Technical DPDP Act readiness
Most DPDP work stops at policies and consent banners. Farwatch looks inside your code, databases, logs and app SDKs. We show where personal data lives down to the file and column, test that deletion really works, and then our engineers fix what we find.
services/auth/otp.ts:88
logger.info(`OTP sent to ${user.phone}`)
→ CloudWatch /prod/api · retention: never expires
test user 4f2c…e1 removed from postgres.users ✓
still found: warehouse.events_raw (1,204 rows)
still found: s3://exports/crm/2026-09/ · Mixpanel
android/app/build.gradle:41
com.google.android.gms:play-services-ads
→ no age check before initialisation
RDS (KMS) · S3 (SSE-KMS) · backups encrypted
The gap
Most companies get two options today: documents built from workshops, or consent banners on the front door. Real data-discovery platforms exist, but they are priced for banks and stop at finding the data. Nobody checks the back end, where personal data is stored, copied, logged and deleted. That back end is where the security, breach and deletion duties apply.
| Capability | Gap reports & policies₹50k–₹15L one-time | Consent platforms₹0–₹1.2L / year | Enterprise discovery₹60L+ / year | FarwatchScoped to your stack |
|---|---|---|---|---|
| Data map built from your actual code and databases | No | No | Partly | Yes |
| Finds personal data leaking into logs | No | No | Partly | Yes |
| Checks app SDKs and trackers | No | Partly | No | Yes |
| Tests that deletion removes data everywhere | No | No | No | Yes |
| Breach drill against the 6-hour and 72-hour deadlines | Partly | No | No | Yes |
| Engineers who build the fixes | No | No | No | Yes |
Categories and price ranges are based on published offers from Indian and global vendors as of October 2026. Individual vendors vary.
The Farwatch Audit
AI-assisted scanners do the broad search across your repos, schemas, buckets, logs and app builds. Our engineers review every finding before it goes in your report, and they run the deletion test and breach drill themselves.
01 · Data map
Every personal field traced to a file and line, table and column, or bucket and path. Each one is tagged as identity, contact, financial, health or children's data. Includes every third-party SDK and tracker in your web and mobile apps.
users.phone · otp.ts:88 · s3://kyc/
02 · Logs
We check application logs, error trackers and analytics for phone numbers, emails, Aadhaar, PAN, OTPs and tokens. You get the exact log statements to change and the retention each log source should have.
CloudWatch · Sentry · Datadog
03 · Deletion
We create a test user, delete them through your real flow, then look for them everywhere: primary database, replicas, warehouse, backups, caches, logs and third-party processors. You get a pass or fail for each location.
pass / fail per location
04 · Safeguards
We check encryption, access control, MFA, logging, log retention and backups in your real cloud accounts, not a questionnaire. Each one is mapped to Rule 6 of the DPDP Rules.
Rule 6 evidence pack
05 · Breach drill
We run a simulated incident with your team. Can you detect it, work out which users are affected, and draft the CERT-In report within 6 hours and the Data Protection Board report within 72?
6h CERT-In · 72h Board
06 · Fix list
Every finding comes with severity, an owner and effort in engineer-days. You also get exports for your lawyer, your compliance tool and your investors, plus a two-page summary for enterprise customers who ask.
lawyer · Sprinto/Scrut · investors
How it works
Every stack is different, so we agree scope and access in writing before anything runs. Your engineers join the kick-off, the deletion test, the breach drill and the read-out. Everything else runs on our side.
Before anything runs
We agree the scope and sign the written authorisation, NDA and data processing agreement. You give us read-only access, and we deploy scanners inside your cloud or CI.
Mostly automated
We scan code, schemas, data stores, buckets, logs, error trackers, analytics and mobile app builds. Engineers then review and confirm every finding.
With your team
We run the deletion test with a test user, check security safeguards against Rule 6, and run the breach drill with your on-call team.
Handover
We walk your engineering and leadership teams through the findings. You get the fix list, the evidence pack and the exports. Then we revoke our access.
After the audit
Our engineers build the fixes: deletion and retention jobs, log redaction, consent checks in your APIs, and breach alerts. You review every pull request.
