KlaritiQKlaritiQ
Sign inGet my free audit readiness assessment
Legal and compliance

DPDP/DPDPA duties and evidence for legal and compliance teams.

KlaritiQ shows the DPDP/DPDPA duties that may apply to your organisation, who owns each one, how sure we are, and the proof to keep, so an audit question already has its evidence attached.

Get my free audit readiness assessment
No legal jargon · no commitment · every answer backed by evidence
Where the rules bite
A breach notice
The DPDP/DPDPA Rules expect notice to the Data Protection Board and to the people affected. KlaritiQ shows what the notice involves and who has to sign it off.
A request from a person
People can ask about their data and raise grievances, and the Rules cap how long a response may take. You see the limit at the step where the request lands.
Erasure and retention
Retention periods and erasure notices reach into vendors and systems you do not control day to day. You see each one with an owner and a proof requirement.
A vendor that handles your data
The responsibility stays with you. KlaritiQ shows what to ask for and what to file when a new processor comes in.
The problem

What usually goes wrong.

The duties live in different documents

Rules, directions and circulars all say something about the same process, and no one place says what is settled.

Ownership is assumed, not recorded

Everyone thinks someone else holds the proof, until an auditor asks.

Evidence is scattered

The notice, the approval and the log sit in email, drives and chat.

How it works

Your process, step by step.

  1. 1
    Map the duties

    KlaritiQ shows the DPDP/DPDPA duties that may apply to your organisation, each with a certainty label.

  2. 2
    Assign an owner

    Each duty gets a named person, so nothing sits with "legal" in general.

  3. 3
    Collect the proof

    Documents, decisions and approvals are filed against the duty they support.

  4. 4
    Sign off

    A duty is only marked complete with a named reviewer and the evidence behind it.

  5. 5
    Keep it current

    When rules or your systems change, the affected duties are flagged for review.

Deadlines

The clocks and limits

Each figure is read from the rule itself. A person confirms which ones apply to your organisation.

72h
DPDP Rules, detailed breach report
To the Data Protection Board, within 72 hours of becoming aware. The Board and affected people are told without delay before that.
90d
DPDP Rules, grievance response
Each organisation sets its own response period, and it may not be longer than 90 days.
48h
DPDP Rules, erasure notice
Warn the person 48 hours before their data is erased.
1y
DPDP Rules, log retention
Keep the logs the Rules name for at least one year.

See every deadline KlaritiQ tracks

What you get

A map, a certainty label and the proof.

A duty map with owners

What may apply, who owns it, and what is still open.

A certainty label on every item

Settled, needs a lawyer's call, or not yet known.

A proof trail

Who approved what and when, with the evidence attached.

Who it is for

Built for your team.

General counsel, compliance heads, data protection officers and company secretaries at Indian companies that handle customer or employee data.

Common questions

Straight answers

No. KlaritiQ is a map of what the rules say about the work you do. It helps you and your advisers see what applies and act faster. For decisions about your specific situation, talk to a qualified lawyer.

Have the evidence before the question.

See what applies to your duties with the founders at KlaritiQ.

KlaritiQ provides information about laws and regulations to help organisations understand how rules may apply to their processes. It is not legal advice and does not create a lawyer-client relationship. Rules change, and how they apply depends on your facts; consult a qualified professional before acting. Law names are given for reference only. © KlaritiQ.