Prompt to an AI chatbot
Draft a reply to Priya, Aadhaar 2345 6789 0123, email [email protected]
0 redactions todaysent clean
XcellPrivacy|DPDP Compliance Platform
DPDP compliance you can prove, not just claim.
XcellPrivacy finds personal data across your apps and clouds, captures consent in the languages your customers read, runs rights requests and breaches against the legal clocks, and links every step to a sealed piece of evidence.
Consent & notices · §5–§6
Rights & grievances · §11–§14
Records of processing
DPIA & vendor risk
PII discovery & redaction
72-hour breach response
XcellPrivacy · consent capturesample data
01Consent captured, in her language
§4–§17*Obligations mapped
22+ENEighth Schedule languages
72hBoard breach report
6hCERT-In reporting
14Modules, one platform
ISO 27001 · ISO 20000-1 Microsoft Gold Partner Hosted in Mumbai 24×7 NOC & SOC Since 1999
Why now
The DPDP Act is law. The core duties start on 13 May 2027.
The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 apply to any business that handles the digital personal data of people in India. You need a notice people can read, consent you can show, a way to answer rights requests, security safeguards, and a plan to report a breach within hours. XcellPrivacy keeps all of that in one place, with evidence attached.
- Notice and consent in English or any Eighth Schedule language the person chooses (§5(3)).
- Rights requests answered within the period the Rules set: at most 90 days for grievances.
- Breach intimation to the Board and each affected person; detailed report to the Board within 72 hours.
- Penalties up to ₹250 crore per instance for failing to take reasonable security safeguards.
Commencement timeline— days to 13 May 2027
- 11 Aug 2023DPDP Act, 2023 enacted.
- 13 Nov 2025DPDP Rules notified. Definitions and Data Protection Board provisions in force.
- 13 Nov 2026Consent Manager registration and duties apply (one year after notification).
- 13 May 2027Notice, consent, security, breach, retention, rights, children's data and SDF duties apply (18 months).
Dates from the Rules as notified and PIB releases of 14 Nov and 3 Dec 2025; checked November 2026.
Evidence graph
Every finding is linked to the proof that closes it.
Most compliance tools keep a checklist. XcellPrivacy keeps a graph: findings, source systems, records of processing, rights cases, erasures and proofs, joined by edges that say how sure we are. Click a node to see why it is there.
Live telemetry · sample
Four things the platform does while you are busy.
Figures below are sample data, animated to show how each feed behaves.
sealed
sha256 · —EN + 22SLA target 30 days*1 overdue
inherent 16 → residual 6likelihood × severity
14 modules · one platform
Five modules for the Act. Nine for the security behind it.
The core five cover what the DPDP Act asks of a Data Fiduciary. The extended nine find the data and close the security gaps that cause breaches. Switch modules on as you need them.
Consent & NoticeItemised notices, purpose-level consent, withdrawal as easy as giving it.§5 · §6 · Rule 3
Records of ProcessingEach activity with purpose, legal ground, data, retention and processors.§5 · §8(1) · §11
DPIALikelihood × severity, inherent and residual, with owners and review dates.§10(2)(c) · Rule 13
Rights & DSRAccess, correction, erasure, grievance and nomination with SLA clocks.§11–§14 · Rule 14
Breach ResponseRunbook, notices to people, and Board and CERT-In reports on time.§8(6) · Rule 7
Data DiscoveryScanners for Aadhaar, PAN, health and financial data in apps, stores and endpoints.§8(5)
CSPMCloud misconfigurations on AWS, Azure and GCP that expose personal data.§8(5)
KSPMKubernetes posture, including secrets that hold personal data.§8(5)
CIEMOver-privileged identities that can read personal data.§8(4)
Attack SurfaceInternet-facing assets and exposed endpoints, found before attackers do.§8(5)
AI-SPMA guardrail on outbound LLM traffic and a register of AI models in use.§8(4)
Vendor Risk (TPRM)Processor contracts, DPA status, assessments and shadow vendors.§8(1) · §8(2)
Bill of MaterialsSBOM, AIBOM, CBOM and HBOM with vulnerability and VEX status.§8(4)
Agentic RemediationMCP tools that draft fixes, schema changes and processor notices for approval.§8(1)
Section references show the duty each module supports. Using a module is evidence of effort, not a legal finding of compliance.
