In short
Inovatree helps Indian businesses comply with the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, and with the GDPR where they serve European customers. We run privacy audits and impact assessments, draft notices and policies, design consent and breach-response processes and track regulatory change. Most DPDP obligations apply from 13 May 2027, and penalties reach ₹250 crore.
What we do
Data privacy audit
A gap assessment of how you collect, use, store and share personal data against the DPDP Act and Rules, and the GDPR where relevant, with a prioritised fix list.
Data protection impact assessment
An evaluation of a new or existing processing activity for its effect on individuals, to reduce privacy and security risk and build client trust. Significant Data Fiduciaries must carry out a DPIA every year.
Compliance programme
Notices, consent flows, data retention, processor contracts, rights handling and governance aligned to the DPDP Act, and GDPR rules for businesses serving Europe.
Regulatory tracker
Updates on Indian and global privacy developments, so you know which changes affect you and when.
Privacy policy and notices
Clear, standalone privacy notices and website policies, easy to find and written so individuals understand them.
Privacy framework
Our lawyers and technical experts work together to design a framework that identifies and manages privacy risk and protects sensitive data under current law.
DPDP Readiness Check
A free online self-assessment for healthcare organisations that gives an instant readiness score.
How we work
- 1Map the data
What personal data you hold, why, where it lives and who it reaches.
- 2Assess the gaps
Each obligation tested against current practice.
- 3Fix
Notices, consent, contracts, security and breach response put in place.
- 4Sustain
Training, records and a tracker so compliance survives change.
Frequently asked questions
When does the DPDP Act apply to my business?
The DPDP Rules were notified on 13 November 2025 and come into force in phases. Most obligations for businesses, including notice, consent, security safeguards, breach reporting, retention and individual rights, apply from 13 May 2027.
What is the maximum penalty under the DPDP Act?
Up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach. Failing to notify a breach and breaching obligations on children's data can each attract up to ₹200 crore.
Does the GDPR apply to Indian companies?
It can. The GDPR applies to businesses outside the EU that offer goods or services to people in the EU or monitor their behaviour there, so many Indian IT, SaaS and outsourcing companies must comply with both regimes.
How quickly must a data breach be reported under the DPDP Rules?
The Data Protection Board and each affected individual must be informed without delay, and a detailed report must reach the Board within 72 hours of becoming aware of the breach.