G.S.R. 846(E).—In exercise of the powers conferred by sub-sections (1) and (2) of section 40 of the Digital Personal Data Protection Act, 2023 (22 of 2023), the Central Government hereby makes the following rules, namely:—

1. Short title and commencement.—(1) These rules may be called the Digital Personal Data Protection Rules, 2025.

(2) Rules 1, 2 and 17 to 21 shall come into force on the date of their publication in the Official Gazette.

(3) Rule 4 shall come into force one year after the date of publication in the Official Gazette.

(4) Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication in the Official Gazette.

2. Definitions.—(1) In these rules, unless the context otherwise requires,—

(a) “Act” means the Digital Personal Data Protection Act, 2023 (22 of 2023);

(b) “techno-legal measures” means measures to ensure compliance with the Act and these rules by implementing technologies…

THE GAZETTE OF INDIA EXTRAORDINARY[PART II—SEC. 1]

THE SCHEDULE [See section 33 (1)]

Sl.Breach of provisions of this Act or rules made thereunderPenalty

1.Breach in observing the obligation of Data Fiduciary to take reasonable security safeguards to prevent personal data breach under sub-section (5) of section 8.May extend to two hundred and fifty crore rupees.

2.Breach in observing the obligation to give the Board or affected Data Principal intimation of a personal data breach, under sub-section (6) of section 8.May extend to two hundred crore rupees.

3.Breach in observance of additional obligations in relation to children, under section 9.May extend to two hundred crore rupees.

4.Breach in observance of additional obligations of Significant Data Fiduciary, under section 10.May extend to one hundred and fifty crore rupees.

5.Breach in observance of the duties under section 15.May extend to ten thousand rupees.

6.Breach of any term of voluntary undertaking accepted by the Board under section 32.Up to the extent applicable for the breach in respect of which the proceedings under section 28 were instituted.

7.Breach of any other provision of this Act or the rules made thereunder.May extend to fifty crore rupees.

THE SCHEDULE · SECTION 33(1) The fine doesn’t shrink for a small office.

A complaint costs your client nothing. Proving you did what the law expects is on you: the notice, the consent, the purpose and the deletion, for every client.

The DPDP Act explained

HOW IT WORKS

Built around what the Act asks of you.

Six things the Act requires at the moment you collect. You send one request, your client opens one link, and all six happen there.

How it works, in full

DPDP CHECKSPURPOSENOTICECONSENTRIGHTSRETENTIONPROOF

0/6

10:12 THU 4 SEP YOU · 2 MINUTES

Say why you need it, and tell them before you take it.

You build the request instead of typing a message: what it’s for, what you need, how long you keep it. The notice writes itself and freezes the moment you create it. No purpose, no request.

What to call it

2–5 words each

Title KYC documents

Purpose Verifying your identity and address for your client file This sentence appears in the client's notice exactly as written.

18:40 THU 4 SEP RAJESH · HIS PHONE

Get a clear yes, to exactly this, before anything is kept.

Rajesh reads the notice, agrees, uploads. No account, no app. Nothing is stored until he agrees, and he takes a receipt of exactly what he agreed to, as a PDF or by email. If he doesn’t respond, it reminds him.

GrievancePriya Sharma · [email protected]

ComplaintsData Protection Board of India, if unresolved

I agree to share Aadhaar card (masked) with Sharma Associates for verifying your identity and address for your client file, kept for 1 year.

Agree and continue Files encrypted · only Sharma Associates can see them

Any day WHENEVER HE ASKS RAJESH

Let them see, correct or erase what you hold, whenever they ask.

From one screen, you export what you hold on him, correct it, or erase it. Withdrawing consent is as easy as giving it.

16 Mar 2034 YOU, ONCE

Keep it only as long as the purpose needs. Then delete it.

You set the period when you build the request, and the notice shows it. Fifteen days before, it asks you once: keep, renew or delete now. Do nothing and it deletes on the date, backups included.

Later this month1

31MAR Rajesh Kumar · KYC documents 1 document · 0 answers · promised until 31 Mar 2034 deletes in 15 days Renew Keep Delete now

Ask Rajesh to keep it for how long?

Further period, in days365 Create the renewal Cancel

Counted from 31 Mar 2034: kept until 31 Mar 2035 if they agree · the link is valid until 31 Mar 2034 A fresh notice with the new date goes to them; they choose item by item what may be kept. Anything not chosen deletes on 31 Mar 2034 as promised.

Later this month1

31MAR Rajesh Kumar · KYC documents 1 document · 0 answers · promised until 31 Mar 2034 deletes in 15 days Renew Keep Delete now

Ask Rajesh to keep it for how long?

