RBI · DPDP
NBFC & lending
A withdrawal that reaches every partner
A lending NBFC whose borrower data flows to co-lending partners and collection agents, with no way to confirm a withdrawal reached any of them.
Read the scenario → Resources
What a Promiz deployment looks like - and why.
Three illustrative scenarios from the sectors where DPDP bites hardest, plus research notes and blog posts on the duties behind them: proof, withdrawal, erasure, rights and breach.
Illustrative scenario - not a named customer. Built from how Promiz works, to show the shape of a deployment.
Three scenarios
From the first notice to the proof.
Each scenario names the modules that were switched on and the DPDP duties they cover. None quotes a customer, a number or a time saved.
IRDAI · DPDP
Insurance
Proof of notice for consent collected in person
An insurer whose agents collect health and family details face to face, with no record of the notice the customer actually saw.
Read the scenario → DPDP · children's data
Education & ed-tech
Verifiable guardian consent for learners under 18
An ed-tech platform where many learners are under 18, and the sign-up flow could not tell a guardian from a child.
Read the scenario → Research
Where DPDP compliance actually fails.
Short notes that map the Act's duties and penalties to the controls that satisfy them. Facts from the Act, the Rules and their Schedule; no vendor statistics.
DPDP Act · Rules 2025
Research · 6 min read
The five duties after the banner: where DPDP compliance actually fails
Collecting consent is the step every tool covers. The DPDP Act adds four more - prove it, act on withdrawals, erase on time, answer requests - and that is where the risk sits.
Read → Schedule · DPDP Act 2023
Research · 5 min read
DPDP penalties, mapped to the control that prevents each one
The Schedule to the DPDP Act sets penalties up to ₹250 crore. Each band points at a specific duty, and each duty has a specific control. A working map from fine to fix.
Read → Blog
Practical notes for the next 20 months.
What to do, in what order, before 13 May 2027.
Healthcare
Blog · 8 min read
How should hospitals handle patient data under the DPDP Act? Healthcare Series Part 1
A plain guide for hospitals, clinics, labs and health apps: the three reasons you can use patient data, one form with many switches, emergencies, children, and what to do when a patient says no.
Read → Key dates
Blog · 5 min read
13 May 2027: a working plan for Data Fiduciaries
The DPDP Rules were notified on 13 November 2025 and apply in full on 13 May 2027. What to have in place each quarter between now and then.
Read → Withdrawal · erasure
Blog · 4 min read
Stop processing vs erase: two duties teams keep confusing
"Stop using it" and "delete it" are different duties under the DPDP Act, with different triggers, deadlines and exceptions. Mixing them up erases data the law says you must keep.
Read →Bring one purpose. Leave with the proof.
A 30-minute session on your own use case.
- 5 min Find your DPDP gaps for that purpose
- 20 min Build the notice, collect consent, withdraw it, and close the task
- 5 min Download the receipt and verify the chain