DPDP Implementation Practitioner — 90 Days to Audit-Ready

The first two weeks of a real engagement. Running the discovery interviews that get engineering, marketing, HR and support to actually tell you where personal data lives. The two scanner outputs you must have (file-share grep + database schema diff). The four hiding places that never make the first list: ad-platform audience uploads, support-ticket attachments, legacy backups, and spreadsheets on individual laptops. The deliverable is a draft data inventory good enough to anchor the RoPA in Module 3.

1. 1. Discovery interview questions that get engineering to actually tell you where data lives 12 min
2. 2. Reading a database schema the way an auditor reads it 11 min
3. 3. The four hiding places engineering always forgets to mention 12 min
4. 4. File-share and cloud-storage scanning without buying a six-figure DLP 11 min
5. 5. Building the draft data inventory that will survive Day 15 11 min
6. 6. Discovery sign-off and the Day-15 stop-or-go decision pack 12 min

The RoPA is the one artifact an auditor will ask for first. Most RoPAs fail because they are built as checklists, not as a map of how the company actually works. This module teaches the eight columns a RoPA must have, how to source each column from the Module 2 inventory, the three "red flag" cells that indicate a problem the moment they are filled, and how to walk a Data Protection Board inquiry through your RoPA without flinching. One fully-worked example (ABC Tyres) is built step by step.

1. 1. The eight columns of a DPDP RoPA, and why no ninth belongs 12 min
2. 2. Filling the RoPA from the Module 2 inventory, column by column 12 min
3. 3. The three red-flag cells an auditor spots in the first sixty seconds 12 min
4. 4. The twenty-minute RoPA walkthrough a DPB officer will ask you to run 12 min
5. 5. ABC Tyres worked example: four RoPA rows, filled column by column 12 min
6. 6. RoPA sign-off, the Day-30 Board update, and setting up Module 4 11 min

Lawful basis under DPDP is binary in theory and messy in practice. Retention is where theory and practice collide hardest. This module teaches the lawful-basis test as a decision tree, the retention matrix as a layered artifact (DPDP floor, sectoral overlay, government-security exception, contractual necessity), the Third Schedule 3-year inactivity rule with the 48-hour pre-erasure notice, and how to defend a 7-year retention cell to a Data Principal who asks for erasure.

1. 1. The lawful basis decision tree, and why "legitimate interest" is not an answer 12 min
2. 2. The retention matrix, layered by sector, that defends every cell 12 min
3. 3. The Third Schedule three-year inactivity rule and the 48-hour pre-erasure notice 11 min
4. 4. Erasure requests and the "unless required by law" response 12 min
5. 5. Getting the retention schedule signed off by Day 30 11 min

The privacy-facing surface of the company. Drafting a Rule 3 standalone notice that itemises data categories and purposes without turning into a wall of text. Wiring a Section 6 consent flow that will route through a registered Consent Manager when the Rule 4 regime goes live in November 2026. Handling cookies and tracking pixels (DPDP is silent, but the direction of travel is clear). Multilingual delivery under the Eighth Schedule. The deliverable is a live notice, a working consent flow in staging, and a Consent Manager integration plan.

1. 1. Drafting the Rule 3 standalone notice without turning it into a wall of text 12 min
2. 2. The Section 6 consent flow and the auditable consent record 13 min
3. 3. Cookies and tracking under DPDP, when the Act does not mention cookies 12 min
4. 4. Multilingual notice under the Eighth Schedule: 22 languages, Claude AI, not Bhashini 12 min
5. 5. The Rule 4 Consent Manager integration plan: live-frontier work 12 min
6. 6. Going live: the Day-45 checklist that keeps the notice from embarrassing you 12 min

Data Principal rights are the first place a company gets publicly embarrassed. This module teaches the DSAR intake form that minimises identity over-collection, the internal SLA design that stays comfortably inside the 90-day hard cap, the four response templates (grant, partial, refuse-with-reason, escalate) and the Section 13 grievance workflow that keeps a request out of the DPB. Includes the Section 15 Data Principal duties and the ₹10,000 Schedule penalty, because every DSAR workflow leaks requests from bad-faith requesters.

1. 1. The DSAR intake form that collects what you need and nothing more 11 min
2. 2. Identity verification without over-collection — three tiers, one decision tree 11 min
3. 3. The 90-day clock, and why you must beat it, not touch it 11 min
4. 4. The four response templates — grant, carve-out, refuse, escalate 11 min
5. 5. Section 13 grievance and the Section 15 duty that handles bad-faith requests 11 min

A DPDP programme is only as strong as its weakest Data Processor. This module teaches the vendor risk register (one row per vendor, nine columns), the Section 8(2) DPA with the ten clauses that are non-negotiable, the Rule 15 cross-border decision log for the negative-list regime, and the three "difficult vendor" scripts (big US SaaS vendor, small Indian vendor who will not sign anything, legacy vendor whose contract was signed in 2019). Includes the Section 17 exemptions and when they actually apply.

