DPDP-ready in 14 days.
Global-ready by design.
A fixed-scope, engineering-led program for Indian startups: map your data, fix your consent and notice flows, stand up rights handling and breach response, then prove it with an evidence pack and a verifiable badge.
Readiness, not a rubber stamp
The outcome is a dated, scoped verification. We never call it "certified", and the badge page says what was and was not assessed.
We never read your data
Read-only access, schema-only classification, credentials revoked on Day 14.
Built on the platform you already use
Consent capture, end-to-end encrypted storage and the respondent flow come from VerifID Forms, so seamless is the default.
The 14-day plan
Each day has founder inputs, automated checks and output files you keep. Tap a day to see them.
Discover
Days 1–3Scope the laws that apply and map every form, tracker and data flow.
Day 1 Kickoff, scoping, access
- You provide
- Intake questionnaire, domain and app list, read-only access, a named Grievance Officer candidate.
- We run
- Applicability matrix (DPDP always; GDPR and CCPA when they apply); read-only access check.
- You keep
- Scope and applicability memo, access register, program plan.
Day 2 Asset discovery and crawl
- You provide
- Product walkthrough of every screen that collects data; list of third-party tools.
- We run
- Headless crawl of forms and consent controls, tracker capture before and after consent, SDK inventory, repo secret and PII scan.
- You keep
- Form inventory, tracker report, SDK inventory.
Day 3 Data inventory and classification
- You provide
- Data-flow worksheet per system; schema exports (no data).
- We run
- Schema-only column classification (no row data is read), cloud region map, data-flow graph.
- You keep
- Record of processing activities, data-flow diagram, sensitive-data register.
Design
Days 4–7Decide the legal basis per purpose, ship the notice and consent flow, stand up rights handling.
Day 4 Purposes, lawful basis, consent gaps
- You provide
- 90-minute session with the legal reviewer: consent (s.6) or legitimate use (s.7), per purpose.
- We run
- Per-form consent-gap check: pre-ticked boxes, bundled consent, missing notice, trackers firing before consent.
- You keep
- Purpose register, consent gap report, minimization recommendations.
Day 5 Notice and consent implementation
- You provide
- Integrate the consent flow in staging; approve translated notice text.
- We run
- Consent flow verification, accessibility (WCAG 2.2 AA) and translation lint.
- You keep
- Integration patch, notice text in English, Hindi and your regional languages, verification report.
Day 6 Data Principal rights and grievance
- You provide
- Name the Grievance Officer; choose identity verification and response SLAs.
- We run
- Synthetic access, correction, erasure, withdrawal and grievance requests end to end.
- You keep
- Rights-request runbook, Grievance Officer appointment, test results.
Day 7 Week-1 checkpoint
- You provide
- 60-minute review; sign off the residual-risk register.
- We run
- Re-crawl and diff against Day 2; score against the audit checklist.
- You keep
- Week-1 scorecard and gap register.
Harden
Days 8–11Close the security, vendor, retention and breach-response gaps.
Day 8 Security safeguards
- You provide
- MFA, least-privilege IAM, encryption at rest and in transit, log retention of at least a year.
- We run
- Cloud posture, web headers, dependency CVEs, IAM review.
- You keep
- Posture report, remediation tickets, SOC 2 control mapping.
Day 9 Vendors and cross-border transfers
- You provide
- Vendor list with DPA status and processing regions.
- We run
- Vendor risk checks and transfer mapping against the current restricted-country list and GDPR transfer mechanisms.
- You keep
- Vendor register, transfer notes, pre-filled DPA requests.
Day 10 Retention and erasure
- You provide
- Approve the retention schedule; schedule deletion jobs.
- We run
- Retention-age check (counts only), synthetic erasure across systems, log PII scan.
- You keep
- Retention schedule, erasure test report, deletion job templates.
Day 11 Breach response and tabletop
- You provide
- Name the Incident Commander; join a 90-minute tabletop.
- We run
- Statutory-clock simulation (Board, individuals, GDPR, CERT-In), alert-path test.
