What is the DPDP Act 2023?

India's Digital Personal Data Protection Act 2023 governs lawful processing of digital personal data, mandates itemised notice and consent (§5, §6), Data Principal rights (§11–§14), 72-hour breach notification (§8(6)) and stricter obligations for Significant Data Fiduciaries.

How fast can Crawlshark make us DPDP-ready?

Most mid-market Indian SaaS and D2C teams go live in 5–10 days using Crawlshark's SDK, notice templates in 22 Indian languages and DSR workflows.

What is the penalty under the DPDP Act?

Penalties go up to ₹250 crore per instance for failure to safeguard personal data, ₹200 crore for breach notification failures and ₹200 crore for children's data violations.

Notification № CS/2026/00412Published under §6(1) DPDP Act 2023Price · ₹0

Privacy is the new Standard.

Your legal team just forwarded the DPDP Rules. Your CEO wants a status update by Friday. Your engineers have never heard of a Consent Manager. We ship the SDK, the consent ledger, and the 22-language notices in five working days — so the next board meeting isn’t about a ₹250 Cr notice from the Data Protection Board.

If you’re reading this, you already know: one missed Data Principal request, one un-itemised notice, one 72-hour breach window slipped — and the fine is larger than the ₹19.5 Cr an average Indian breach already costs (IBM, 2024). Book a 20-minute demo this week. Walk out knowing exactly where you stand, and how fast we can close the gap.

Book compliance demo Run a free DPDP scan

DPDP 2023 Consent Manager-ready ISO 27001 SOC 2 II Hosted in India

crawlshark / dpdp-console Live

DPDP score

96/100

Consents

1.2M

+8% wk

Open DSRs

all in SLA

Data principal queueavg 4h 12m

ERASURErhea.k@…2h 14m

ACCESSarjun.m@…5h 02m

CORRECTsana.p@…11h 38m

WITHDRAWvikram.s@…22h 11m

Notice served · 60s22 langs

Englishहिन्दीதமிழ்বাংলাతెలుగుमराठीગુજરાતીಕನ್ನಡ

Consent ledgertamper-evident

12:04:11GRANTEDMarketing emails

12:03:58WITHDRAWWhatsApp updates

12:03:47GRANTEDAnalytics cookies

12:03:42GRANTEDPersonalisation

[02]Impact at scale

last 12 months · audited

Penalty exposure₹0 Crprevented for customers

Indian brands0+Series A to listed

Faster DSRs0%4h avg vs 7-day baseline

Languages0for notice & consent

SDF audits0passed first attempt

Breach notify<0hto DP Board

Day rollout0SDK to production

Consent capture0%cryptographically signed

Live now · ap-south-1

See India consenting in real time — map, ledger, pulse.

Open the live page

[03]Trusted by India's fastest-moving teams

KITEJUNGLEEBANYANTATVASARALNEXAKOSHVAYUINDUSMIRAOTTERPRAVAH

[04]The problem

India just rewrote the rules.
Your stack hasn't caught up.

The DPDP Act 2023 makes consent, notice and Data Principal rights legal obligations not nice-to-haves. Most product teams are flying blind.

Cookie banners aren't consent.

Pre-ticked boxes, bundled purposes, and dark patterns all fail DPDP's specific, unambiguous, freely-given consent test. Every banner you ship today is potential liability tomorrow.

DSRs are buried in support inboxes.

Access, correction, and erasure requests sit in Zendesk for days. Missed SLAs mean Board complaints, fines up to ₹250 crore, and angry users posting screenshots on X.

Notices nobody understands.

English-only legalese fails DPDP's plain-language and multilingual mandate. Users in tier-2 and tier-3 India can't read your privacy policy, let alone meaningfully consent to it.

[05]How it works

One SDK.
Three obligations.
Zero spreadsheets.

An autonomous layer that lives between your infrastructure and regulatory bodies. Real-time observability for PII across AWS, GCP and Azure.

Ships with audit-grade evidence pack

Crawl.

Drop the SDK in your web, app and backend. Crawlshark maps every data collection point, purpose, processor and cross-border flow in under an hour.

Consent.

Serve itemised, plain-language notices in 22 Indian languages. Capture cryptographically-signed consent into an immutable, tamper-evident ledger you can hand to regulators.

Comply.

Auto-route Data Principal requests with SLA tracking. Generate evidence packs on demand. Notify the Data Protection Board within the 72-hour breach window — by default.

[06]Platform

Everything DPDP demands.
Nothing it doesn't.

Six primitives, one console. Engineered with Indian privacy counsel, not retrofitted from a GDPR codebase.

F-01

Consent Ledger

Tamper-evident, timestamped, cryptographically signed. Export as legal evidence in one click.

F-02

Multilingual Notice Engine

22 official Indian languages. Auto-translated and legally reviewed templates.

F-03

DSR Automation

Access, correction, erasure, withdrawal and nomination all SLA-tracked.

F-04

Consent Manager API

Built to plug into the DPDP Board's Consent Manager framework the moment it's notified.

F-05

Breach War Room

Detect, triage and file the Board notification well inside the 72-hour window.

F-06

Audit Vault

Immutable, signed evidence room. RoPA, consent receipts, DPIAs and breach files — ready for the Board, your auditor or counsel.

