DPDP by sector
Fohrkast vs spreadsheets and consultants
Last checked 6 Nov 2026
Most businesses start DPDP work with a spreadsheet, a consultant, or both. A spreadsheet lists the work, a consultant brings judgment on the law and the business, and Fohrkast runs the daily duties and keeps the record of each step. Many businesses need the judgment and the record together, so the choice is often about which work goes where.
What does each one do?
| The work | Spreadsheet | Consultant | Fohrkast |
|---|---|---|---|
| List of duties with dates | Typed and kept up by the business | Delivered at the time of the engagement | A register of each duty, with its date and clause |
| Reading the law for this business | No | Yes | No; Fohrkast shows its readings, and counsel decides |
| Notices | No | Drafted by hand | Drafted from the purposes and data map; the business checks and publishes |
| Consent records | Typed in, if at all | Advice on what to record | Recorded per purpose, with withdrawal |
| Rights requests | Tracked by hand | Advice on hard cases | A desk that dates each request and drafts each reply |
| Breach | A plan on file | Advice during the incident | An incident record and drafts of each notice and the 72 hour report |
| Proof of each step | Any cell can change with no trace | Reports and letters | A tamper evident record and an exportable evidence pack |
When is a spreadsheet enough?
A spreadsheet suits the first look: listing what data is held, where it sits and who uses it. It also needs a person to keep it current, and it does not show who changed what. The Act asks a business to prove notice and consent when consent is the basis of processing (s.6(10)), so the record itself comes to matter as the work grows.
When is a consultant the right call?
A consultant or counsel suits questions that turn on judgment: whether an exemption applies, which role a business holds, how to answer a hard request, what to do during a breach. Fohrkast does not give legal advice. The business decides and sends every notice and report, and remains the Data Fiduciary, responsible for its duties (s.8(1)).
What does Fohrkast add?
- A register of each duty that applies to the business, from a signed and versioned rulebook.
- Consent records per purpose, a rights desk and a grievance desk with dates.
- An incident record with the time the business became aware of the breach, never prefilled, and drafts for the business to send.
- A tamper evident record of each step, and an evidence pack that can be exported and handed to counsel or a consultant.
The DPDP fact sheet sets out plans, limits and dates. Firms that advise several businesses can see DPDP software for partner firms.
Questions and answers
Can a business meet the DPDP Act with spreadsheets alone?
The Act does not name any tool. It asks for the duties to be met and for consent and notice to be provable (s.6(10)). A spreadsheet can hold a list, and it gives no trace of who changed an entry.
Does Fohrkast replace a lawyer or consultant?
No. Fohrkast runs the duties and keeps the record, and does not give legal advice. Questions of judgment stay with the business and its counsel.
Can a consultant work with Fohrkast?
Yes. The evidence pack can be exported for a consultant or counsel, and a firm advising several businesses can use the partner workspace.
Sources
- Digital Personal Data Protection Act, 2023 (22 of 2023): MeitY copy. Read 6 Nov 2026.
- G.S.R. 846(E), Digital Personal Data Protection Rules, 2025: MeitY copy. Read 6 Nov 2026.
Not legal advice.