Compliance

New hires get access on day one that nobody reviews by day thirty. The 30-day checklist, what Section 7(i) permits, and the fix that costs nothing.

The DPDP Act names startups once, in Section 17(3). It can lift five duties, needs a notification nobody has issued, and leaves consent and security intact.

DPDP enforcement in India starts with a grievance email, not a raid. What a rejected candidate’s request triggers, and the 90-day clock behind it.

The DPDP 72-hour clock starts the moment you become aware. What Rule 7 makes you file, and the CERT-In six-hour clock that runs before it.

A DPDP right to erasure request does not mean delete everything. What RBI KYC, PMLA and IRDAI rules force a BFSI firm to keep, and what to send back.

The IRDAI IT compliance checklist for endpoint protection: the 10 device controls an auditor asks insurers to prove, from inventory to secure disposal.

Your auditor is not going to ask whether you have a policy on file. They are going to ask for the evidence. Here is the ten-point readiness check we run before an audit date lands, and the one gap that catches nearly everyone.

Consent management under DPDP stops being a cookie banner in November 2026. A Pune D2C brand’s 6-week consent rebuild, what changed, and what it cost.

One security policy for office and remote staff, enforced from one console: how a Coimbatore NBFC closed its audit gap between office and field laptops.

An Avaya licence audit at a 1,200-seat Pune BPO found 300 named seats nobody had logged into in a year. Here is how the true-up meeting actually went.