DPDP by sector

How to choose DPDP compliance software

Last checked 6 Nov 2026

DPDP software should show how each screen ties to the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, and leave the business with records it can produce later. These questions work for any product, and each one comes with Fohrkast's own answer.

Does each duty name its clause and its date?

A duty with no clause cannot be checked, and a duty with no date cannot be planned. Nearly every duty starts on 13 May 2027 under G.S.R. 843(E) and Rule 1(4) of the Rules. Ask to see the list and pick a few clauses to check against the Gazette.

Fohrkast's answer: a register of each duty with its date, basis and clause, from a rulebook that is signed, versioned and published.

Does it record consent per purpose, with withdrawal?

A notice itemises the data and each purpose (s.5, Rule 3), and withdrawing has to be comparable in ease to giving consent (s.6(4)). Ask how a withdrawal is recorded and how the record can be produced later (s.6(10)).

Fohrkast's answer: consent is recorded per purpose, withdrawal is as easy as giving it, and notices are drafted for the business to check and publish.

Can staff log requests that arrive outside the website?

Requests for access, correction, erasure and nomination (s.11, s.12, s.14) and grievances (s.13) do not always arrive through a form. Ask how a request made at a counter or by phone gets onto the record, and how identity is checked before a reply.

Fohrkast's answer: requests come from a hosted request page or are logged by staff from WhatsApp, phone, SMS, the counter, email or letter, with identity checked before any reply.

What happens in the first 72 hours of a breach?

Each affected person and the Board are told without delay, and the detailed report goes to the Board within 72 hours of becoming aware of the breach (Rule 7). Ask who writes down the time of awareness, and whether the product fills it in by itself.

Fohrkast's answer: the time is entered by a person and never prefilled. Fohrkast drafts each notice and the report.

Who decides and who sends?

The Data Fiduciary answers for its duties (s.8(1)), whatever software it uses. Ask whether anything goes out in the business's name without a person approving it.

Fohrkast's answer: the business decides and sends every notice and report.

Can the record be exported and checked?

Ask whether the record shows when each step happened, whether it can be changed later without trace, and whether it can be exported in a form that counsel can read.

Fohrkast's answer: every step is written to a tamper evident record, and the evidence pack can be exported on every plan.

What proof of security is there?

The Act asks for reasonable security safeguards (s.8(5), Rule 6(1)), and a vendor handling personal data works under a contract that includes them (s.8(2), Rule 6(1)(f)). Ask which certificates the vendor holds today, and read the security terms in the contract.

Fohrkast's answer: Fohrkast holds no certification against a security standard yet. Its security policy and sub processors are published.

How much personal data does the product itself hold?

Software that holds a copy of every record becomes one more place to protect. Ask what it stores, how it is sealed and who can open it.

Fohrkast's answer: it is designed to hold the least personal data each duty needs. Personal details are sealed under a key for each person, and each opening is written to the audit trail.

The DPDP fact sheet sets out plans, limits and dates.

Join early access

Questions and answers

Does the DPDP Act require software?

No. The Act names no tool. It sets the duties and the proof they need, and software is one way to meet them.

Does buying software make a business meet the Act?

No. The business remains the Data Fiduciary and answers for its duties (s.8(1)). Software supports the work and keeps the record.

What should a business check first?

Whether each duty names its clause and date. A few minutes against the Gazette shows how carefully a product was built.

Sources

Not legal advice.