XcellPrivacy|FaceOff Privacy in a Box

Every DPDP duty, run from one box on your premises.

FaceOff Privacy in a Box handles consent, cookies, rights requests, data discovery, masking, DPIAs, breach response, evidence and governance from one engine and one consent signal. It runs inside your network. XcellHost supplies, deploys and supports it in India.

  • 9 modules, one engine
  • Unified consent signal
  • Mapped to DPDP sections & Rules
  • Appliance on your premises
  • Personal data stays in your building
  • Optional XcellHost vDPO
See packages → DPDP readiness check WhatsApp
✦Ask AI about FaceOff Privacy in a BoxChatGPTClaudePerplexityGoogle AICopilot
Privacy in a Boxnine modules, one engine
01/05Nine modules light up
Illustrative
9 privacy modules DPDP Act 2023 & Rules 2025 On-premise appliance Box on quote · services in INR + GST XcellHost ISO 27001 · ISO 20000-1 Since 1999 · Mumbai
Why FaceOff Privacy

Collect, use and protect personal data responsibly. Inside your own walls.

FaceOff describes its platform as AI-powered privacy by design: it simplifies compliance and builds digital trust as risks change. This page covers the privacy box in depth. For deepfake and synthetic-fraud defence, see the Security page.

Most DPDP tools are cloud services. That suits many companies, but not a bank whose outsourcing policy keeps customer data in-house, a department that runs on a closed network, or a hospital that will not copy patient records to a third party. FaceOff Privacy in a Box puts the whole privacy programme on an appliance in your data centre: consent records, the data map, rights requests, DPIAs, breach cases and the audit trail.

The nine modules share one unified data and consent signal, which FaceOff calls the single source of truth. When a person withdraws consent, the cookie banner, the data map, the rights desk and the evidence log all see it. You stop reconciling spreadsheets between teams.

Who does what. FaceOff designs and builds the platform and appliance. XcellHost is a FaceOff partner* and handles supply, site survey, installation, connectors to your systems, monitoring from our 24×7 NOC in Mumbai and, if you want it, DPO support through our vDPO service. You keep the data.

  • Compliance by designPrivacy controls built into each workflow
  • User empowermentSelf-service choices people can trust
  • Operational efficiencyAutomated workflows, faster responses
  • Enterprise readyScalable, secure, connects to your systems
  • Trust & reputationVisible accountability to customers

Benefits as FaceOff states them. FaceOff positions the platform for DPDP, GDPR and CCPA/CPRA.

Sister applianceFaceOff Security in a BoxDeepfake, cloned voice and synthetic fraud defence, on your premises→ OverviewPrivacy & Security in a BoxBoth boxes side by side, with a box-fit tool and combined pricing→
The nine modules, one by one

What each module does, and which DPDP duty it serves.

The first column is FaceOff's description from its brochure. The second maps it to the DPDP Act, 2023 and the DPDP Rules, 2025. The third shows what the module reads from or writes to the shared signal.

01

Consent Management

Capture, track and honour consent

What it does

  • Captures valid consent for each purpose.
  • Gives people self-service control over their choices.
  • Makes consent the authoritative signal everywhere.

DPDP duty

  • §5 · Rule 3Itemised notice in clear language, in English or a scheduled language
  • §6Consent that is free, specific, informed and withdrawable as easily as given
  • §6(7)–(9) · Rule 4Consent Managers: registration and duties from 13 Nov 2026
  • §9 · Rule 10Verifiable consent of a parent or lawful guardian for children

On the signal

Writes consent state and purpose scope for every person.

XcellHost maps notices and purposes with your legal team, and confirms Consent Manager interoperability with FaceOff*.

02

Cookie Management

Trackers off until people say yes

What it does

  • Discovers and classifies cookies across web and apps.
  • Blocks them until consent is given.
  • Monitors continuously and alerts on drift.

DPDP duty

  • §6Non-essential tracking needs consent for a stated purpose
  • §6(4)Withdrawal must be as easy as giving consent
  • §9(3)No tracking, behavioural monitoring or targeted ads aimed at children

On the signal

Reads consent state for each visitor, so a banner choice and a CRM record never disagree.

XcellHost scans your public sites and apps during onboarding and reviews drift alerts monthly with the vDPO service.

03

DPAR Management

Data principal access requests, on time

What it does

  • Receives data principal requests.
  • Verifies identity securely.
  • Fulfils access, correction, erasure and grievance.
  • Closes within the statutory clock.

DPDP duty

  • §11Right to a summary of data processed and who it was shared with
  • §12Right to correction, completion, updating and erasure
  • §13Grievance redressal by the Data Fiduciary
  • §14 · Rule 14Nomination; published means to exercise rights; 90-day outer limit for grievances

On the signal

Reads the live data map to find every copy, then writes the closure to the evidence trail.