F-07

Vendor & Processor Registry

Every Data Processor, contract clause and cross-border transfer in one auditable view.

[07]Customer impact

What changes after Crawlshark.

TATVA

9 days → 3 hours

Avg DSR response

"We were drowning in privacy emails. Crawlshark turned a manual nightmare into an SLA-tracked queue overnight.

Ananya Iyer

Head of Privacy, Tatva (D2C beauty)

KOSH

First-attempt pass

SDF readiness audit

"Our auditors asked for evidence; we exported a signed ledger in 30 seconds. We passed our SDF readiness audit on the first attempt.

Rohit Mehra

CISO, Kosh (Fintech SaaS)

PRAVAH

2× consent rate

in tier-2 cities

"Multilingual notices doubled informed consent in Bharat. Users actually read them when they're in their own language.

Meera Joshi

VP Product, Pravah (Edtech)

[08]DPDP coverage

Mapped to the Act,
section by section.

Every Crawlshark feature ties back to a specific obligation under the Digital Personal Data Protection Act 2023 and its Rules. No interpretive gymnastics, no GDPR-shaped pegs in DPDP-shaped holes.

SectionObligationCoverageStatus

DPDP §4Lawful consentSpecific, informed, unambiguous & freely given. Covered

DPDP §5NoticeItemised, plain-language, in the user's chosen Indian language. Covered

DPDP §6Consent withdrawalOne-tap withdrawal, propagated across your stack. Covered

DPDP §8Security safeguardsReasonable technical and organisational measures. Covered

DPDP §8(6)Breach notificationBoard + affected Data Principals within 72 hours. Covered

DPDP §10SDF obligationsDPO, audits, DPIAs, periodic data erasure. Covered

DPDP §11Right to accessSummary of processing, purposes, and recipients. Covered

DPDP §12Correction & erasureRectify, complete, update or erase on request. Covered

DPDP §13Grievance redressalReadily available, auditable, time-bound. Covered

DPDP §14Right of nominationNominate another individual to exercise rights. Covered

DPDP §16Cross-border transferRestricted-country logic and transfer registry. Covered

DPDP §17Children's dataVerifiable parental consent and no profiling. Covered

[09]Integrations

Plugs into the Indian stack you already run.

60+ integrations · webhooks · REST · GraphQL

Shopify

Razorpay

WebEngage

MoEngage

Segment

Mixpanel

Postgres

MongoDB

AWS

GCP

Snowflake

Zendesk

[10]ROI calculator

What does DPDP cost if you wait?

Three sliders. Live numbers. A back-of-the-envelope view of penalty exposure avoided, prep hours saved, and the DSR throughput Crawlshark unlocks for a team your size.

[ inputs ]

Monthly active users5,00,000

10K1M10M

Industry

Data sensitivityMedium

MarketingPII + paymentsHealth / minors

[ note ] Estimates derived from DPDP Act §33 penalty bands, customer benchmarks across 600+ Indian deployments and an 87% audit-prep reduction baseline. Directional, not legal advice.

[ projected impact / year ]live

Penalty exposure avoided

₹10.4 Crof a ₹12.0 Cr worst-case under DPDP §33

Audit & prep hours saved

377hrs

≈ 2.4 FTE-months reclaimed

DSR throughput / day

281vs 6.7/day manual

200 requests/mo expected

SLA-breach risk without automation

DPDP §13 grievance redressal

80%

Book a DPDP readiness review Email me this report

[10]Pricing

Priced in rupees.
Built for Indian budgets.

All plans include consent collection, multilingual notices and the free DPDP scan. No per-seat fees, no annual lock-in, no surprise overages. Save 20% on annual billing.

T-01tier

Free Scan

₹0free forever

Run a DPDP gap analysis in under 10 minutes. No card required.

Free DPDP readiness scan + PDF report
Consent banner — 1 domain
Up to 25,000 MAU
English + Hindi notices
Email-based DSR intake
Cookie & tracker auto-discovery
Community Slack support

Start free scan

T-02tier

Launch

₹2,499/ month

For seed-stage and bootstrapped Indian startups going live with DPDP basics.

Everything in Free Scan
Up to 100,000 MAU · 3 domains
8 Indian languages (auto-translated)
Self-serve DSR workbench
Consent receipts (PDF export)
Basic vendor registry (10 processors)
Cookie consent + preference center
Email support · 24h response

Start 14-day trial

Privacy is our product —
and our practice.

Your customers' data lives in Mumbai and Hyderabad. It never leaves India unless you explicitly route it.

ISO 27001

SOC 2 Type II

MeitY-empanelled cloud

Data residency in India

Pen-tested quarterly

24/7 IST SOC

[12]Frequently asked

Answers for Indian privacy buyers.

The Act was passed in August 2023 and the DPDP Rules have been operationalised. Sectoral enforcement and SDF designations are rolling out now — most counsel are advising readiness ahead of the next quarterly review cycle.

DPDP enforcement is here

India's DPDP clock
is ticking. Be ready before
the Board calls.

Get a free DPDP gap report in under 10 minutes. No credit card, no sales call until you want one.

Run free DPDP scan Book a demo