DPDP Compliance Assessment and Database Advisory Services
A DPDP compliance assessment checks whether the personal data in your databases is found, protected, logged and deleted as the DPDP Act, 2023 and DPDP Rules, 2025 require. Geopits maps personal data across production, replicas, backups and test copies, and within 1 week delivers a personal data inventory, a risk-scored gap report and a prioritised roadmap. Our team can then move straight into implementation.
Why DPDP Act Compliance Depends on Your Database
Most organisations have started implementing DPDP with privacy notices and consent banners. The Digital Personal Data Protection Act, 2023 goes further. It asks five questions that only the data layer can answer.
Where is our personal data?
A clear record of where data is held, like production, replicas, backups and test environment.
Is it protected?
Reasonable security safeguards, including encryption, masking, and least privilege access
Who accesses it?
Access logs must be kept for at least one year, with audit settings, log retention and alerts on unusual access.
Can a breach be reported on time?
A detailed report to be given to the Data Protection Board within 72 hours.
Do we delete data on time?
Erase data when consent is withdrawn, through retention and purge activities.
What Our DPDP Compliance Assessment Covers
Personal data discovery
Every table holding names, phone numbers, emails, Aadhaar, PAN & other sensitive information.
Encryption
Ensure encryption at rest, in transit, and in backups and identify the gaps.
Access control
Privileged and shared accounts, least privilege, dormant logins.
Audit and monitoring
What's logged, how long logs are kept, alerts on unusual access.
Test and dev data
Real customer data sitting in non-production copies
Retention and erasure
Purge and deletion across replicas and backups
Breach readiness
Detection, Forensic trail, Incident runbook
Backup and recovery
Restore testing and DR coverage
How the DPDP Assessment Works
Kickoff (Day 1)
We agree the scope and set up secure, read-only access.
Discover and Assess (Days 2–4)
We scan and classify personal data and review security controls against DPDP safeguards.
Report and Roadmap (Day 5)
We walk you through the findings and a prioritised plan.
Implement (from Week 2)
We close the gaps with your team, or manage DPDP-compliant operations for you.
What You Get: DPDP Gap Report and Roadmap
A personal data inventory across all your databases
A risk-scored gap report (High / Medium / Low)
A prioritised remediation roadmap
A one-page executive summary for leadership
A walkthrough session, then hands-on implementation support from the same team
DPDP Compliance FAQs
When does DPDP compliance become mandatory?
The DPDP Rules were notified in November 2025, with most obligations applying 18 months later, around May 2027. Fixing database gaps takes months, so it's best to start now.
We already have a privacy policy. Isn't that enough?
A policy says what you'll do. The Act expects you to actually protect, log and delete personal data, and much of that happens in your databases.
Will this affect our production systems?
No. We use read-only access and schedule the work around your peak hours.
Does our data leave our environment?
No. We record only metadata, such as table and column names, never customer records.
What happens after the assessment?
You can act on the roadmap with your own team, or let Geopits handle remediation and ongoing management.
What is a DPDP compliance assessment?
A review of how your organisation finds, protects, logs and deletes personal data under the DPDP Act, 2023 and the DPDP Rules, 2025. Geopits focuses on the database layer, where most obligations are actually met, and delivers a gap report and a prioritised roadmap.
What does the DPDP Act require from databases?
Six things:
- Know where personal data is stored.
- Protect it with reasonable safeguards such as encryption and masking.
- Limit and review access.
- Keep access logs for at least a year.
- Report breaches to the Data Protection Board within 72 hours.
- Erase data when it is no longer needed or consent is withdrawn.
What is the penalty for DPDP non-compliance?
Up to ₹250 crore per instance for failing to take reasonable security safeguards to prevent a personal data breach, and up to ₹200 crore for not notifying a breach.
How long does a DPDP compliance assessment take?
About 1 week from kickoff to report. Implementation then starts right away, with timelines set by the roadmap. Want a quick view first? The free DPDP readiness check gives you a score in about 3 minutes.
2027 is closer than it looks. Start with a free health check.
A 30-minute call with a senior Geopits Engineer to review your organisation’s database setup and discuss where DPDP gaps are most likely to sit. No obligation.
The privacy policy is the promise. The database is the proof. Geopits gets that proof ready before the Data Protection Board comes asking.