DPDP & Privacy Operations
Breach deadlines, DPIAs, SDF classification, and audit packs — built for Data Fiduciaries.
What is the best tool for India's DPDP Act and CERT-In breach reporting?
A Data Fiduciary's control panel for the DPDP Act, 2023 and CERT-In Directions 2022: breach notification with statutory deadlines, DPIA lifecycle, SDF classification, vendor due diligence, and audit-ready evidence packs.
What this replaces
A personal-data breach under the DPDP Act means notifying the Data Protection Board without delay and filing a detailed report within 72 hours. If the incident is also a reportable cyber incident, the CERT-In Directions separately require a report within 6 hours. Two regulators, two clocks — deadlines that spreadsheet-based privacy programs discover mid-incident. Most global GRC tools treat Indian regulation as an afterthought.
What Offload does
A Data Fiduciary's control panel for the DPDP Act, 2023 and CERT-In Directions 2022: breach notification with statutory deadlines, DPIA lifecycle, SDF classification, vendor due diligence, and audit-ready evidence packs.
What you get
- Breach lifecycle per Rule 7: detect → declare → assess → report → close, with two independently tracked clocks — Data Protection Board (without delay, detailed report within 72 hours) and CERT-In (6 hours, where the incident is a reportable cyber incident) — and watchdog alarms
- Rule 7(2) nine-section report validation; CERT-In Annexure I across 18 incident categories
- DPIA lifecycle (draft → review → approve/expire) satisfying Section 13 obligations
- Significant Data Fiduciary classification with Section 10 obligations surfaced
- 18-question vendor/processor due-diligence assessments
- SCF-mapped readiness scoring with a penalty-exposure estimate per the Act's Schedule (Section-specific ceilings, not a blanket figure)
- Immutable audit-event log and generated audit packs; transfer impact analysis
How it works
The module is a pure domain core — state machines, validators, scoring — wrapped by services that persist state, emit audit events, and integrate the risk register. Every statutory workflow is deterministic and testable.
Every material action lands in an immutable audit log from which regulator- and board-ready packs are generated.
One platform, one risk view
DPDP readiness and breach posture feed the risk register and compliance dashboards; breach workflows raise central alerts; evidence joins the same reporting layer as the rest of the platform.
Ready to implement it?
Step-by-step guides in the product documentation — every connection is read-only, with copy-paste setup.
Solutions built on DPDP & Privacy Operations
Other modules on the platform
DPDP & Privacy Operations — frequently asked questions
What breach-notification deadlines does Offload Security track?
Two separate clocks. For a personal-data breach under the DPDP Act it tracks the Data Protection Board obligation — notify without delay, detailed report within 72 hours. Where the incident is also a reportable cyber incident under the CERT-In Directions, it separately tracks the 6-hour CERT-In deadline. Both run with watchdog alarms across a Rule 7 breach lifecycle (detect → declare → assess → report → close).
Does Offload support DPIAs and Significant Data Fiduciary obligations?
Yes — a DPIA lifecycle satisfying Section 13, Significant Data Fiduciary classification surfacing Section 10 obligations, and 18-question vendor/processor due-diligence assessments.
Can Offload run on-premises for Indian data residency?
Yes. It can be deployed fully on-premises so personal data never leaves your environment — a common requirement for Indian regulated organisations.