Sections 5 and 6
Consent and notices
Purpose-wise consent with a tamper-evident ledger. Notices in 22 scheduled languages, reviewed by your team before they go live.
DPDP Act 2023 Built for the DPDP Rules 2025
Run data protection compliance every day, not once a year.
ShieldDPC gives Indian businesses one place to collect consent, publish notices in Indian languages, answer data principal requests, report breaches on time and prove it all to the Data Protection Board.
Prefer to talk it through?
Book a 30-minute walkthrough
Consent notice previewEnglish
Acme RetailPurpose: order updates on SMS
Consent ledger3 records
- CN-24187 Marathi, given
- CN-24186 Tamil, withdrawn
- CN-24185 Hindi, given
Try it: switch language, then agree or decline. Every choice becomes a timestamped record.
CERT-In empanelledsecurity auditors behind it
22 Indian languagesfor notices and consent
Every change loggedwith before and after
Self-run or managedon the same platform
The DPDP Rules are phased. The clock is running.
Most obligations apply 18 months after the Rules were notified.
- Nov 2025DPDP Rules 2025 notified. Data Protection Board of India provisions take effect.
- Nov 2026Registration of Consent Managers opens. Interoperability starts to matter.
- May 2027Full obligations apply: notice, consent, rights, breach reporting, retention and security.
The numbers your team has to work to.
The Act and the Rules set hard clocks and retention periods. ShieldDPC tracks each one so nothing depends on someone remembering a date.
72hours
Breach report to the Board
Detailed report after a personal data breach, following the first intimation made without delay.
48hours
Notice before erasure
Data principals are told before their data is erased for inactivity, so they can log in and keep it.
1year
Keep processing logs
Logs and traffic data needed to detect and investigate breaches are retained for at least a year.
3years
Inactivity erasure
Large e-commerce, gaming and social media platforms erase data of users inactive for three years.
90days
Grievance resolution
The longest period you can publish for resolving data principal grievances.
22languages
Notice languages
Data principals can ask for notices in English or any language in the Eighth Schedule.
Penalties are set per breach, not per year.
The Schedule to the Act caps each category of failure separately. A single incident can attract more than one.
Maximum penalties under the Schedule to the DPDP Act 2023. For guidance only, not legal advice.
Every obligation in the Act, mapped to a working module.
Each module is tied to the section of the Act it serves, so your DPO can show exactly which control answers which duty.
Section 6(7) to 6(9)
Consent Manager ready
Withdrawal and preference changes reach every connected system through signed webhooks. Built to work with registered Consent Managers.
Section 8
Data discovery and inventory
Find personal data across systems with an India-specific detector for Aadhaar, PAN, UPI IDs, mobile numbers and more.
Section 8(6)
Breach response
Guided intimation to the Board and affected people, with owners, deadlines and a full audit trail from first alert to closure.
Section 8(7)
Retention schedules
A library of Indian statutory retention periods so you keep what the law requires and erase what it does not.
Section 9
Verifiable parental consent
Guardian verification through DigiLocker or OTP before any child's data is processed.
Sections 11 to 14
Rights requests and grievances
Access, correction, erasure, nomination and grievance requests tracked against response deadlines in one queue.
Section 10
DPIA and audits
Data protection impact assessments, periodic audits and DPO reporting for Significant Data Fiduciaries.
One dashboard for your DPO and your board.
See where you stand today, what is due this week and which teams need a nudge.
- Compliance score by obligationNotice, consent, rights, breach, retention and security, each scored separately.
- Deadlines that count downEvery rights request and breach carries its legal clock and an owner.
- Scheduled reportsA monthly pack for leadership, sent automatically.
- Regulatory change digestPlain-language updates when the Board or the Ministry issues new guidance.
Illustrative screen with sample data.
Why teams choose ShieldDPC.
Built in India, for the DPDP Act, by people who audit security controls for a living.
Made by security auditors
ShieldByte is CERT-In empanelled. The controls in ShieldDPC are the ones our auditors test in the field, so your evidence holds up when someone checks it.
CERT-In empanelled auditing organisation
Every notice in your customer's language
Notices and consent screens in all 22 Eighth Schedule languages. Machine translation does the first draft and a person approves every version.
22 languages, human approved
Finds Indian personal data
A detector pack built for Indian identifiers: Aadhaar, PAN, UPI IDs, Indian mobile numbers, voter ID, passport and GSTIN, across files and databases.
India-specific PII detection
Withdrawal that actually stops processing
When consent is withdrawn, signed webhooks tell your CRM, marketing and processor systems, and each one's acknowledgement is stored as proof.
Consent Manager interoperable
AI that drafts, people who decide
Upload your old policies and notices. ShieldDPC checks them against the Act and the Rules and proposes changes. Nothing publishes without your approval.
Human approval on every document
Software and service in one
Run it yourself, or let ShieldByte's privacy team do the work inside your account. Switch between the two without changing platforms.
