1. The Problem

The Digital Personal Data Protection Act, 2023 (DPDP Act) and its accompanying Rules, 2025 represent a paradigm shift in how Indian businesses must handle personal data. Every Data Fiduciary — from an e-commerce startup to a large healthcare provider — now faces obligations around consent, data principal rights, breach notification, third-party agreements, and potential Significant Data Fiduciary (SDF) classification.

For Chartered Accountants advising clients across industries, this creates a new and unfamiliar compliance frontier:

1. No structured tool exists to rapidly assess a client's DPDP readiness
2. Section-by-section analysis of the Act is time-consuming and requires specialized knowledge
3. Drafting the required compliance documents (consent notices, privacy policies, DPAs, grievance officer letters) from scratch is inefficient
4. Managing compliance status across multiple clients lacks a centralised view
5. Clients — especially SMEs — have no accessible starting point to understand their obligations

Penalties under the Act reach up to ₹250 crore for a single breach event. The compliance gap is not merely a legal risk — it is a financial and reputational one. CAs are uniquely positioned to help clients navigate this, but need the right tools to do so efficiently.

2. The Solution — DPDP Compass

DPDP Compass is a standalone, browser-based AI compliance tool built for Chartered Accountants. It transforms a 5-step client questionnaire into a full DPDP gap report, drafts compliance documents, and tracks assessment status across an entire client portfolio — all within a single HTML file requiring no installation, no backend server.

2.1 How It Works

A CA enters client details across five structured steps covering organisation basics, data categories collected, consent and notice practices, data principal rights, and SDF indicators. On submission, the tool calls the Claude AI API via a Make.com webhook — returning a customised compliance gap report within 20–40 seconds, analysed against specific sections and rules of the DPDP Act.

2.2 Core Modules

2.3 Key Technical Highlights

1. Zero-install: delivered as a single HTML file — open in any browser, share via email or USB
2. AI-powered via Claude (Anthropic): responses are contextual, section-accurate, and industry-specific
3. SDF auto-detection: flags Significant Data Fiduciary risk signals based on data volume, sensitivity, and national reach
4. In-browser editing: reports and documents are fully editable before print or download
5. Word export: gap reports and drafted documents download as .rtf (Word-compatible) with structured formatting
6. Persistent storage: client history, reports, and drafted documents saved locally across sessions

3. Real-World Use Case Walk-Through

Consider a CA advising Zesto Foods Pvt Ltd, an e-commerce platform with over 5 lakh customer records, a mobile app, and third-party payment and logistics partners:

1. Step 1 — Input: The CA opens DPDP Compass and completes the 5-step form in under 5 minutes
2. Step 2 — Report: The tool returns a CRITICAL risk-rated report identifying gaps: no written consent notice, no withdrawal mechanism, no DPAs with vendors, and SDF indicators triggered by data volume
3. Step 3 — Documents: DPDP Compass auto-identifies required documents and drafts a Consent Notice, Privacy Policy, and Data Processing Agreement — tailored to Zesto Foods' e-commerce profile and data categories
4. Step 4 — Delivery: The CA edits each document, saves, and downloads as a Word file for client delivery — within the same session
5. Step 5 — Tracking: Zesto Foods is logged in the Client Tracker with CRITICAL status; the CA revisits post-remediation to run a fresh assessment and track improvement

4. Value Delivered

1. Compress hours of research into minutes
2. Offer DPDP compliance as a new advisory service line
3. Deliver client-ready documents without drafting from scratch
4. Manage and demonstrate compliance progress across all clients
5. Plain-language understanding of DPDP obligations
6. Immediate identification of penalty-risk gaps (up to ₹250 Cr)
7. Ready-to-use compliance documents tailored to their business
8. Actionable remediation roadmap, not just gap identification

5. Why This Matters for the Profession

DPDP Compass is built by a CA, for CAs — with a deep understanding of how practitioners actually work with clients. It is not a generic compliance checklist; it is a contextual AI engine that understands the difference between an e-commerce platform and a healthcare provider, and generates guidance accordingly.

As the DPDP Act moves into enforcement, the profession needs tools that keep pace. DPDP Compass demonstrates that AI can be responsibly and practically deployed in the CA's workflow — reducing risk for clients, adding value to the advisory relationship, and opening a new service line for practitioners who are ready to lead on data protection compliance.