Try the DPAR SLA clock below. XcellHost sets your policy SLA and escalation rules at go-live.

04

Intelligent Data Mapper

Discover and map personal data

What it does

  • Scans and maps personal data across systems automatically.
  • Gives an identity-resolved view of where data lives.
  • Detects shadow and stale data.

DPDP duty

  • §5 · §11You cannot list purposes or answer access requests without knowing where data sits
  • §8(7) · Rule 8Erase data once the purpose is served or consent is withdrawn, unless law requires retention
  • §8(1)The Data Fiduciary stays accountable, including for processors

On the signal

Writes the live data map and lineage that every other module relies on.

XcellHost plans connector waves with your IT team; see deployment & integrations.

05

Data Anonymization & Masking

Minimise and redact what you do not need

What it does

  • Anonymises or masks personal data at scale.
  • Keeps data usable for analytics, testing and support.
  • Reduces exposure without breaking operations.

DPDP duty

  • §8(5)Reasonable security safeguards to prevent a personal data breach
  • Rule 6Safeguards include encryption, obfuscation, masking or virtual tokens
  • §6(1)Process only what is necessary for the specified purpose

On the signal

Reads the data map and purpose scope to decide what to mask, and for whom.

XcellHost sets masking for test, analytics and support copies first, where exposure is usually highest.

06

PIA / DPIA Assessment

Privacy impact assessments, built in

What it does

  • Identifies privacy risk at design time.
  • Assesses likelihood and impact.
  • Recommends controls and a residual risk rating.

DPDP duty

  • §10(2)(c) · Rule 13Significant Data Fiduciaries: DPIA and audit every 12 months
  • Rule 13SDFs also check that algorithmic software does not risk data principals' rights
  • §8(5)For everyone else, a DPIA is the clearest record of reasonable safeguards

On the signal

Writes the risk posture used by Governance and Evidence.

XcellHost's DPIA service (₹49,999 per system) can run the first assessments on the box with your owners.

07

Data Breach Management

Detect, report and respond fast

What it does

  • Detects and validates breach incidents.
  • Assesses impact and the data affected.
  • Notifies the regulator and individuals within timelines.
  • Tracks to closure.

DPDP duty

  • §8(6) · Rule 7Tell the Board and each affected person without delay
  • Rule 7Detailed report to the Board within 72 hours of becoming aware
  • CERT-InDirections of 28 Apr 2022: report specified incidents within 6 hours

On the signal

Reads the data map and lineage to scope who is affected, fast.

Run the breach clock below. XcellHost runs tabletop drills on both clocks.

08

Evidence Management

Audit-ready compliance records

What it does

  • Collects evidence automatically.
  • Keeps a tamper-proof audit trail.
  • Proves compliance at any depth, on demand.

DPDP duty

  • §8(1)Accountability for all processing, by you or on your behalf
  • Rule 6Keep logs that help detect and investigate unauthorised access
  • §10(2)(c) · Rule 13SDFs report significant audit observations to the Board

On the signal

Writes the evidence trail fed by every other module.

XcellHost exports evidence packs for auditors and the Board on request.

09

Privacy Governance

Policies, roles and oversight in one place

What it does

  • Defines policies, roles and KPIs.
  • Monitors programme health.
  • Drives continuous improvement and accountability.

DPDP duty

  • §8(9) · §8(10)Publish a contact for data questions; run grievance redressal
  • §10(2)(a)–(b)SDFs: a DPO based in India and an independent data auditor
  • §8(2)Processors only under a valid contract

On the signal

Reads risk posture and the evidence trail to show programme health.

Pair it with XcellLead vDPO for a named privacy lead.

Module names and "what it does" lines are FaceOff's. The brochure's box panel uses slightly different names for two modules (DSAR Management; Intelligent Data Reduction); FaceOff confirms the module line-up per box at scoping*. The DPDP mapping is XcellHost's orientation, not legal advice.

Unified data & consent signal

One event in. Nine modules in step.

The FaceOff-Privacy Engine returns three things to every module: consent state and purpose scope, the live data map and lineage, and the risk posture and evidence trail. Pick an event to see which modules act on it.

AI coreFaceOff-Privacy Enginesecure · unified · intelligent
Signal log
    Returned to every module Consent state & purpose scope Live data map & lineage Risk posture & evidence trail

    Illustrative flow drawn by XcellHost from FaceOff's description of the engine. Event names and sample details are examples.

    DPDP timeline

    The Rules are notified. Most duties start on 13 May 2027.

    The dates come from the Act, the Rules and official releases. Consent Manager duties began yesterday.

