Privacy by design · Custom software + DPDP
DPDP-Ready Software Development
Software that handles personal data the way India’s DPDP Act expects, designed in from the start instead of patched in before the May 2027 deadline.
Quick answer
What is DPDP-ready software?
DPDP-ready software is software designed to meet India’s Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 by default: it shows compliant notices, records and honours consent and withdrawal, lets people access, correct and erase their data, keeps access logs for at least a year, deletes data when its purpose ends and supports 72-hour breach reporting. Kaivan Tech builds custom software this way and can retrofit existing systems.
What’s included
DPDP-Ready Software Development: modules we build
Pick the modules you need. We build the highest-value one first and add the rest in stages.
Notices & consent capture
Rule 3 notices per collection point, unticked opt-ins per purpose, and versioned consent records.
Consent withdrawal
One-click withdrawal that stops dependent processing across the system and connected tools.
Rights-request portal
Access, correction, erasure and nomination requests with identity checks and a tracked workflow.
Grievance handling
A grievance inbox with deadlines so every complaint is answered well within 90 days (Rule 14).
Access logs & monitoring
Who accessed which personal data and when, retained for at least one year (Rule 6).
Retention & erasure jobs
Automatic deletion when a purpose is served, with advance notice where the Third Schedule applies (Rule 8).
Breach detection & runbook
Alerts, an incident log and templates for the individual notice and the 72-hour Board report (Rule 7).
Security by default
Encryption, masking, role-based access, backups and a processor register for every vendor.
Build or buy
Privacy by design vs retrofitting
| Factor | Custom | Off-the-shelf |
|---|---|---|
| Cost | Built in at design time | Rework across screens, data model and integrations |
| Consent records | Captured from day one with versions | Historic consents often missing or unprovable |
| Erasure | Data model designed for deletion | Personal data scattered across tables, exports and tools |
| Logging | Access logs part of the architecture | Added later, often incomplete |
| Deadline risk | Ready before 13 May 2027 | Competing for time with every other fix |
Choose custom when
- You are building a new CRM, portal, app or internal system that handles customer, patient, student or employee data
- Your existing software has no way to record consent, honour withdrawal or erase a person’s data
- You need a rights-request and grievance workflow connected to the systems that hold the data
- An audit found technical gaps that your current vendor cannot fix
Buy off-the-shelf when
- You only need a legal opinion or policy drafting: start with a lawyer or our DPDP assessment
- A SaaS tool you use already provides compliant consent and rights features you can configure
How we deliver
Built in stages, owned by you
- 1
Discovery
We map the current process, spreadsheets and tools, including the workarounds.
- 2
Scope & quote
Modules, roles, integrations and timeline agreed in writing before development.
- 3
First module live
The highest-pain module goes into real use first, often alongside the old process.
- 4
Expand & integrate
Further modules, reports and integrations added in stages.
- 5
Support
Maintenance, monitoring and improvements on a monthly retainer.
Who it’s for
Businesses we build this for
- Healthcare and clinics (patient data)
- Education (student and parent data, under-18s)
- Fintech, NBFCs and insurance distributors
- Ecommerce and D2C brands
- HR, staffing and recruitment platforms
Stack: React and Next.js, Node.js or Python, PostgreSQL or MySQL, hosted on AWS, Vercel or your own servers. You own the code and the repository from the first commit.
Common questions
DPDP-Ready Software Development FAQ
What is DPDP-ready software?+
Software designed to meet India’s DPDP Act and Rules by default: compliant notices, consent and withdrawal, rights requests, grievance handling, access logs, retention and erasure, and breach reporting support.
Can you make our existing software DPDP compliant?+
Often, yes. We start with an assessment of how personal data flows through the system, then implement the missing controls, such as consent records, withdrawal, rights workflows, logging and retention, in stages.
Does DPDP compliance make software more expensive?+
Designing for DPDP from the start adds some effort to the first build, but it is far cheaper than retrofitting consent, erasure and logging into a finished system.
Who is responsible for DPDP compliance, us or the software vendor?+
Your business, as the Data Fiduciary, remains responsible. The vendor usually acts as your Data Processor; the software should give you the controls to comply, and your contract should set out the vendor’s obligations.
When do these requirements apply?+
Most DPDP obligations, including notices, consent, security, breach reporting, rights and retention, apply from 13 May 2027.