Executive summary
Most privacy programmes fail where the policy and the database disagree. This engagement establishes what personal data you actually hold, rebuilds consent and rights handling so they work in your systems, and leaves evidence a regulator or an enterprise buyer can verify. The exposure it addresses is a ₹250 crore DPDPA penalty ceiling and a stalled enterprise sales pipeline; the outcome is a programme that survives both.
Most privacy programmes fail in the same place: the policy says one thing and the database does another. A notice promises deletion in thirty days while three warehouses and a marketing tool keep silent copies. A consent banner records a choice that no downstream system reads.
DATATrust India closes that gap. We start from the systems, not the paperwork — tracing personal data through applications, integrations, analytics pipelines, vendors and backups until the map matches reality. Then we design the controls that keep it accurate as your product changes.
The result is a privacy programme that is enforceable in code: consent that propagates, rights requests that resolve inside statutory windows, retention that actually deletes, and evidence that a regulator or an enterprise buyer can verify without taking your word for it.
Why privacy programmes stall
Each capability below is a discrete workstream with its own owner, deliverables and definition of done.
System-by-system inventory of personal and sensitive data, including shadow copies in analytics, logs, test environments and third-party tools — delivered as a living record of processing activities, not a one-off PDF.
A consent model that is granular, versioned, withdrawable and machine-readable, wired into the systems that consume it so a withdrawal actually stops processing downstream.
Intake, identity verification, fulfilment and audit trail for access, correction, erasure, nomination and grievance requests — designed to close well inside DPDPA and GDPR deadlines.
Lightweight privacy review gates inside your existing delivery process, with threshold assessments, DPIA templates and engineering guardrails developers will actually use.
Transfer mapping, adequacy analysis, contractual safeguards and localisation design for organisations moving data between India, the EU, the US and the Gulf.
Personal data breach playbooks calibrated to DPDPA, CERT-In and GDPR clocks — with the decision tree, the templates and the rehearsal that make the first six hours survivable.
Each benefit is stated with the commercial consequence attached, because a capability without a consequence is a feature list.
Your team answers buyer questionnaires from an evidenced position rather than from memory, with a maintained answer library and a published sub-processor list.
A published sub-processor list and a maintained answer library, so no diligence round starts from a blank page.
Federated search and fulfilment across every system holding personal data, instrumented with SLA tracking rather than run over email.
Fulfilment tracked against the statutory window with automatic escalation, not run over email until someone remembers.
Consent published as a versioned event stream that every downstream system consumes, with continuous reconciliation proving it.
Closes the single most common privacy audit failure before it is found for you.
Retention logic enforced in systems rather than described in a spreadsheet, including analytics copies, backups and processor-held data.
Reduces breach blast radius and the volume of data in scope for every future assessment.
Phases overlap deliberately — design begins before assessment closes, so the programme does not stall waiting for a document to be signed off.
Weeks 1–3
Structured interviews with product, engineering, marketing and HR, plus tooling-assisted scanning, to establish where personal data enters, rests and leaves the organisation.
Weeks 3–5
Gap analysis against DPDPA, GDPR and ISO 27701, scored by likelihood and business impact so remediation is sequenced by risk rather than by chapter number.
Weeks 5–9
Target-state privacy architecture — consent model, rights workflow, retention logic, vendor controls — specified tightly enough for your engineers to build from.
Weeks 9–20
Hands-on delivery alongside your teams: policy set, technical controls, training, and the evidence pipeline that proves the controls are operating.
Ongoing
Quarterly assurance reviews, regulatory horizon scanning, and metrics that tell your board whether privacy risk is going up or down.
Named artefacts, listed in the statement of work. If it is not on this list, we will tell you before you sign rather than after.
Sector constraints change the delivery approach more than they change the obligations. These are the sectors this methodology is built around.
Fixed fee for defined scopes, retainer for ongoing services. We do not price advisory work on time and materials, because that misaligns our incentive with your outcome.
2 weeks
Boards and CISOs who need a defensible current-state read before committing budget
Commercial basis: Fixed fee
16–24 weeks
Organisations committing to a full DPDPA or GDPR readiness position
Commercial basis: Fixed fee, milestone-based
Rolling, 12-month minimum
Teams that want the programme run rather than handed over
Commercial basis: Monthly retainer
Every proposal states what is included, what is not, and what would trigger a change request. If the scope we recommend is smaller than the one you asked for, we will say so.
One implementation, cross-mapped. Each framework below links to its own obligations and control domains.
Specific answers about scope, timeline and what we will and will not do.
Ask a practitioner directly. First responses come from the person who would run your engagement, within one business day.
Ask a questionDefensible security, built around how your business actually loses money.
Threat-led security strategy, architecture and control design that prioritises the handful of scenarios that would genuinely hurt you — not a generic checklist of 300 controls.
Explore capabilityOne operating model for privacy, security, risk and AI accountability.
We design the committees, policies, decision rights and reporting lines that let trust obligations be managed as one programme instead of four competing ones.
Explore capabilityCertification without the eighteen-month scramble.
Readiness, implementation and audit support for ISO 27001, ISO 27701, ISO 42001, SOC 2 and PCI DSS — run as a project with dates, owners and a definition of done.
Explore capabilityCombining capabilities reduces cost — the second framework typically lands at about half the price of the first.