Connectors
Connect a system once. Get discovery, a vendor record and erasure.
Hundreds of SaaS, database and cloud connectors* are planned or available. Each new connection creates a vendor entry with a DPA stub, and, where the system's API allows, runs access and erasure requests with a sealed purge proof.
48 shown
* A sample of 48 connectors is shown. Availability, depth (discovery only, or access and erasure too) and the total count are confirmed at scoping. Product names and trademarks belong to their owners and are used only to describe compatibility; no endorsement or partnership is implied. Tally* support is planned through a local agent.
Extended posture · xSPM
Most breaches start as a security gap. Six tiers to close them.
The DPDP Act makes you answer for reasonable security safeguards (§8(5)). These tiers find where personal data sits, who can reach it and what is exposed.
Sandbox · runs in your browser
Eight tools to try. Nothing leaves this page.
Each tab is a working slice of the platform with sample data. The masking playground and consent builder process what you type locally; nothing is uploaded.
—sample
sample inventory · VEX status
| Component | Type | Where | Finding | VEX |
|---|
Language
Position
Accent
Purposes shown
Notice fingerprint
—SHA-256 of the exact text shown, logged with each consent.Sample translations for illustration; production notices are checked by a native-language reviewer.
sample queue · policy SLA 30 days* · legal ceiling 90 days
Select a request to see where it is routed.
Click a cell to set inherent risk · severity → / likelihood ↑
Controls in place
Inherent16
→Residual—
—
Masked output
Pattern matching only: Aadhaar (12 digits, with a Verhoeff checksum test), PAN, email, Indian mobile and IFSC. Production scanners add context rules and confidence scores.
T+00:00since awareness
1 second = 1 hour
CERT-In's 6-hour reporting comes from its directions of 28 April 2022. Board and individual intimation come from §8(6) of the Act and Rule 7. Not legal advice.
Tool · DPDP readiness
Five sliders. A score and your top gaps.
Be honest; nothing is sent anywhere. The score is an illustration to start a conversation, not an audit.
By industry
Same Act, different pressure points. Pick your sector.
KYC data everywhere, and an RBI audit on top.
Aadhaar and PAN copies sit in onboarding databases, S3 logs, ledgers and email. We find them, tokenise or mask what you do not need, log KYC consent with multilingual notices, and keep the evidence your auditors and the Board will ask for.
BFSI Cloud →- Aadhaar and PAN discovery across databases, buckets and mailboxes
- Masking and tokenisation guidance per system
- Region checks for data that must stay in India under sector rules
- AI model register aligned to RBI's FREE-AI framework (Aug 2025)
Millions of customers, many apps, one consent record.
Large e-commerce platforms face a three-year inactivity erasure rule with 48 hours' notice. We link storefront, payments, CRM, marketing and logistics so a withdrawal or erasure reaches every system, with proof.
Retail Cloud →- Purpose-level consent for marketing, separate from order delivery
- Withdrawal synced to marketing tools within your SLA
- Inactivity tracker for the Rule 8 erasure classes
- Processor contracts for couriers, payment and messaging partners
Health data is sensitive, and so are the people asking about it.
Patient records, lab results and prescriptions spread across HIS, LIMS, apps and partners. We map them, run DPIAs before new systems go live and handle access and correction requests without exposing other patients.
Healthcare Cloud → Pharma Cloud →- Health and medical data patterns in discovery
- DPIA before a new app, lab system or AI tool goes live
- Identity checks on access requests
- Breach drills that include patient notices in plain language
You are a processor for your customers and a fiduciary for your own staff.
