Question 1

Is DPDPA compliance mandatory for SMBs?

Accepted Answer

Yes. The DPDPA 2023 applies to all "Data Fiduciaries" - any person or entity that determines the purpose and means of processing personal data. Size exemptions are limited and subject to government notification. All businesses handling Indian citizens' personal data must comply.

Question 2

What is DPDPA compliance, and does your business need it?

Accepted Answer

If you collect, store, or process personal data of Indian citizens - including customers, patients, students, or employees - the DPDPA 2023 applies to you. Non-compliance carries statutory penalties up to ₹250 Crore per violation instance.

Question 3

Should I get DPDPA compliance before the rules are notified?

Accepted Answer

Yes. Businesses that begin compliance early reduce remediation costs and eliminate the panic and penalties that come with rushed implementation. Early adoption also signals security maturity and earns trust from enterprise clients and partners.

Question 4

What is the DPDPA Penalty Checker?

Accepted Answer

The DPDPA Penalty Checker is a free interactive tool by Kryptasys that calculates your business's statutory fine exposure under India's Digital Personal Data Protection Act 2023 in under 5 minutes across all 10 statutory violation categories.

Question 5

How much does DPDPA compliance cost with Kryptasys?

Accepted Answer

The Free tier covers basic gap detection. Starter (₹4,999/month) includes 5 forensic PII scans and a full compliance report. Business pricing is custom for unlimited scans, continuous monitoring, and multi-entity coverage.

Question 6

What is Kryptasys, and who founded it?

Accepted Answer

Kryptasys is an Indian cybersecurity company founded by Vivek Kumar, a cybersecurity researcher who trained under the Gurugram Cyber Police (GPCSSI program). It builds evidence-driven DPDPA compliance tools for Indian businesses.

Question 7

What does Kryptasys do?

Accepted Answer

Kryptasys builds DPDPA 2023 compliance automation tools and digital forensics infrastructure for Indian businesses. Its flagship product, DPDP Shield, replaces subjective checklists with forensic evidence mapping and penalty risk scoring up to ₹250 Crore.

Question 8

Is Kryptasys affiliated with the Government of India?

Accepted Answer

No. Kryptasys is an independent private cybersecurity company. It is not affiliated with the Government of India or the Data Protection Board of India.

Question 9

Which industries does Kryptasys serve?

Accepted Answer

Kryptasys builds products for Indian SMBs and enterprises across sectors including private schools, healthcare clinics, logistics firms, fintech startups, SaaS platforms, and e-commerce companies that process customer, patient, or employee data.

Question 10

What is forensic PII detection?

Accepted Answer

Forensic PII detection (built into DPDP Shield) scans your log files locally in your browser to identify personal data exposure - such as Aadhaar patterns, PAN numbers, email addresses, phone numbers, and UPI virtual payment addresses - before an auditor or regulator asks for proof.

Question 11

How does Kryptasys verify compliance - not just report it?

Accepted Answer

Most compliance tools ask you to tick subjective questionnaire boxes. Kryptasys maps your operational controls to verifiable forensic evidence - consent logs, access audit trails, and documented processor agreements - so your readiness score is provable to auditors.

Question 12

What does a Kryptasys compliance report contain?

Accepted Answer

Each report covers six comprehensive sections: Executive Summary, Legal Compliance Matrix (covering all 61 DPDPA checkpoints), Gap Analysis, Priority Action Plan ranked by penalty risk, Evidence Appendix, and a signed Prepared By verification page.

Question 13

Does Kryptasys store our sensitive customer data or source code?

Accepted Answer

No. Kryptasys operates on a strict client-side isolation model. Raw logs, source code, and database schemas are processed entirely in your browser or local environment - zero raw logs or sensitive data ever leave your infrastructure.

Question 14

How does DPDP Shield differ from generic compliance checklists?

Accepted Answer

Generic tools provide subjective questionnaires without verification. DPDP Shield pairs every compliance checkpoint with verifiable evidence, audit trails, and automated rights portal workflows with legal SLAs (such as 48-hour erasure notice tracking and 90-day grievance resolution).

Frequently Asked Questions

Still have questions?