1. 1. The vendor risk register — ten columns, one row per vendor, nothing more 12 min
2. 2. The ten DPA clauses you do not negotiate away 13 min
3. 3. The Rule 15 cross-border decision log — four columns and the empty negative list 12 min
4. 4. Three vendor conversations that go sideways — and the exact scripts 13 min
5. 5. Section 17 exemptions — when they genuinely apply and when founders only think they do 11 min
6. 6. The Day-75 cutoff — accept the risk, or kill-switch the vendor 12 min

The lesson practitioners get called about at 2 AM. The Rule 7 Stage 1 "without delay" intimation to Data Principals and the Board. The Rule 7 Stage 2 72-hour detailed report. The parallel CERT-In 6-hour clock under the April 2022 Directions. The breach runbook that lets a company fire both without missing either. A tabletop exercise with a plausible breach scenario. The Star Health late-reporting pattern as a cautionary case.

1. 1. Classifying an incident as a personal data breach under Section 2(u) 11 min
2. 2. Rule 7 Stage 1 — the "without delay" intimation to Data Principals and the Board 12 min
3. 3. Rule 7 Stage 2 — the 72-hour detailed report to the Data Protection Board 11 min
4. 4. The CERT-In six-hour parallel clock — filing twice without duplicating effort 11 min
5. 5. The two-hour tabletop that turns a paper runbook into a tested one 12 min

What changes when the company either designs a high-risk processing activity or gets notified as a Significant Data Fiduciary. The DPIA scoping template, the risk-rating methodology, the algorithmic due diligence checklist for AI/ML systems, the Rule 13 independent audit on a 12-month clock, and the DPO role (qualifications, reporting line, salary band, independence protections). One fully-worked DPIA on a case-study processing activity.

1. 1. Scoping a DPIA before Legal is the one asking you to run one 12 min
2. 2. A risk-rating methodology that survives a Board meeting 11 min
3. 3. Algorithmic due diligence for AI systems, worked on a credit-scoring model 13 min
4. 4. The Rule 13 independent audit on a 12-month clock 12 min
5. 5. The DPO role that survives a change of CEO 12 min

Day 91 is the hardest day of a DPDP programme. The engagement is "over" but the programme must now run forever. This module teaches the 12-month DPO calendar (monthly, quarterly, half-yearly, annual cadences), the five KPIs that actually indicate programme health, the board-reporting cadence and deck template, the budget-ask language that gets a renewal through CFO, and the handover document a departing DPO owes a successor.

1. 1. The 12-month DPO calendar that keeps a programme alive after Day 91 12 min
2. 2. Five KPIs that indicate programme health — and the gaming behaviour that corrupts each 12 min
3. 3. Board reporting cadence and the six-slide deck that gets fifteen minutes well-spent 11 min
4. 4. The budget renewal ask — how to argue for a 10 percent increase, not accept a 10 percent cut 11 min
5. 5. The DPO handover document — what a departing DPO owes a successor 12 min

The reason most DPDP programmes stall is not legal, not technical, and not budgetary. It is cross-functional friction. This module teaches the leadership craft: how to run a steering committee, how to turn an engineering No into a scheduled Yes, how to handle a marketing team that has already shipped the pixel you now need to remove, how to brief a Board that does not understand DPDP, and the three conversations that unblock 90% of implementations. Six lessons, six real scripts, zero generic advice.

1. 1. Running a steering committee that decides, not one that updates 12 min
2. 2. Converting an engineering "no, not this quarter" into a scheduled Yes 11 min
3. 3. Handling the marketing pixel removal fight without losing the CMO 12 min
4. 4. Briefing a Board on DPDP risk in ten minutes and six slides 11 min
5. 5. The three recurring cross-functional disputes and how to mediate each 13 min
6. 6. When to escalate to the CEO, when to absorb, and how to escalate once 12 min

The capstone walks you through a complete 90-day DPDP engagement on ABC Tyres, a fictional Indian tyre-manufacturing company (modelled on the dcomply Decipher demo tenant). You produce every artifact from Modules 1-11 on this one company, and submit a complete programme file. The final exam is 45 questions drawn from a 70-item pool, covering every module, with each question anchored to a specific Section, Rule, Schedule or regulator circular cited in the course.

1. 1. ABC Tyres — the client brief and your Day-0 engagement plan 13 min
2. 2. Walking the full ABC Tyres programme file end to end 15 min
3. 3. Submitting your capstone and preparing for the final exam 11 min