PrivaNex is a DPDP compliance software platform from ShieldByte Infosec. It runs your whole Digital Personal Data Protection programme in one connected record: consent management, privacy notices, data discovery, gap assessments, RoPA and DPIA, breach response, Data Principal rights and grievances, policies and audits. Every action leaves evidence a regulator can follow.

Who has to comply with the DPDP Act, 2023?

Any organisation (Data Fiduciary) that processes digital personal data in India, and organisations outside India that process personal data in connection with offering goods or services to people in India. Processors acting on a Data Fiduciary's behalf are bound through their contracts with it.

When do the DPDP Rules 2025 take effect?

The DPDP Rules were notified on 13 November 2025 with a phased start. Data Protection Board provisions applied immediately, Consent Manager registration opens after 12 months (November 2026), and most Data Fiduciary obligations, including notice, consent, security safeguards, breach intimation, retention, rights and children's data, apply from 13 May 2027.

What are the penalties under the DPDP Act?

The Schedule to the Act sets penalties of up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failing to notify the Board and affected Data Principals of a personal data breach, up to ₹200 crore for breaching obligations on children's data, up to ₹150 crore for breaching the additional obligations of a Significant Data Fiduciary, and up to ₹50 crore for other breaches.

How does PrivaNex handle consent management?

PrivaNex provides a consent ledger and API that capture and withdraw consent from your websites and apps. Each consent receipt records the purpose, the notice version and language, and a hash, in a signed, hash-chained ledger, so consent records can be verified later.

Does PrivaNex support privacy notices in Indian languages?

Yes. PrivaNex produces itemised privacy notices in English and the 22 languages in the Eighth Schedule to the Constitution, 23 languages in all. Each translation is approved by a person before it is published.

How does PrivaNex help with the 72-hour breach notification?

Breach response runs incident timers for intimating the Data Protection Board and the affected Data Principals. Under the Rules, the Board must be intimated without delay and given a detailed report within 72 hours of becoming aware of the breach, unless the Board allows longer.

Is PrivaNex suitable for Significant Data Fiduciaries?

Yes. Significant Data Fiduciaries must run a DPIA and an audit every year and appoint a Data Protection Officer based in India. PrivaNex keeps the DPIA, audit evidence and board reports in one place, and ShieldByte can carry out the independent audit.

Does PrivaNex use AI?

Yes, to draft. AI suggestions for things like notices and register entries are tracked as changes and need human approval before they are used.

Can ShieldByte implement the DPDP programme for us?

Yes. ShieldByte's privacy team delivers a gap assessment, data mapping, implementation, ongoing operation and monitoring, and an independent audit, all inside PrivaNex, so every finding, policy and approval stays in your record.

How do I get started with PrivaNex?

Take the free six-question DPDP readiness check on this page, or book a 30-minute demo. We walk through your industry, your departments and the modules that matter most, then share a readiness plan.

Privacy. Protection. Progress.

One platform for every DPDP duty.

PrivaNex runs your whole Digital Personal Data Protection programme in one connected record: consent, notices, rights, data mapping, assessments, breach response, policies and audits. Your team works in it, and every action leaves evidence a regulator can follow.

Book a 30-minute demo Check your readiness

Built on the DPDP Act 2023 and DPDP Rules 2025 From a CERT-In empanelled security firm Notices in 23 languages

aadhaar XXXX XXXX 4821 mobile +91 98•••• 0412 email r•••@mail.in health special class

Consent receipt RoPA entry DPIA screened

Consent receipt ● RECORDED

Ref: CR-261018-7Q4K
Purpose: Loan servicing
Notice: Hindi · v3
Hash: 9f2c…a41e

Why now

The Rules are notified. The clock is already running.

The DPDP Rules 2025 were notified in November 2025 with a phased start. Most organisations have until May 2027 to have every obligation working in practice, not only on paper.

Nov 2025Rules notified

Data Protection Board provisions take effect and the Board begins its work.

Nov 2026 · nowConsent Managers

Registration of Consent Managers opens. Your consent stack must be ready to work with them.

May 2027Full obligations

Notice, consent, security, breach intimation, retention, rights and children's data duties apply.

OngoingSDF duties

Significant Data Fiduciaries run an annual DPIA and audit and appoint a DPO based in India.

₹250 CrMAX. PENALTY PER INSTANCE

Failing to take reasonable security safeguards can attract a penalty of up to ₹250 crore under the Schedule to the Act. Failing to notify the Board and affected Data Principals of a breach can attract up to ₹200 crore. PrivaNex keeps the evidence that shows your safeguards were reasonable.

TIME LEFT TO MAY 2027

--days

--hrs

--min

--sec

Ready on day one

Pre-built content packs feed one connected core.

Question banks, policies, catalogues and registers drafted by privacy auditors and mapped to the Act and Rules, so your teams start with a working programme instead of a blank page.

Gap question banksBy industry, department and obligation area

Master policy libraryPolicies, SOPs, notices and agreements

Multilingual notices23 languages, approved by a person

PII cataloguePersonal and higher-risk data by category

Registers and retentionRoPA, DPIA, breach, rights and retention

Audit toolkitPlans, work papers, findings and reports

Faster startLaunch assessments the day you onboard.

Entered onceEvery answer updates every register.

Right questionsEach team sees only what applies to it.

Audit-readyEvidence collected as the work happens.

How ShieldByte delivers it

From first assessment to independent audit.

Our privacy services run inside PrivaNex, so every finding, policy and approval stays in your record after we finish.

Gap assessment

Department-wise review of where you stand today.

Gap report

Data mapping

Personal data, systems, sharing and transfers recorded.

RoPA and DPIA

Implementation

Policies, notices and consent integration contracts.

Approved policies

Operate and monitor

Rights requests, breach drills and board reporting kept on schedule.

Board report

Independent audit

Audits by ShieldByte auditors, with full evidence.

Audit report

What PrivaNex covers

The whole programme, not only consent.

Start with the modules you need most and switch on the rest as your programme grows.

SEC 6 · RULE 3

Consent ledger and API

Capture and withdraw consent from your apps, with records that can be verified.

SEC 5

Notices

Itemised notices in English and 22 Indian languages, approved by a person.

DISCOVER

Data discovery

Find and classify personal data across your systems.

ASSESS

Gap assessments

Questions by industry and department, each citing the Act and Rules.

MAP

RoPA, DPIA and risks

Registers built from assessment answers, ready for review.

SEC 8(6)

Breach response

Incident timers for notifying the Board and the people affected.

SEC 11–14

Rights and grievances

Every request with its own owner, clock and reply.

SEC 10

Audits and board reports

Independent audits, evidence packs and scheduled reporting.

Security by design

A privacy platform built by security auditors.

PrivaNex is built and run by ShieldByte Infosec, a CERT-In empanelled cybersecurity firm. We test other people's systems for a living, so we hold our own to the same standard.

AUTH

Two-step sign-in, your choice of methodE-mail code, authenticator app, passkeys or recovery codes, set per organisation.

DATA

Encrypted and tamper-evidentStrong password hashing, encrypted secrets and a signed, hash-chained consent ledger.

TRACE

Every action auditedBefore-and-after values, a reason for every action taken on your behalf, and separation of duties.

AI that drafts, people approveAI suggestions are tracked as changes and need human approval before use.

Readiness check

How ready are you for May 2027?

Six quick questions. Your answers stay in your browser.

Your readiness score

Answer the questions to see where you stand and which PrivaNex modules to start with.

FAQ

What compliance teams ask us first.

Act and Rule references are given for orientation and are not legal advice. Confirm obligations for your organisation with your counsel.