Running DPDP Act compliance as daily operations with TrustOS

The problem after the policy is signed

Most companies start DPDP work with a gap assessment, a new privacy notice and a revised set of policies. That part ends. What does not end is the daily work: a customer withdraws consent on Tuesday, a former employee asks what data you still hold on Thursday, a vendor reports a misdirected email on Friday. Each one has to be handled correctly, on time, with a record you can show later.

The Digital Personal Data Protection Act, 2023, and the DPDP Rules, 2025, have phased timelines. Consent Manager provisions apply from November 2026 and most other duties from May 2027, under the Rules as notified on 13 November 2025. By then, you need more than documents. You need a way of running compliance every day.

TrustOS is the platform we built for this. It brings DPDP compliance into one place, from consent and rights requests to breach response and audit evidence. It serves any company in India that handles personal data, including US and global companies operating in India.

Four areas of recurring work

Each area maps to a duty under the Act and the Rules:

1. Consent management. Notices, consent capture and withdrawal, in line with the Act and its rules.
2. Data principal rights. Access, correction and erasure requests, tracked to closure within timelines.
3. Breach response. Incident logging, assessment and notification workflows.
4. Audit evidence. Records, reports and evidence ready for review by the Board.

The four areas in practice

Consent as an operation

Under the Act, consent must be free, specific, informed, unconditional and unambiguous, given with a clear affirmative action, and as easy to withdraw as it was to give. The notice that goes with it must be clear and itemised.

Operationally, that means:

• Each purpose you process data for needs its own notice and its own consent record.
• When someone withdraws consent, every system and vendor using the data for that purpose needs to stop, within a reasonable time.
• You need to show, for any person, what they agreed to, when and through which notice version.

TrustOS keeps the notices, the consents given and withdrawn, and the history in one record per data principal. Your website, app or CRM captures consent through it, and withdrawals flow back to the teams who need to act.

Rights requests with a clock

People can ask for a summary of their data, correction, completion, updating or erasure, and can nominate someone to exercise rights for them. You must respond within the timelines the Rules set and offer a way to raise grievances.

Without a system, these requests arrive by email, sit in an inbox and are answered late or not at all. In TrustOS, each request is logged, identity is verified, the request is assigned to the teams holding the data, and it is tracked to closure against its deadline. Managers see what is open and what is at risk of going overdue.

Breaches, handled by a calm process

The Rules require you to inform the Data Protection Board and each affected person of a personal data breach without delay, and to send the Board a detailed report within 72 hours of becoming aware of it, unless the Board allows longer.

That timeline is tight. TrustOS gives you an incident log, an assessment workflow to decide scope and impact, and notification workflows so the right people draft, approve and send the required notices. Every step is time stamped, which matters when someone later asks what you knew and when.

Evidence the Board can review

Compliance that cannot be shown does not count for much. Boards, auditors, enterprise customers and, if it comes to it, the Data Protection Board will want to see records.

TrustOS keeps records, reports and evidence ready for review: consent histories, rights requests and response times, incidents and actions taken. When an audit comes, you produce the evidence from the system.

Processors and vendors

Most personal data you hold also sits with vendors: your CRM provider, payroll bureau, cloud host, marketing agency, call centre. Under the Act, you remain responsible as the data fiduciary for what your processors do with it. So each consent withdrawal, erasure request and breach has a vendor side. Keep a list of which vendors hold which data for which purpose, make sure contracts require them to act on your instructions and report incidents to you promptly, and record when you asked a vendor to act and when they confirmed. TrustOS keeps that trail alongside the request or incident it belongs to, so the evidence is complete.

How it fits with the rest of the work

TrustOS does not replace the thinking. You still need to map what personal data you hold, decide your lawful purposes, fix retention and agree contracts with processors. Our consulting division does that work with clients, and TrustOS then runs the recurring parts.

Two limits worth stating:

• If you are a small business with little personal data and few requests, a well kept register and a clear email process may be enough for now. A platform pays for itself as volume, systems and vendors grow.
• No platform makes you compliant on its own. It makes compliant behaviour easier to repeat and easier to prove.

Where to start

May 2027, the date as currently notified, is closer than it looks. Data mapping, consent redesign and vendor contracts take months in a company of any size. Start with your consent flows and rights request process, since those touch customers directly, then build breach response and evidence around them.