Data Privacy & GDPR Compliance
Data privacy compliance under India's DPDP Act and the EU GDPR — data mapping, notices, consent, policies and breach response.
- Estimate Cost
- ₹50,000 – ₹5,00,000
- Typical duration
- 30 days
Service overview
- Data privacy compliance ensures your business collects, uses, stores and transfers personal data lawfully
- This service covers the EU General Data Protection Regulation (GDPR) and India's Digital Personal Data Protection (DPDP) Act, 2023, and builds trust with customers and partners
Who needs it? / When is it needed?
- Indian businesses serving EU or UK customers, or processing their data (IT, BPO, SaaS, e-commerce, healthcare).
- Any business processing personal data of Indian users under the DPDP Act.
- When entering contracts that require privacy compliance, or after a data breach.
What to expect from the WCP Professionals
- Data mapping and gap assessment.
- Drafting of privacy notices, consent and cookie mechanisms.
- DPIAs, records of processing and vendor assessments.
- Advice on cross-border transfers (SCCs or BCRs), DPO appointment, breach response plans and data subject rights processes.
- Staff training.
Key deliverables
- Data inventory and gap report.
- Privacy policy, consent notices and internal policies.
- DPIA reports and transfer mechanisms.
- Breach response plan and training.
Standard turnaround time
- Assessment: 2–4 weeks.
- Full implementation: 2–4 months, depending on size.
- GDPR breach notification: within 72 hours of becoming aware.
Government fees, timelines & key outcomes
- No registration fee in most cases.
- GDPR fines can reach EUR 20 million or 4% of global turnover.
- DPDP penalties can go up to Rs 250 crore per instance.
- Key outcome: lawful data handling and lower regulatory risk
Forms & filings involved
- Records of processing activities.
- DPIA documentation.
- Data processing agreements and SCCs.
- Breach notifications to authorities and data subjects, when required.
Documents required
- Details of data collected, systems and vendors.
- Existing privacy policies and contracts.
- IT security measures.
- Organisational chart.
What we need from you
- Management commitment and a designated privacy owner.
- Access to IT and business teams.
- Implementation of technical controls.
Important conditions
- Compliance is ongoing, as laws and guidance evolve.
- DPDP Rules are being implemented in phases.
- Technical security implementation may require IT specialists.
Additional information
- Annual privacy audits are recommended.
- Related services: ISO 27001 Information Security Management, AML & KYC Compliance.
The estimated cost covers indicative professional fees only. Government fees, stamp duty and taxes are payable at actuals.
How it works
- 1. Raise a service enquiry describing your requirement.
- 2. A Relationship Manager reviews it and opens it for bidding.
- 3. Pay into escrow and assign the professional you select.
- 4. Track progress to completion, then accept and release payment.
Frequently asked questions
What is the DPDP Act?
India's Digital Personal Data Protection Act, 2023, which governs processing of digital personal data, with rules being phased in.
What are the penalties under the DPDP Act?
Up to ₹250 crore per instance for failures such as not taking reasonable security safeguards.
When does GDPR apply to an Indian business?
When it offers goods or services to people in the EU or monitors their behaviour, regardless of where it is based.
What does a privacy programme include?
Data mapping, privacy notices, consent and rights processes, vendor contracts, security controls and breach response.