    Days to full commencement— days to 13 May 2027
    1. 11 Aug 2023DPDP Act, 2023 receives assent.
    2. 13 Nov 2025DPDP Rules, 2025 notified (PIB release 14 Nov 2025). Definitions and Data Protection Board provisions in force.
    3. 13 Nov 2026Consent Manager registration and duties apply, one year after notification.
    4. 13 May 2027Notice, consent, security, breach intimation, retention, rights, children's data and Significant Data Fiduciary duties apply.
    ₹250 crFailing to take reasonable security safeguards§8(5) · Module 05, 07
    ₹200 crNot notifying a breach, or breaching duties on children's data§8(6), §9 · Module 07, 01
    ₹150 crBreaching Significant Data Fiduciary duties§10 · Module 06, 09
    ₹50 crBreaching any other provision of the Act or Rules§5, §6, §8(7), §11–14 · Module 02, 03, 04

    Maximum penalty per instance under the Schedule to the Act; the Board weighs gravity, duration and mitigation. Orientation only, not legal advice1.

    Tool · DPDP readiness check

    Ten questions. A score and the modules to start with.

    Answer for your organisation today. Your score and module suggestions update as you go. Nothing leaves your browser.

    0of 100
    Not started

    Answer the questions to see where you stand.

    Start with these modules

      A self-check by XcellHost, not a legal assessment or audit.

      Tool · statutory clocks

      Watch a request close inside the clock.

      Pick a request type and your internal SLA, then step through the days. Switch to the breach clock to see the CERT-In and Board deadlines from the moment an incident is noticed.

      Day 0of 90 max
      OpenDPAR-0418 · AccessSLA due day 30 · legal ceiling day 90

        The 90-day ceiling is the Rules' outer limit for grievance redressal; set a shorter internal SLA for all requests. Breach duties: DPDP §8(6) and Rule 7; CERT-In Directions of 28 Apr 20222. Orientation, not legal advice.

        Tool · evaluation checklist

        How to evaluate a DPDP privacy platform.

        Use these capability rows to compare any platform, ours included. Mark what you must have, then download the list as questions for your RFP. FaceOff's coverage is shown only where FaceOff states it.

        Statedin FaceOff's product brochureSelf-assessedFaceOff's own evaluation sheet, Jul 2026PartialFaceOff self-assessed as partialAsk us*not stated, confirm in a demo
        0must-haves marked
        0stated by FaceOff
        0to confirm in a demo

        Rows are XcellHost's vendor-neutral checklist, grouped by DPDP area. "Self-assessed" is FaceOff's own rating, not an independent test.

        On-premise deployment & integrations

        Racked in your data centre. Connected to the systems that hold personal data.

        Choose a layout to see where the boxes sit. Final sizing follows a site survey.

        What it connects to

        The Data Mapper scans, and DPAR and Breach act on, the systems you connect. Typical sources for an Indian enterprise are below. FaceOff self-assesses REST API and webhook connectors; confirm specific products in a demo*.

        CRM & customer appscustomer records, consent touchpoints
        HRMS & payrollemployee and candidate data
        Core banking, billing, ERPtransactions and KYC
        Databases & data lakesstructured stores and warehouses
        File shares & documentsunstructured data*
        Email & collaborationchat and shared drives*
        Directory & SSOstaff sign-in and roles*
        SIEM & ticketingbreach signals and tasks*
        1. 01Scope

          Scoping call, FaceOff demo, list of systems and purposes.

        2. 02Site survey

          Rack, power, network zones and egress rules.

        3. 03Install

          Box racked, hardened and handed to your network team.

        4. 04Connect

          Connectors added in waves; first data map reviewed.

        5. 05Configure

          Notices, purposes, SLAs, breach runbook, roles.

        6. 06Operate

          24×7 NOC monitoring and optional vDPO.

        Packages · box on quote

        The same box. Three levels of help around it.

        Appliance pricing depends on modules, capacity and sites, so the box is always quoted. The XcellHost services in each package have list prices.

        Box + deployment
        On quote
        Price on quote · INR, excl. 18% GST
        • FaceOff Privacy in a Box
        • Nine privacy modules*
        • Site survey, install, connectors
        • 24×7 NOC monitoring of the box
        • Your team runs the programme
        Recommended
        Box + vDPO Programme
        On quote + ₹19,999/mo
        Box on quote · vDPO excl. 18% GST
        • Everything in Box + deployment
        • XcellLead vDPO · 8 h / month
        • DPDP readiness sprint ₹99,999*
        • DPIAs at ₹49,999 per system
        • Monthly evidence review
        Configure →
        Box + Designated DPO
        On quote + ₹39,999*/mo
        Box on quote · vDPO excl. 18% GST
        • Everything in vDPO Programme
        • XcellLead vDPO · 20 h / month
        • Annual DPIA and audit support for SDFs*
        • Breach tabletop drills ₹29,999*
        • Staff training ₹24,999* / session
        XcellHost servicePriceBasis · same as on
        Box supply, site survey, installation & integrationOn quoteper site · sized after survey
        XcellLead vDPO · Programme (8 h / month)₹19,999per month · vDPO page
        XcellLead vDPO · Designated (20 h / month)₹39,999*per month · vDPO page
        Extra vDPO hour₹4,999per hour · vDPO page
        DPDP readiness sprint₹99,999*one-time · data map, gap report, 90-day plan · vDPO page
        DPIA per system₹49,999per system · vDPO page
        Privacy training session (up to 50 staff)₹24,999*per session · vDPO page
        Breach tabletop drill (DPDP + CERT-In clocks)₹29,999*per drill · DPDP platform page