Further period, in days365 Create the renewal Cancel

00:0031 MAR 2034

Be able to prove all of it, to anyone who asks.

आयकर विभाग
INCOME TAX DEPARTMENTभारत सरकार
GOVT. OF INDIA

Permanent Account Number CardXXXXX1234XRAJESH KUMAR12/08/1984

Gone.

31 March 2034, midnight. The PAN card no longer exists anywhere. These lines do.

Written as it happened. Nobody can change it afterwards, not you, not us. When someone asks whether you did this properly, you do not say so. You show them.

Start free, no card required Everything it does

Notice shown 18:38 · THU 4 SEP

Consent recorded 18:40 · THU 4 SEP

Files received 18:42 · THU 4 SEP

Viewed by Mehta & Co. 10:05 · FRI 5 SEP

Files deleted, backups included 00:00 · 31 MAR 2034

SECURITY

Only the firm that asks for the documents can see them.

Twelve layers stand between your client’s document and anyone else. Here is every one of them, from the moment it leaves your client’s phone to where it rests in Mumbai.

01 · KEEPS PEOPLE OUT

02 · KEEPS IT UNREADABLE

03 · KEEPS THE PROOF

L01 IN TRANSIT

CLIENT

q7Hx9LmP2vRt0aZcW4nYbKs8

MUMBAI

HTTPS / TLS

L02 AT THE DOOR

POST /sign-in · 49.36.x.xHUMAN · PASS

POST /sign-in · 185.220.x.xBOT · STOPPED

POST /sign-in · 103.21.x.xHUMAN · PASS

POST /sign-in · 45.155.x.xBOT · STOPPED

CLOUDFLARE TURNSTILE

L03 YOUR CLIENT’S UPLOAD PAGE

↓

2 files sentRECEIVED · SEALED

VIEWDOWNLOADCHECK

RECEIVE-ONLY

L04 YOUR FIRM’S SIGN-IN

••••••••••••$argon2$v=19$9f2c…e41a

481027

✓ NOT IN KNOWN BREACHESLOCKS ON REPEAT FAILS

2FA · ARGON2

L05

STAFF SIDE

FIRMDOCUMENTS

Mehta & Co.— none shown

Firm 0412— none shown

Firm 0413— none shown

Not us.

L06 AWS KMS · MUMBAI

MASTER KEY NEVER LEAVES KMS

L07 WRAPPED BY THE MASTER KEY

FIRM KEY ISSUED TO MEHTA & CO. ALONE

L08 WRAPPED BY THE FIRM KEY

dk_7f3a · form-16.pdf

DESTROYED 31 MAR 2031 · NO VERSIONS · NO BACKUP COPY

DOCUMENT KEY

FORM NO. 16 Certificate under section 203 of the Income-tax Act, 1961

Employee · RAJESH KUMAREmployer · MEHTA INFRA PVT LTDAssessment year · 2026–27

Gross salary₹ 14,20,800

AES-256-GCM

sO0STliuxhNT+StCpmOk8jXaNgXhqGVuCKUDTooUXe8duueAKRRfd7R+CTkWtul4URQoajM1A08ZKwEVzhbLQoVYE5u3pZVX5Z+4AQmHCZl/sS187PEdui7hsMM/1/+CLb4rclPF2HPGpKLq7UlPPhcRSCYjrY3yfPV6Hbek00TmcRdZLmUZKdPfOUqdgcYeQutcZrqeTaIYbgDBC+ry4NsD37YlvD5/0uZKqLNrsvGT/tVZ5UBSxrL2lt8yuFzMkIw7R0fCWslQfxsZIgvyMuEvyjs82Zc+40Jnne2brJ9GVkf6HaLJiNvn0VC8f5OMHp+HDBsvB+nu3+FzN6vQLClVE8VqAbguqhnT+VX2xE5/d359z3x+fD9x6O+8y5qd5TaCwSRmSRNxgHQPQLrM1KP0tETtMJFQM3wMxwx59d69Ymjh+t0xmNzV2VuyoEHA6ECqYnQnKiZbdMLsTUllKFCNs7mFcjKkb0nT+vEnQXABGwfon6Uh4qSTptTeAcl1J93/6/nyo0JqsM3LTVbcJ19gDjN0uowqaZLnmRQ+qxLLnXrQvfRPUcarSUt/8/D7n+5DYcXGuFeePITsTOOxzYBtw6J4DZ3hHlbKoXUALqab7ZIZXbq78hLdzL7WauiUUHI0w8gkaWX5EAhPS/+kIvOzzBaSa2eLkaY6GBRqyDuwB22Fcwglu5koKS+jbpC+PXjTDfBMtn25L0f0Pnq1H5k0O4AC0/mlu2B4+OH/h7HL6w0SBczMrmmNYp2m/vj6ZvLgQH79m45fmjNaLHUjx4Ct/e6HSzPyo6YDRA29WUksmFDCEgjxymRMcPjeFBEHyPAaYyO4HIhrTOtCFf6vGqqhH0JixTZxQmbd/VdmRMHTE2jSm7vUF6klYFEMufmma3BD

