India DPDP Act

Digital Personal Data Protection Act 2023: data processor inventory, third-party controls.


Short name	DPDP
Region	Asia-Pacific
Country or scope	India
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers DPDP

Scan requirements: 4, all decided by a scan.
Controls: the scan requirements below, plus 9 controls from Safeguard's control catalog for DPDP.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for DPDP and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 4 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`DPDP-S8` Data Fiduciary Identification	India DPDP requires data fiduciary identification for personal data processing	Scan
`DPDP-S9` Data Principal Rights Components	DPDP requires capability for data principal rights (access, correction, erasure)	Scan
`DPDP-S10` Consent Manager Documentation	India DPDP allows consent managers: document consent management components	Scan
`DPDP-S16` Significant Data Fiduciary Controls	Significant data fiduciaries require additional security and data localization	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`DPDP-S4`	Process Personal Data Only for Lawful Purposes
`DPDP-S5`	Provide Clear and Accessible Notice of Data Processing
`DPDP-S6`	Obtain Free, Specific, and Informed Consent
`DPDP-S6-W`	Honour Consent Withdrawal Without Detriment
`DPDP-BREACH`	Notify Data Principals and DPBI of Personal Data Breaches
`DPDP-SDF`	Apply Heightened Obligations for Significant Data Fiduciaries
`DPDP-CHILD`	Protect Children's Personal Data
`DPDP-PROCESSOR`	Govern Data Processors by Written Contract
`DPDP-XBORDER`	Restrict Cross-Border Data Transfers to Permitted Countries

Policy templates

Written for DPDP:

Consent and Notice Management Policy (DPDP Act 2023)
Data Principal Rights and Grievance Redressal Policy (DPDP Act 2023)
Cross-Border Personal Data Transfer Policy (DPDP Act 2023)

And 22 from the standard set, adapted to DPDP.