B2B SaaS companies need two views: the data you process on contract, and the data you decide on. We keep both, answer customer security questionnaires from the evidence graph, and keep your sub-processor list current.
Managed GRC →- Separate processor and fiduciary records
- Sub-processor register and change notices
- SBOM and AIBOM for your own product
- Evidence exports for customer due diligence
Most of your data subjects are children.
Under §9, processing a child's data needs verifiable consent from a parent or lawful guardian, and tracking, behavioural monitoring and targeted advertising aimed at children are not allowed. Rule 10 sets how that consent is verified, with exemptions for certain educational purposes.
Higher Education Cloud →- Guardian consent flow with verification records
- Checks for trackers and ad tags on student-facing pages
- Records for admissions, exams, transport and hostel data
- Staff training on what counts as a child's data
Compared
Point tools plus spreadsheets, or one evidence trail.
| What you need | Point tools + spreadsheets | XcellPrivacy |
|---|---|---|
| Obligation coverage | A cookie banner here, a ticket queue there | Notice to breach in one record, mapped to sections |
| Finding personal data | Annual self-declaration by each team | Scanners on SaaS, databases, storage and endpoints |
| Bill of materials | Software only, if at all | Software, AI, crypto and hardware in one view |
| Vendor risk | Questionnaire once a year | DPA status tracked, shadow vendors flagged |
| Evidence | Screenshots in shared folders | Graph-linked records with hash seals |
| Fixing gaps | Manual tickets | Agent-drafted fixes, approved by a person |
| Data handling | Payloads copied into a vendor's cloud | Metadata-first scans; hosted in Mumbai, your VPC or on-prem |
| Built for | GDPR templates relabelled | DPDP sections, Rules, Indian languages and IDs |
How it works
Four stages, each feeding the next.
- 01Ingest assets & BOM
Connectors and scanners list systems, data stores, software and AI models, with the personal data each holds.
- 02Draft records of processing
Columns and fields are matched to purposes and legal grounds. Drafts are labelled as inferred until a person confirms them.
- 03Trigger DPIAs
A new connector, column or AI model opens a DPIA task before data starts to flow.
- 04Route rights & incidents
Requests and breaches follow the records to every system, with SLA clocks and a sealed proof at the end.
Your readiness score blends documented evidence with live signals from scanners and connectors, so it moves when reality does.
16-point DPDP matrix
Each control, and the section it answers.
Section numbers checked against the DPDP Act, 2023 and the DPDP Rules, 2025. "Records of processing" is not a term in the Act; we use it as the working record behind §5 notices, §8 duties and §11 access summaries.
Deployment
Run it where your data rules say it should run.
XcellHost private cloudSingle-tenant in our Tier IV Mumbai data centre, run by our 24×7 NOC and SOC.Default
Your cloud VPCDeployed in your AWS, Azure or GCP account in an Indian region. No data leaves your tenancy.
On-premisesFor regulated estates that keep everything in-house. We support the install and updates.
Multi-tenant for partnersIsolated client workspaces with role-based access for consultants and MSSPs.
Plans
Start with the core five. Add posture when you are ready.
Platform prices are new and indicative. vDPO uses the same price as our vDPO page.
Starter
For SMEs and startups getting to a defensible baseline.
₹14,999*/month
Indicative · excl. 18% GST
- Consent & notice · 1 domain, EN + 22 languages
- Records of processing · up to 25 activities
- Rights & grievance portal with SLA clocks
- Breach runbook and 72-h clock
- 5 connectors
Recommended start
Business
All five core modules plus discovery and vendor risk.
₹49,999*/month
Indicative · excl. 18% GST
- Everything in Starter · 3 domains
- DPIA module with risk grid
- PII discovery · 25 connectors
- Vendor risk & DPA tracking
- Evidence graph with sealed exports
Enterprise
All 14 modules, SDF duties and your choice of deployment.
