What does a DPDP Act & CERT-In Compliance engagement cover in India?
Key takeaways
- Scope, price band and delivery date are agreed in writing before any testing starts.
- Every finding ships with a reproduction step and a concrete fix, not a tool name.
- A one-page plain-English summary is included so non-technical decision makers can act.
- A retest after remediation is included and lists each finding as closed, partial or open.
- The report states what was tested and what was not, so you know the limits of the result.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What does the engagement include?
Know exactly what you are required to do, and what you have not done yet. The concrete scope depends on your estate, and we set it out line by line in the rules-of-engagement document before we begin.
- Data inventory and mapping of what you hold, where it sits and who touches it
- Notice, consent and purpose-limitation gap review against the DPDP Act 2023
- Data principal rights request handling readiness
- Breach notification and incident logging process design
- Vendor and processor contract clause review
What will you receive?
- Data inventory and classification register
- Compliance gap register with owners and deadlines
- Draft notice, consent and policy text for counsel
- A prioritised 90-day and 12-month compliance roadmap
How does the engagement run?
The sequence matters more than the tools. A scoping call establishes what a useful test would cover, which is often a much smaller scope than the one first proposed. A written rules-of-engagement document then fixes the terms: every system, every date, the test window, the contact, and what is explicitly excluded. You sign it, we sign it, both sides keep it. Testing happens inside that window. Then the report, then the fixes, then the retest that marks each finding closed, partial or open.
| Stage | What happens | What you get |
|---|---|---|
| Scoping | A call and, where needed, a short technical discovery | A written scope and a fixed price band |
| Authorisation | Rules of engagement signed by both parties | A document for your legal and insurance files |
| Testing | Manual and AI-assisted testing inside the agreed window | A live finding log you can ask about at any point |
| Reporting | Technical report plus a one-page executive summary | Prioritised findings with reproduction steps and fixes |
| Remediation | Your team fixes, we answer questions during the work | Support while the fixes are in flight |
| Retest | We re-test what we raised | A retest certificate per finding |
What do you get, and when?
The deliverables are consistent across services, and that consistency is the point. Two vendors quoting you for different services should still be producing comparable artefacts, otherwise the comparison you are making is not a comparison at all.
| Deliverable | What it contains | When you get it |
|---|---|---|
| Written scope and rules of engagement | Every system, date, permitted technique and named contact | Before testing starts |
| Live finding log | Findings as they are raised, with severity | During the engagement |
| Technical report | CVSS scores, reproduction steps and fix guidance | At the end of testing |
| Executive summary | One page, written for a non-technical decision maker | With the technical report |
| Evidence pack | Request and response captures for every finding | With the technical report |
| Remediation support | Answers while your team applies the fixes | While the fixes are in flight |
| Retest certificate | Each finding marked closed, partial or open | After remediation |
How do you price it?
₹50,000 – ₹3,00,000 is the indicative band for a typical scope of this type. The final figure depends on the number of assets, the depth of authentication, the number of environments, and whether the engagement includes remediation support. We quote a fixed price, not an hourly one, and we confirm it in writing before work starts.
What are the common questions about this service?
Request a scoped quote for dpdp act & cert-in compliance
Send us the scope you have in mind: the number of applications, the number of users, the environments, and the deadline you are working to. You will get a fixed price and a start date.
Request a quote See pricingLast reviewed: 24 October 2026. Information on this page is general guidance, not legal advice. Prices are indicative bands for a typical scope and are confirmed in a written quote before any work begins.