schedule item 2).
- Vendors, the firm included. A firm that handles personal data for a business, as an accounting firm may, is one of its vendors: the business stays responsible for that processing (s.8(1)) and needs a valid contract with the firm that includes reasonable security safeguards (s.8(2), Rule 6(1)(f)).
When do the duties start?
| Date | What starts | Gazette reference |
|---|---|---|
| 13 Nov 2026 | Registration of Consent Managers (s.6(9), s.27(1)(d), Rule 4). | G.S.R. 843(E), item (b); G.S.R. 846(E), Rule 1(3) |
| 13 May 2027 | Nearly every duty on businesses, and the Board's penalties. | G.S.R. 843(E), item (c); G.S.R. 846(E), Rule 1(4) |
Both dates count from the Gazette dated 13 November 2025; some sources give 14 Nov 2026 and 14 May 2027. Fohrkast counts from 12 Nov 2026 and 12 May 2027, a day early, until counsel confirms, and shows each duty as a recommended step until its start date.
What does Fohrkast do for a partner firm?
- One partner workspace for the businesses the firm advises, each with the duties in the Act and the Rules that apply to it, with its date, its basis and the clause it comes from.
- Counts across the firm's businesses, and the drafts the firm prepares.
- The owner's screens, the claim page and the hosted request page in English or Hindi.
- For each business, every step written to a hash-chained record (SHA-256) with times in IST, and an evidence pack the business can export on every plan, including after a plan ends.
What does Fohrkast not do?
- Give legal advice.
- File or send on a business's behalf.
- Hold more personal data than a duty needs.
- Claim a security certification. Fohrkast holds none yet.
No legal duty moves to the firm: each business remains the Data Fiduciary, responsible for its duties, including when a partner firm acts for it (s.8(1)).
Which plan usually fits?
Partner pricing and terms are set under the partner agreement and are not published. To ask, request access at fohrkast.com and choose "A partner firm". The plans a business holds on its own are on fohrkast.com/pricing.
Questions and answers
Is there DPDP software for a firm that manages many client businesses?
Yes. A partner firm looks after its clients from one Fohrkast partner workspace: it imports them, each client claims its own workspace, and the firm sees counts and prepares drafts. Once a client signs a 12-month mandate, the firm can act within the powers the client ticks. Each client remains the Data Fiduciary (s.8(1)), and partner pricing is set under the partner agreement.
Does a partner firm become responsible for its clients' DPDP duties?
No. Each business remains the Data Fiduciary, responsible for its duties, including when a partner firm acts for it (s.8(1)). A firm that handles a client's personal data does so as one of that client's vendors, under a valid contract with reasonable security safeguards (s.8(2), Rule 6(1)(f)).
What can a partner firm see in Fohrkast?
Counts and drafts only, with no access to records or personal data. Once a client signs a mandate, the firm can act within the powers the client ticks; opening sealed personal data and adding staff stay excluded unless ticked. A distributor sees counts across its partner firms, never records.
How does a client business join through its partner firm?
The firm imports the business. Fohrkast emails the owner a claim link, valid for 14 days and usable once, and the owner claims the workspace for the business.
How is Fohrkast priced for partner firms?
Partner pricing and terms are set under the partner agreement and are not published. To ask, request access at fohrkast.com and choose "A partner firm".
Sources
- Digital Personal Data Protection Act, 2023 (22 of 2023): MeitY copy. Read 21 Oct 2026.
- G.S.R. 846(E), Digital Personal Data Protection Rules, 2025: MeitY copy. Read 21 Oct 2026.
- G.S.R. 843(E), commencement of the Act, 13 Nov 2025: MeitY copy. Read 21 Oct 2026.
- PIB explainer, DPDP Rules 2025 Notified, 17 Nov 2025: PDF. Read 21 Oct 2026.
- Fohrkast rulebook in.dpdp version 1: published duties.
Related duties in the published rulebook: vendor contracts, a published contact, the grievance route, access requests, the 72-hour report.
Not legal advice. Legal statements on this page are awaiting counsel review.