Self-managed or fully managed
| What you need | ShieldDPC | Spreadsheets and email | One-time consulting project |
|---|---|---|---|
| Consent record for every person and purpose | Tamper-evident ledger | Scattered across systems | Not in scope |
| Notices in Indian languages | 22 languages, approved | Manual translations | English template |
| 72-hour breach clock | Tracked with owners | Depends on memory | Playbook on paper |
| Rights requests to deadline | One queue with SLAs | Shared inbox | Not in scope |
| Evidence for the Board | One-click export | Rebuilt each time | Point-in-time report |
| Keeping up with new rules | Change digest and updates | Ad hoc | Ends with the project |
A compliance cycle, not a checklist.
Compliance stays current because ShieldDPC repeats the cycle and connects to the systems where personal data actually lives.
The continuous compliance cycle
Six stages that run all year, with every stage feeding the next.
Connected to your systems
Consent, requests and evidence move between ShieldDPC and the tools you already run.
How the work flows, step by step.
The three processes the Board is most likely to ask about, as ShieldDPC runs them.
What happens when a customer withdraws consent
The Act says withdrawing must be as easy as giving consent. Every step below leaves a record you can export for the Board.
How a data principal request is handled
Access, correction, erasure and nomination requests share one queue, one identity check and one clock.
How a personal data breach is reported
ShieldDPC starts the clock at detection and walks your team through each intimation the Rules require.
From sign-up to steady state in five phases.
Most teams have consent and notices live in weeks. The deeper work follows in a plan agreed with you.
Kick-off and scan
Website privacy scan, gap assessment against the Act and the Rules, owners named.
Gap report and plan
Discover and map
Personal data found across systems and mapped to purposes and lawful grounds.
Data inventory
Notices and consent live
Notices approved in your languages, consent capture connected to your website and app.
Consent ledger running
Rights and breach ready
Request queue, identity checks and breach playbooks set up and rehearsed.
Playbooks tested
Run and report
Retention schedules, audits, scheduled reports and the regulatory change digest.
Monthly compliance pack
Run it yourself, or let our team run it with you.
The same platform supports both. Switch models as your privacy team grows.
Self-managed
For organisations with an in-house DPO or privacy team.
- Your SPOC controls users, departments and module access
- Master documents with in-app editing, review and approval
- AI review of your existing policies and notices
- Dashboards and scheduled reports for leadership
ShieldByte managed service
Our privacy delivery team does the compliance work inside your account.
- Gap assessment, data mapping and notice drafting done for you
- Rights requests and breach response handled to deadline
- Your team reviews and approves every document
- One accountable delivery lead and monthly reporting
Who sees what
Four access levels keep each person to the data their role needs.
Built for sectors that hold the most personal data.
Templates, retention periods and notices come pre-set for your sector, so you start from something close to finished.
Banks, NBFCs and insurers
KYC records, sector retention rules and high volumes of rights requests.
Hospitals and healthtech
Sensitive health records, patient consent and strict access by department.
E-commerce and retail
Marketing consent at scale and three-year inactivity erasure for large platforms.
Education and edtech
Verifiable parental consent before processing any student under 18.
Employers and HR
Employee and candidate data, from hiring to exit, with clear retention.
SaaS and IT services
Processor contracts and proof of compliance for your own customers.
Built by a security firm that audits for a living.
ShieldDPC comes from Shieldbyte Infosec Pvt Ltd., a CERT-In empanelled cybersecurity company based in Mumbai. The controls in the product are the ones our auditors check for in the field.
CERT-In empanelledInformation security auditing organisation
Hosted in IndiaYour compliance data stays in the country
Every change loggedBefore-and-after audit trail on every record
Human approvalAI drafts, your team approves before anything publishes
Questions DPOs ask us
Do we need ShieldDPC if we are not a Significant Data Fiduciary?
Yes. Notice, consent, rights requests, breach reporting and retention apply to every Data Fiduciary. The DPIA and audit modules are there when you need them.
Can we bring our existing privacy policy and notices?
Upload them as they are. ShieldDPC checks them against the Act and the Rules, proposes amendments, and your team reviews and approves each change.
How are notices translated into Indian languages?
Notices are machine-translated into the 22 languages of the Eighth Schedule, then reviewed and approved by a person before they are published.
Will it connect to our CRM and marketing tools?
Yes. Consent changes are pushed to connected systems through signed webhooks and APIs, and each system's acknowledgement is recorded.
Does ShieldDPC work with registered Consent Managers?
Yes. Consent given or withdrawn through a Consent Manager flows into the same ledger, so your records stay complete whichever route a person uses.
Where is our data hosted?
In India. Access is limited by role, every change is logged, and ShieldByte delivery staff see only the accounts they are assigned to.
How long does onboarding take?
Most organisations are live with consent and notices within weeks. Data discovery and retention schedules follow in phases agreed with your team.
See your DPDP readiness in one session.
We will walk through your consent flows, notices and rights process, and show you where the gaps are before May 2027.