Consulting Division
Compliance for digital products and AI, done properly.
Apps and AI systems now carry real legal obligations. We help you work out which laws apply, close the gaps and stay compliant as you grow. The same team delivers the product changes and the compliance documents, so the policy and the software say the same thing.
In short
Which regulations does Code Colonies help with?
DPDP Act 2023, GDPR and UK GDPR, EU AI Act, HIPAA, PCI DSS, NIST Frameworks and CCPA and CPRA. The team maps the law to your data and processes, closes the gaps in your systems and keeps the evidence an auditor asks for. For the DPDP Act, TrustOS runs the daily work.
- When does the DPDP Act apply in full?
- The DPDP Rules were notified on 13 November 2025 and start in phases: Consent Manager provisions from about 13 November 2026 and most Data Fiduciary duties from about 13 May 2027.
- Do you give legal advice?
- No. The team covers the regulation, processes and engineering, and your lawyers do the legal review alongside.
- Where do I start?
- The DPDP Readiness Check takes ten questions and shows where you stand.
- How is it priced?
- Under 2good.dev at USD 2 or INR 199 an hour, a 150 hour minimum, no advance and payment after you accept the work.
When clients call us
Situations we are asked to resolve
- DPDP Act deadlines are coming and you do not know where to begin.
- A client in Europe or the US asked for GDPR, HIPAA or PCI DSS evidence.
- Your app collects health, payment or children's data.
- You use AI in decisions that affect people.
Scope
What the work covers
- Privacy and data protection
- DPDP Act 2023, GDPR, UK GDPR and CCPA. What applies, where the gaps are, the policies and the day to day processes.
- Health and regulated products
- Whether HIPAA applies, medical device risk under FDA and EU MDR, and compliant design for health apps.
- AI governance
- EU AI Act classification and obligations, ISO 42001 readiness, NIST AI RMF, AI policies and risk registers.
- Security and payments
- PCI DSS for payment systems, NIST control mapping, security reviews and evidence for audits.
- Compliance engineering
- Consent screens, data rights requests, retention rules and logging built into your product.
- TrustOS platform
- Our own DPDP compliance platform for running the programme day to day.
Regulations
Pick the rules that apply to you
- IndiaDPDP Act 2023India's Digital Personal Data Protection Act, and the rules made under it.
- European Union and United KingdomGDPR and UK GDPRData protection law for people in the European Union and the United Kingdom.
- European UnionEU AI ActRules for AI systems in the EU market, graded by risk.
- United StatesHIPAAUS law on protected health information.
- GlobalPCI DSSSecurity standard for any system that handles card data.
- Global, US originNIST FrameworksNIST Cybersecurity Framework and NIST AI Risk Management Framework.
- California, United StatesCCPA and CPRACalifornia's consumer privacy law.
How it runs
A clear path, with gates
- Step 11 to 2 weeksShort assessmentWhich laws apply, where the gaps are and what to fix first.
- Step 22 to 4 weeksDesign and documentationPolicies, processes and product changes worked out together.
- Step 3As neededImplementationOur engineers build the changes into your systems.
- Step 4OptionalAdvisory retainerContinued support as laws, products and data change.
Deliverables
What you receive, and what changes
What you receive
- Which laws apply, and why
- Gap assessment
- Policies and privacy notices
- Product changes for consent, rights and retention
- Evidence pack for audits and clients
What changes
- A clear list of your obligations
- Evidence ready when clients or regulators ask
- Privacy built into the product
- Less regulatory exposure
Start here
Talk to us about compliance and data protection.
Tell us what you are trying to achieve. A specialist replies within one working day, and the first conversation is free.
Questions
Do you provide legal opinions?
No. Legal review stays with your legal team and we work with them. We cover the regulatory, process and engineering side.
When does the DPDP Act apply in full?
Under the Rules as notified, Consent Manager provisions start around 13 November 2026 and most Data Fiduciary duties around 13 May 2027. The government can change these dates, so we confirm them at the start. An assessment now leaves time to fix what it finds.