Data governance that is measured, not assumed.
A governance cycle that runs inside the platform — with a DPDP workspace built on the same governed data, so privacy obligations are evidenced, not just documented.
Seven steps, one continuous loop.
Each step is a working screen in the platform with an owner, a measure and an audit trail.
One view of your data estate.
Governance becomes a score management can track, rather than a binder of policy no one reads.
- Classification at column level. Public, internal, confidential or restricted — with personal data tagged. It drives masking, retention and who may see what.
- Quality as a number. Rules run across the data and produce a score, with the failing records listed for correction.
- Accountability by name. Every dataset has a steward. A RACI matrix maps each data domain to the people responsible.
- Policy tied to law. A policy library mapped to the instruments it implements, from the IT Act to national data-sharing and geospatial policies.
Classification column level
| Column | Class | Tag |
|---|---|---|
| mobile_number | Restricted | PII |
| vendor_tax_id | Restricted | PII |
| contract_value | Confidential | — |
| survey_chainage | Internal | — |
| ward_code | Public | — |
Policy library 6 policies in force
Privacy obligations, run as workflows.
Built around the Digital Personal Data Protection Act and Rules, and connected to the catalogue, so personal data is found, not guessed at.
- Processing record. Each activity with its data, lawful basis, recipients and retention period.
- Notice and consent. Consent stored in a tamper-evident ledger. Withdrawal is as easy as giving consent.
- Rights requests. Access, correction and erasure tracked against their statutory clocks, with the steward in the loop.
- Breach, processors, impact. Breach logs and reporting workflow, processor agreements, impact assessments and certified destruction.
- Personal-data scanner. Finds personal data in tables, and records every reveal.
Readiness against the Act and Rules
Rights requests time remaining
| Request | Status | Due in |
|---|---|---|
| Access | Open | — |
| Correction | In review | — |
| Erasure | Awaiting steward | — |
Consent ledger tamper-evident
| Time | Purpose | Status |
|---|---|---|
| 10:42 | Service updates | Granted |
| 10:37 | Programme survey | Granted |
| 10:21 | Service updates | Withdrawn |
| 09:58 | Programme survey | Granted |
Breach response simulation
Governance, security and privacy — together.
A gap in one becomes exposure in the others. We design them as a single framework.
Corporate governance
Board-level direction and monitoring, IT general controls and maturity scoring, aligned to COBIT 2019 and audit expectations.
Information security
Controls, incident reporting and log retention, aligned to ISO/IEC 27001 and national cyber directions. See assurance →
Privacy compliance
Consent, records of processing and data-principal rights, aligned to the DPDP Act and ISO/IEC 27701.
Framework first. Vendor-neutral.
Technology comes after a documented study — so every decision stands up to audit.
System study
Map infrastructure and data flows; classify every data asset; build a risk register.
Policy framework
Classification and access policies, incident response plan and a DPDP-aligned consent framework.
Specification
A technology specification based on confirmed gaps only, ready for competitive procurement.
Continuous monitoring
Quarterly reviews, a board data dashboard and an annual audit cycle.
Know where you stand, before you buy anything.
An independent data and privacy gap study shows what you hold, what is exposed and what to do first.