        INR, excl. 18% GST. Prices without * are list prices on the linked XcellHost pages; * marks prices those pages show as indicative, or labels to confirm with XcellHost. FaceOff appliances, licences and installation are quoted.

        Configure

        Add XcellHost services around your box.

        Pick DPO support, assessments and drills. The box itself is quoted and not added here.

        Your estimate · 12 months
        ₹0
        incl. 18% GST
        Prices marked * are indicative — confirm with XcellHost. The cart shows prices excl. GST; 18% GST is added at checkout.
        SECURITY & COMPLIANCE

        Security & Compliance — FaceOff Privacy in a Box

        On-Premise Records

        Keep the privacy platform and its records within your own infrastructure.

        Consent And Rights

        Coordinate consent, cookies and data principal requests through the supplied privacy modules.

        Evidence And Governance

        Use the assessment, breach and evidence modules to support your privacy programme.

        WHY XCELLHOST

        Why XcellHost For FaceOff Privacy in a Box

        Scope Your Programme

        Map the systems, purposes and privacy workflows you want the appliance to support.

        Deployment Support

        Plan appliance installation and connections to your existing systems.

        vDPO Support

        Select privacy support alongside the appliance where your organisation needs it.

        Readiness Review

        Use the readiness check to prioritise modules and follow-up work.

        Drills And Assessments

        Configure privacy assessments and response exercises around your deployment.

        One Point Of Contact

        Discuss appliance sizing, services and ongoing support with XcellHost.

        FAQ

        FaceOff Privacy in a Box, answered.

        It is FaceOff's AI-powered data privacy and compliance platform, delivered as an appliance that runs on your premises. Nine modules cover consent, cookies, data principal access requests, data mapping, anonymisation and masking, PIA/DPIA, breach, evidence and privacy governance, all on one unified data and consent signal.

        The software and the records run on hardware in your own data centre, so consent records, the data map and audit evidence never sit on a shared cloud. That suits banks, insurers, government departments and hospitals with strict outsourcing or localisation policies. If a cloud service suits you better, see our XcellPrivacy DPDP Compliance Platform.

        Notice (§5) and consent (§6) through Consent and Cookie Management; rights under §11 to §14 through DPAR Management; breach intimation under §8(6) and Rule 7 through Data Breach Management; retention and erasure under §8(7) with the Data Mapper; safeguards under §8(5) with masking; and Significant Data Fiduciary DPIAs and audits under §10 with the DPIA, Evidence and Governance modules.

        FaceOff's engine keeps one record of consent state and purpose scope, the live data map and lineage, and the risk posture and evidence trail, and returns it to every module. A withdrawal or an erasure reaches the cookie banner, the data map, the rights desk and the evidence log together.

        The DPDP Rules, 2025 set an outer limit of 90 days for grievance redressal, and you must publish how people can exercise their rights. Most organisations set a shorter internal SLA, such as 30 days. The DPAR module verifies identity, fulfils the request across mapped systems and records closure.

        Under §8(6) and Rule 7 you tell the Data Protection Board and each affected person without delay, then send the Board a detailed report within 72 hours of becoming aware. CERT-In's directions of 28 April 2022 separately require reportable cyber incidents within 6 hours. Data Breach Management tracks both.

        The Rules were notified on 13 Nov 2025. Consent Manager registration and duties apply from 13 Nov 2026. Notice, consent, security, breach, retention, rights, children's data and Significant Data Fiduciary duties apply from 13 May 2027.

        FaceOff builds the platform. XcellHost, as a FaceOff partner, supplies the box in India and handles site survey, installation, connectors, 24×7 NOC monitoring from Mumbai and optional DPO support through XcellLead vDPO. You buy, get support and get billed in INR through XcellHost.

        The box is priced on quote, based on modules, capacity and sites. XcellHost services have list prices: vDPO Programme ₹19,999 a month, extra vDPO hours ₹4,999 and DPIA ₹49,999 per system. Some services are indicative and marked with *. All prices exclude 18% GST.

        Call +91 22 6711 1555, WhatsApp +91 86570 32540 or e-mail [email protected]. We run a scoping call, arrange a FaceOff demo, survey your site and send an INR quote. Existing customers can reach [email protected].