On quote
Sized to systems, users and deployment
- All 14 modules incl. CSPM, AI-SPM, BOM
- SDF pack: annual DPIA and audit support
- Agentic remediation via MCP
- Private cloud, your VPC or on-prem
- Named success manager
* Indicative — confirm with XcellHost. INR, excluding 18% GST, billed monthly. Legal opinions, third-party audits and connector work beyond the standard catalogue are not included.
Configure
Build your XcellPrivacy subscription. See the rupee total.
Fixed-price items go to the cart. Enterprise and the DPO Genie365 platform come with a quotation.
1 · Plan
6 · People to run it
Your estimate · indicative
XcellPrivacy Business
Monthly₹0
One-time₹0
Subtotal · first invoice₹0
GST (18%)₹0
Total incl. GST₹0
Quoted items are added to your quotation request.
FAQ
Questions we hear every week.
The DPDP Act, 2023 applies to anyone processing digital personal data in India, and to processing outside India linked to offering goods or services to people in India. From 13 May 2027 you must give clear notices, hold valid consent or another lawful ground, protect the data, answer rights requests and report breaches. Customers, investors and enterprise buyers are already asking for proof.
A lawyer interprets the law and drafts your notices and contracts; you still need them. Software does the daily work a lawyer cannot: finding personal data in 40 systems, logging every consent, running erasures, and timing a breach response. XcellPrivacy produces the evidence your counsel needs. It is not legal advice.
It finds where personal data lives, shows customers a notice in their language and records what they agree to, lets them ask for their data or its deletion and tracks the deadline, and helps you report a breach on time. Each step leaves a sealed record you can show.
A Starter workspace with consent, a rights portal and a breach runbook can be live within about two weeks*. Discovery across many systems and a full set of records of processing take longer, depending on how quickly access is granted. We give you a dated plan after the scoping call.
The Data Protection Board can impose penalties per instance under the Schedule to the Act: up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for not notifying a breach or for breaching duties on children's data, up to ₹150 crore for Significant Data Fiduciary duties, and up to ₹50 crore for other breaches. The Board weighs gravity, duration and mitigation when setting the amount.
No. The DPDP Act covers digital personal data only, has fewer lawful grounds than GDPR (consent and listed legitimate uses), treats everyone under 18 as a child, gives a right to nominate, sets India-specific breach timelines and lets notices be read in 22 Indian languages. A GDPR programme is a good start, but it needs re-mapping.
Yes, there is no size threshold in the Act. Section 17(3) lets the Government notify certain Data Fiduciaries, including startups, as exempt from some duties (notice under §5, §8(3), §8(7), §10 and §11). Check whether any such notification covers you before relying on it; we assume no exemption by default. Starter is sized for small teams.
Probably not. A cookie banner rarely gives an itemised notice of the personal data and purposes, a choice per purpose, an easy way to withdraw, a language choice or a record you can produce later. It also does nothing for rights requests, security or breach reporting.
By default in a single-tenant workspace in XcellHost's Tier IV data centre in Mumbai. You can also run it in your own cloud account in an Indian region or on-premises. Scanners work on metadata and samples where possible, so raw payloads do not need to be copied out of your systems.
Under §8(6) and Rule 7, you must tell each affected person and the Data Protection Board without delay, then send the Board a detailed report within 72 hours of becoming aware (the Board can extend this on request). Separately, CERT-In's directions of 28 April 2022 require reportable cyber incidents to be reported within 6 hours. Our clock tracks both.
Yes. Under the Act a child is anyone under 18. §9 needs verifiable consent from a parent or lawful guardian and bans tracking, behavioural monitoring and targeted ads aimed at children, with exemptions set in the Rules. XcellPrivacy records the guardian verification and flags trackers on child-facing pages.
Indicatively ₹14,999* a month for Starter and ₹49,999* a month for Business; Enterprise is quoted. A vDPO Programme adds ₹19,999 a month, the same as on our vDPO page. All prices exclude 18% GST. Use the configurator above for a total.