L10 THE RECORD · SHA-256

18:40CONSENT GIVEN · RAJESH K.a91f

18:41FORM 16 RECEIVED3c07

11:02VIEWED · MEHTA & CO.e5d2

11:05DOWNLOADED · MEHTA & CO.7b40

CHAIN INTACT

L11 HEAD PUBLISHED DAILY · WRITE-ONCE

23 SEPc41e

24 SEP08ad

25 SEPf6b3

26 SEP2d9c

27 SEP7b40

S3 OBJECT LOCK COMPLIANCE MODE

L12 AWS · SOC 2 · ISO 27001 19.08°N 72.88°E AP-SOUTH-1 · MUMBAI DOCUMENTS · DATABASE · KEYS · RECORD

L01 · HTTPS / TLS

HTTPS, end to end.

Every upload travels over HTTPS, the same standard used for online banking, from your client’s phone to Mumbai.

L02 · CLOUDFLARE TURNSTILE

Bots stop at the door.

Cloudflare Turnstile bot protection sits in front of every firm sign-in.

L03 · RECEIVE-ONLY

The upload page only receives.

Once a document is sent, nobody can view, download or check it from there. Not your client, not anyone who finds the link.

L04 · FIRM ACCOUNTS

Locked down by default.

Two-factor authentication, Argon2-hashed passwords, a check against known breached passwords, and a lockout after repeated failed attempts.

L05 · CONFIDENTIAL DISPATCH

Not us.

We have no direct access to your documents, and no backend panel that shows them to us. The files remain encrypted.

L06 · MASTER KEY · AWS KMS

The master key never leaves KMS.

It stays inside AWS Key Management Service in Mumbai, and wraps every key beneath it.

L07 · FIRM KEY

Issued to one firm alone.

Your firm’s key is the only one that unwraps your documents’ keys.

L08 · DOCUMENT KEY

Destroy the key, and the document is gone.

Every document gets its own key. Deletion is enforced at the key layer, not just the file layer: when retention ends, the key is destroyed with it.

L09 · AES-256-GCM

Encrypted the moment it lands.

There is no versioning, so a deleted document can never be rebuilt from an old version or a backup copy.

L10 · THE RECORD · SHA-256

Every view and download, on the record.

Who opened what, and when, sits on the same record as the consent. Each entry carries a SHA-256 fingerprint of itself and of the entry before it.

L11 · S3 OBJECT LOCK

Change one entry, and every later one stops matching.

The chain’s head is published every day to write-once storage, in compliance mode. Not even we can rewrite it.

L12 · AWS MUMBAI

Stored in India, on AWS in Mumbai.

AWS’s infrastructure is SOC 2 and ISO 27001 certified. The documents, the keys and the record never leave the country.

01 · KEEPS PEOPLE OUT

L01 · HTTPS / TLS

HTTPS, end to end.

Every upload travels over HTTPS, the same standard used for online banking, from your client’s phone to Mumbai.

L02 · CLOUDFLARE TURNSTILE

Bots stop at the door.

Cloudflare Turnstile bot protection sits in front of every firm sign-in.

L03 · RECEIVE-ONLY

The upload page only receives.

Once a document is sent, nobody can view, download or check it from there. Not your client, not anyone who finds the link.

L04 · FIRM ACCOUNTS

Locked down by default.

Two-factor authentication, Argon2-hashed passwords, a check against known breached passwords, and a lockout after repeated failed attempts.

02 · KEEPS IT UNREADABLE

L05 · CONFIDENTIAL DISPATCH

Not us.

We have no direct access to your documents, and no backend panel that shows them to us. The files remain encrypted.

L06 · MASTER KEY · AWS KMS

The master key never leaves KMS.

It stays inside AWS Key Management Service in Mumbai, and wraps every key beneath it.

L07 · FIRM KEY

Issued to one firm alone.

Your firm’s key is the only one that unwraps your documents’ keys.

L08 · DOCUMENT KEY

Destroy the key, and the document is gone.

Every document gets its own key. Deletion is enforced at the key layer, not just the file layer: when retention ends, the key is destroyed with it.

L09 · AES-256-GCM

Encrypted the moment it lands.

There is no versioning, so a deleted document can never be rebuilt from an old version or a backup copy.

03 · KEEPS THE PROOF

L10 · THE RECORD · SHA-256

Every view and download, on the record.

