What Data Privacy Advisory Means for Your Organisation

DPDPA readiness gets the basics in place. Privacy advisory goes deeper where risk is highest: international transfers, DPIAs for new products, an ISO/IEC 27701 management system, breach decisions, consent design and AI. Codec Networks reuses any existing data map and records.

Usually the one closest to a deadline or a live risk: consent and notices for consumer businesses, transfers for companies with overseas vendors or group entities, DPIAs for a product launch, and breach readiness if you have never rehearsed a breach.

It depends on who decides why and how personal data is processed. Many organisations are both, for different activities. Codec Networks maps your role for each activity as the first step.

A Data Fiduciary that the Central Government notifies as significant, based on factors such as the volume and sensitivity of data and risks to individuals. Significant Data Fiduciaries have extra duties, including an India-based DPO, periodic DPIAs and audits.

Yes. As a processor you need processor controls, sub-processor oversight, transfer mechanisms and breach notice to your customers. ISO/IEC 27701 certification and SCCs help answer customer due diligence.

Yes. Codec Networks builds a short DPIA screening checklist and privacy by design checkpoints into your existing release process, so only high-risk changes need a full DPIA.

Yes. HR, payroll, monitoring and recruitment data are personal data too, and are often shared with several vendors and countries.

Codec Networks provides DPO-as-a-service and supports appointed DPOs. Where the law requires a named officer based in India, such as for Significant Data Fiduciaries, Codec Networks advises on the appointment and supports that officer.

The DPDP Rules 2025 were notified on 13 November 2025 with phased commencement. Consent manager provisions follow after twelve months and most Data Fiduciary obligations after eighteen months, in May 2027.

As general information: Section 16 of the DPDP Act allows transfers except to countries the Central Government restricts, and the DPDP Rules 2025 can add conditions. Sector rules, such as RBI's 2018 direction on storage of payment system data, may require some data to stay in India.

As general information: the DPDP Act requires intimation of a personal data breach to the Data Protection Board and to each affected Data Principal, and the DPDP Rules 2025 set out the form, content and timeline. Codec Networks builds templates from the notified text; counsel should confirm them.

They run in parallel. CERT-In's Directions of 28 April 2022 require specified cyber incidents to be reported within six hours. A personal data breach may trigger both CERT-In reporting and DPDP intimation, as well as sector and contractual notices.

It can, if you offer goods or services to people in the EU or monitor their behaviour (GDPR Article 3(2)), or process personal data for EU-based customers as a processor.

The 2025 edition, published in October 2025, is a standalone standard, so organisations can certify a privacy management system without first certifying to ISO/IEC 27001. It can still be integrated with an existing ISMS.

The DPDP Act requires verifiable consent of a parent or lawful guardian before processing a child's personal data and prohibits tracking, behavioural monitoring and targeted advertising directed at children, subject to exemptions in the Rules. Penalties for breach of these duties can reach ₹200 crore.

Yes. The Central Consumer Protection Authority issued guidelines on the prevention and regulation of dark patterns in November 2023. Codec Networks reviews consent and checkout journeys against them, for client information.

With a scoping call and a document request covering notices, contracts, system lists and any existing records. Codec Networks then agrees the scope, plan and RACI with your DPO or privacy lead.

Through short workshops with system and process owners, existing documentation and, where agreed, tool-assisted discovery. Each owner typically spends a few hours.

Only where an engagement needs it, such as testing a rights request. Access is minimised and handled under Codec Networks' ISO/IEC 27001:2022 certified ISMS, with agreed deletion afterwards.

Codec Networks drafts them in clear language, your legal counsel reviews them and your teams publish them. Codec Networks also tests the journeys on each channel.

Codec Networks screens the initiative, describes the processing with the owner, assesses necessity and risks, recommends measures and records residual risk and the approval, following ISO/IEC 29134 practice.

Codec Networks presents a realistic scenario with timed injects, and the team decides on containment, notification and communication against each deadline. Gaps are recorded and the playbook is updated.

By inventorying the use case, its data and decisions, reviewing the lawful basis of training and inference data, testing for leakage and re-identification, and recommending controls and governance.

Yes. Codec Networks provides the data map, technical facts and drafts; your law firm gives legal opinions. This keeps legal advice where it belongs and avoids duplicated work.

By the level you choose (Basic, Medium or Advanced) and by scope drivers such as entities, systems, channels, countries, processors and AI use cases. Document 7 gives indicative bands; a written proposal confirms them after scoping.

Typically four to eight weeks for a data map of key systems, a gap list against the DPDP Act and other applicable laws, and a plan to May 2027.

A DPIA for one initiative is usually part of a Basic or Medium package; DPIAs can also be bought per initiative under a privacy retainer.

Typically four to eight months to certification readiness, followed by the certification body's Stage 1 and Stage 2 audits. It is faster if an ISO/IEC 27001 ISMS already exists.

As a monthly retainer based on the volume of rights requests, DPIAs, vendor reviews and Board reporting, typically from ₹2 lakh to ₹8 lakh a month.

No. Certification body fees, consent platform licences and other third-party costs are paid by the client and listed separately in proposals.

Yes. The Privacy Starter, DPDP Ready and Privacy Programme bundles cost less than their parts because the data map, records and workshops are reused.

Clients on an incident retainer get assured response hours. Others are supported as quickly as Codec Networks' incident response team is available.

A quarterly privacy pack: data map changes, rights requests and response times, DPIAs completed, transfers added, breaches and notifications, and decisions required.

Typically records showing notices, consent, security safeguards, breach handling and, for Significant Data Fiduciaries, DPIAs and audits. Codec Networks builds and maintains these records in one repository.

Through owners for each activity, a change trigger in projects and procurement, and quarterly reviews under a retainer.

By volume, type and time to respond, with exceptions explained. These metrics appear in the quarterly pack.

At least once a year, and after major changes to systems, vendors or laws. Codec Networks plans tabletops in the retainer.

Yes. Under a retainer, Codec Networks tracks changes to the DPDP Rules, sector directions and foreign laws and updates notices, clauses and playbooks.

Yes. The data map, records, DPIAs, ISO/IEC 27701 certificate and transfer documents answer most customer privacy questionnaires.

Yes. Codec Networks' incident response and forensics teams can support investigation, follow-up questions from regulators and customers, and the lessons-learned review.