- You keep
- Incident response plan, notification templates, after-action report.
Prove
Days 12–14Triage special cases, assemble evidence and decide on the badge.
Day 12 Special categories and global overlay
- You provide
- Confirm children’s data handling, user volumes for Significant Data Fiduciary triage, EU and California applicability.
- We run
- Global Privacy Control test, age-gate test, GDPR overlay checks.
- You keep
- SDF triage memo, DPIA where triggered, GDPR and CCPA overlay report.
Day 13 Evidence pack and re-verification
- You provide
- Close remaining High and Critical gaps; staff privacy training.
- We run
- Full re-scan; evidence bundle with SHA-256 manifest and signature.
- You keep
- Signed evidence pack, final scorecard, accepted-risk record.
Day 14 Review, badge decision, handover
- You provide
- Closing review; sign the management representation letter.
- We run
- Badge eligibility evaluation; credential revocation; monitoring enrolment.
- You keep
- Readiness certificate (dated and scoped), badge embed, 90-day roadmap.
Three tiers
Fixed scope per tier. Pricing is confirmed on enquiry while we run early-access cohorts.
Starter
Pre-seed and seed teams with India-only users.
Covers: DPDP
- Up to 5 forms and 2 domains
- Consent flow on web
- Email-based rights-request runbook
- Notice, policy pack, Grievance Officer appointment
- One 60-minute legal review
Badge: DPDP Ready
Support: Email, two business days
Growth
B2B SaaS selling to US, EU and Indian enterprise buyers.
Covers: DPDP, GDPR and CCPA overlay, SOC 2 readiness
- Up to 25 forms and 5 domains
- Web and mobile consent flow
- Hosted rights-request portal
- Data processing agreement with SCC annex; vendor DPA requests
- Up to 20 engineering hours of hands-on remediation
Badge: DPDP + Global Ready
Support: Shared Slack channel, one business day
Enterprise
Lending, payments, wealth, insurance and health teams handling sensitive data.
Covers: DPDP, GDPR and CCPA, SOC 2 readiness, RBI, SEBI and IRDAI mapping, CERT-In
- Scope agreed after a paid discovery
- Custom connectors and self-hosted rights portal
- DPIA, Significant Data Fiduciary memo, regulator mapping
- Support negotiating customer DPAs
- Executive tabletop and pen-test coordination
Badge: Verified Compliant: Enterprise Assurance
Support: Named lead; 90-day retainer included
Explore the program
Audit checklist
79 controls across DPDP, GDPR, CCPA and SOC 2, filterable by area, severity and how each is verified.
Open →Consent and rights toolkit
How the consent flow, consent record and rights-request handling fit together with VerifID Forms.
Open →Readiness badge
The twelve criteria, how the verification page works, and how recertification runs.
Open →Frequently asked questions
Will this make my startup DPDP compliant in 14 days? ▾
It gets the controls in place and evidenced, and an independent review confirms them as of a date. No program can certify compliance: the Data Protection Board enforces the law, and no regulator issues a compliance seal. The outcome is a dated, scoped readiness verification.
Is this a SOC 2 report? ▾
No. A SOC 2 report comes from an independent auditor, and a Type II report needs a 3 to 12 month observation window. The program gets you to audit-readiness: policies, evidence and monitoring in place, mapped to the SOC 2 criteria.
Do you see our users’ data? ▾
No. Scans are read-only and classify database schemas by column name, never rows. Credentials are scoped read-only, checked on Day 1 and revoked on Day 14.
When do the DPDP obligations actually apply? ▾
The DPDP Rules 2025 phase obligations in over about 18 months from notification. The program is pre-enforcement readiness, and we re-check commencement dates at the start of every cohort.
Do I need to use VerifID Forms to join? ▾
No. The program works on any stack. If you collect data through VerifID Forms, much of the consent, encryption and rights-handling work is already done by the platform, so the 14 days go faster.
Start collecting data the right way today
Even before a cohort, a VerifID Forms form gives you per-purpose consent and end-to-end encryption on day one.