After the audit
A personal-data scan on every pull request, regular drift reports, and repeat deletion tests and breach drills. Your evidence stays current through May 2027 and beyond.
Sector checks
Both sectors hold the most sensitive data, spread across many systems. We add checks for the rules that apply to you.
Children's data · parental consent
Users under 18 need verifiable parental consent. The Act also bans tracking, behavioural monitoring and targeted ads aimed at children. A consent banner can't tell you whether your app does any of that. Your code can.
Sensitive health data · long retention duties
Medical-records rules make you keep clinical data for years, while the DPDP Act requires you to delete everything else. An ABDM consent covers access to records. It does not cover every later use, such as analytics, insurance or AI training.
Getting started
No two stacks are alike, so we don't quote off a form. The spot check shows you what we find, and it shows us what a full audit would involve.
Free
See what a scan finds before you commit to anything.
Scoped to your stack
We agree the scope with you first, then give you a plan and a quote before any work starts. Scope depends on:
Founding clients
We're taking on a small number of founding clients on preferential terms, in exchange for a named case study and one reference call.
How we handle your data
What Farwatch doesn't do
No legal advice
We're engineers. Notices, contracts and legal questions go to a partner law firm, and we give them our evidence.
No "compliance certificate"
There is no official DPDP certificate for ordinary companies. A dated report backed by evidence is more useful to investors and customers anyway.
No consent-manager product
Keep the consent tool you have, or pick any one. We check that it is wired correctly to your back end.
FAQ
The 13 May 2027 date is fixed, and MeitY has publicly refused to extend it. Enforcement can start as soon as members are appointed. Meanwhile, enterprise customers, hospitals and investors already ask for privacy due diligence. A dated technical report answers them today, and fixing deletion and logging properly takes months, not days.
Neither. The DPDP Act applies to any organisation, of any size, that processes digital personal data in India. It also applies to companies outside India that offer goods or services to people in India. If your product has users in India, the engineering duties apply to you. Your lawyer can confirm the details for your case.
A gap assessment asks your team what happens to personal data and writes down the answers. We check what your systems actually do. That means scanning the code, querying the schemas, searching the logs and deleting a test user to see what's left behind.
It depends on your stack: how many repos, apps, data stores, cloud accounts and log tools hold personal data. We scope it with you first, then give you a plan and a quote before any work starts. The free spot check is the easiest way to get there.
Read-only access to your repositories, database schemas or a read replica, cloud storage listings, your log and error-tracking tools, and current app builds. The exact list is agreed in writing during scoping. Scanners run inside your environment.
Yes. It lets us search far more code, schemas and logs than a manual review could. The models work on code, schemas and redacted samples, not on raw user records. An engineer reviews every finding before it goes in your report.
It helps, because much of the Rule 6 safeguards evidence overlaps and we reuse it. But neither standard checks deletion across every copy of your data, personal data in logs, children's data or the Board's 72-hour breach report. Those are where we spend most of our time.
No to both. We're an engineering firm. We give you evidence of what your systems do and a list of technical fixes. Your lawyer uses that evidence to judge compliance and to draft notices and contracts. If you don't have a privacy lawyer, we can introduce you to one.
Yes, that's the Fix Sprint. Our engineers build deletion and retention jobs, log redaction, consent checks in your APIs and breach alerts. The work ships as pull requests your team reviews. Monitor then keeps the evidence current.
Guides
The law, quoted from the official text, and the work it creates in your systems.
Engineering guide
A plain-English map of India's DPDP Act and Rules for engineering teams: which duties land in your systems, what to build, and where to start before 13 May 2027.
14 min read
Deletion
Erasure is easy to promise and hard to prove. A step-by-step method to test deletion across databases, replicas, warehouses, logs, backups and third-party tools.
9 min read
Breach response
An on-call runbook for personal data breaches in India: what CERT-In needs in 6 hours, what the Data Protection Board needs in 72, and what to build now.
8 min read
Send us one repository and one day of logs, or one app build. We'll return a one-page heat map of the personal data we found and walk you through it in 30 minutes. It's free, and there's no sales deck.
or write to hello@farwatch.systems