Who opened what, and when, sits on the same record as the consent. Each entry carries a SHA-256 fingerprint of itself and of the entry before it.

L11 · S3 OBJECT LOCK

Change one entry, and every later one stops matching.

The chain’s head is published every day to write-once storage, in compliance mode. Not even we can rewrite it.

L12 · AWS MUMBAI

Stored in India, on AWS in Mumbai.

AWS’s infrastructure is SOC 2 and ISO 27001 certified. The documents, the keys and the record never leave the country.

We don’t sell your data.

Not to any third party, today or ever. And if you leave, every firm, free or paid, takes a complete, self-verifying export of its documents and its compliance evidence.

A DATA PROCESSING AGREEMENT IS AVAILABLE

FOR YOUR IT TEAM

Confidential Dispatch runs on AWS in Mumbai, whose infrastructure is SOC 2 and ISO 27001 certified. We don’t hold those certifications ourselves yet. Everything above is how the app is built, and the export lets you check the record yourself.

ENCRYPTIONAES-256-GCM

KEYSAWS KMS · PER DOCUMENT

IN TRANSITHTTPS / TLS

HOSTINGAWS AP-SOUTH-1

PASSWORDSARGON2 · 2FA

RECORDSHA-256 HASH CHAIN

WRITE-ONCES3 OBJECT LOCK

INFRASTRUCTURESOC 2 · ISO 27001 (AWS)

WHO IT IS FOR

Every industry has a different ask. Yours is set up from day one.

For firms already holding client data, and those who want to be compliant from their first request.

KYC kept for the five years the RBI asks, and not a day longer.

How it works for NBFCs

Onboard customers with consent on record, before an auditor or a partner bank asks to see it.

How it works for fintechs

New joiners send payroll papers to one link, not to a recruiter’s inbox.

How it works for HR teams

Every new client, onboarded once. Their PAN and Aadhaar stop living in your WhatsApp.

How it works for CAs

Passports and bank statements for one application, deleted 180 days later.

How it works for visa consultants

Open a matter with the client’s ID and papers together, kept as long as the engagement lasts.

How it works for law firms

Proposal papers collected once, kept for IRDAI’s five years, then gone.

How it works for insurance agents

Patients register with ID and insurance before they reach the front desk.

How it works for clinics

Your firm Client KYC Client onboarding and identity verification.

PAN card Document Aadhaar (masked) Document Address proof Document Full legal name AnswerYour documents are kept for as long as they're a client, then deleted. This link stays open for 14 days.

PLANS

Built to the standard the big firms are held to. Priced for you.

30 days free, on any plan. Start free, no card required

On every plan Every feature.
Unlimited documents.
Unlimited clients.

Solo1 personStart free

₹18,000a year + GSTor ₹1,999 a month + GST

FirmUp to 10 peopleStart free

₹49,000a year + GSTor ₹5,999 a month + GST

InstitutionUnlimited peopleStart free

₹99,000a year + GSTor ₹11,999 a month + GST

See pricing details More than an institution needs? Enterprise and API on request.Talk to us

BUILT FOR

India.

Made for Indian firms and the Digital Personal Data Protection Act, not adapted from a law written somewhere else.

BUILT IN

Maharashtra.

Designed, built and supported by a team in Maharashtra, answerable under Indian law.

HOSTED IN

Mumbai.

Your clients’ documents are stored on servers in Mumbai, AWS ap-south-1. They do not leave India.

MUMBAI

SELF-CHECK

Does DPDP apply to you?

Most professionals who collect client information are covered, many without realising it. Twelve questions tell you where you stand.

Check your DPDP exposure

GUIDES

Understand the law before it lands on your desk.

The DPDP Act explainedFEATURED

Foundations For businesses and professionals For individuals

200+ GUIDES ACROSS 18 TOPICS · NOT LEGAL ADVICE

Collect documents the compliant way, starting today.

Start free, no card required

Rajesh K.

Rajesh ji, please send your Aadhaar and PAN for this year’s ITR. Ok sir sending aadhaar front.jpg IMG_4471.jpg 👍

CONFIDENTIAL DISPATCH

Request fromRao Desai & Co.

Consent

2 Items

3 Send

ITR filing documents

For filing your income tax return. Two things are needed, and nothing you send here can be read back from this page.

This link was sent to +91 ••••• ••210

Items requested2 items

Respond by24 Oct 2026

Documents to upload2 items

Aadhaar card (masked) Aadhaar_masked.pdf

Remove

PAN card PAN_card.jpg

Remove

Consent recorded 10 Oct 2026, 11:42 am IST

Send 2 items This completes the request. After sending you get a one-time consent receipt — save it before you close the page.

This send completes the request. Nothing left to provide