Risk 01 · Penalties
₹250 Cr
Maximum penalty for failing to protect personal data. Up to ₹200 crore for failing to report a breach or for children's-data violations. Even one unresolved complaint can trigger action.
DPDP Act 2023 · Done-for-you compliance programme
DPDP compliance,
DPDP compliance,
handled for you.
Cosmoura runs the end-to-end DPDP readiness programme for Indian businesses — gap check, documents, consent flows, vendor review, training — in 15–30 days. Fixed price. No software to learn.
—Days to enforcement
15–30Days to ready
FixedPrice, no hourly
3–4 hrsYour time, total
Does this apply to me?
If you keep anyone's personal details,
DPDP applies to you.
The DPDP Act covers any business that collects personal details of people in India — on paper, in Excel, in WhatsApp or in software. Size does not matter.
Customer, dealer or distributor lists with names and phone numbers
Employee records — Aadhaar, PAN, bank details, salary data
Student or parent details — admission forms, fee records, school apps
Patient records, prescriptions or appointment lists
CCTV cameras, visitor registers or biometric attendance
Website contact forms, WhatsApp business number or online orders
Vendors who handle your data — payroll agency, CA, software, SMS/WhatsApp provider
Why it matters
Why you shouldn't wait.
Risk 02 · Buyers
Customers and buyers will ask.
Large companies must check vendors handle data properly. If you supply to them, expect DPDP questions in purchase orders, contracts and audits. Being ready wins business.
Risk 03 · Rights
People now have rights.
Customers, parents, patients and employees can ask what data you hold, correct it or delete it — and you must respond. Without a process, one complaint reaches the Data Protection Board.
What you get
Ten deliverables.
One fixed engagement.
Cosmoura works with the dcomply platform and Decipher's AI team. Over 15–30 days you receive the artefacts your business needs — without you touching any software.
Gap check
Short call + questionnaire. We map what data you collect and where it sits.
Data map
Every place personal data lives in your business, one clear document.
Privacy notice
DPDP-format, plain language, English and Hindi.
Consent forms
Admission, enquiry, joining, order and visitor forms rewritten for DPDP.
Vendor review
List, risk-rate, Data Processing Agreement template.
Internal policy
Retention, access control, deletion — written for your team.
Breach plan
Step-by-step playbook including 72-hour regulator notification.
Rights process
"Show me / delete my data" handling with ready reply templates.
Staff training
One hour, Hindi or English, management or team.
Readiness report
Final document + Cosmoura readiness certificate.
How it works
Ready in 15–30 days. Here's how.
-
Day 0
Free gap call
20-minute call to understand your business and recommend a package.
Your effort · 20 min
-
Day 1–3
Kick-off
You fill a simple questionnaire; we collect sample forms and vendor list.
Your effort · ~1 hour
-
Day 3–12
We build
Data map, notices, consent forms, policies, vendor review.
Your effort · None
-
Day 12–15
Review
We walk you through everything; you approve.
Your effort · ~1 hour
-
Day 15–30
Go live
New forms in use, staff trained, report and certificate handed over.
Your effort · 1 hour
Total time from you: about 3–4 hours. We do the rest.
Packages & pricing
Fixed price. No surprises.
Starter
Small businesses up to 20 employees, simple operations.
₹25,000
Delivery · 15 days
- Gap check + data map
- Privacy notice (English + Hindi)
- Up to 3 consent forms updated
- Vendor list + DPA template
- Core policies + breach plan
- 1 staff training session
- Readiness report + certificate
Standard
20–100 employees, multiple locations or systems.
₹50,000
Delivery · 21 days
- Everything in Starter
- Up to 8 consent forms and touchpoints
- Vendor risk rating for up to 15 vendors
- Rights-request process + templates
- CCTV / biometric / visitor data review
- 2 training sessions
- 30 days post-launch support
Pro
Schools, hospitals, larger manufacturers, children's or sensitive data.
from ₹75,000
Delivery · 30 days
- Everything in Standard
- Children's data + parental consent setup
- Patient data handling setup
- Multi-location coverage
- Buyer DPDP questionnaire support
- 60 days post-launch support
+ 18% GST · GST invoice from Cosmoura Marketing Pvt Ltd · 50% to start, 50% on handover
Why Cosmoura
Why owners trust us with this.
We built the platform.
Our sister team created dcomply — India's DPDP-native compliance software with 81+ modules. We know the Act section by section.
We speak your language.
Plain Hindi or English. No jargon, no 80-page reports nobody reads.
Fixed price, fixed timeline.
You know the cost and the handover date before you pay a rupee.
7 years with Indian businesses.
Cosmoura has spent 7 years helping Indian founders run cleaner operations. DPDP is next.
Frequently asked
Questions owners ask us.
Q01 We are a small business. Does DPDP really apply to us?
Yes. The law has no minimum size. If you collect personal details of people in India, it applies.
Q02 When do we need to be compliant?
The DPDP Rules were notified in November 2025, and the main obligations apply from May 2027. Setting up takes time, so starting now is sensible.
Q03 We don't use any software. Our data is on paper and Excel.
DPDP covers digital data and paper data that gets digitised. Most businesses have both. We cover all of it.
Q04 Do we need to buy any software?
No. This is a done-for-you service. You get documents, forms and processes you can use without any software.
Q05 How much of our time will this take?
About 3–4 hours in total: one call, one questionnaire, one review and one training session.
Q06 Is this legal advice?
No. This is a compliance implementation service. For specific legal disputes, consult your own legal counsel.
Q07 We are a school. What's different for us?
Children's data has stricter rules. You need verifiable consent from parents, and tracking or targeted advertising directed at children is restricted. Our Pro package covers this fully.
Q08 What happens after the 15–30 days?
You keep everything. You can manage it yourself, or take our vDPO retainer from ₹2,499/month for ongoing support.
Q09 Do you work outside Delhi NCR?
Yes. Everything can be done online across India. On-site training is available in NCR and Haryana.
Next step
Find out where you stand.
Free. 20 minutes.
Book a free gap call. We'll tell you what DPDP means for your business, what needs fixing, and which package fits — no obligation.
- 011 min
You send this form
- 02≤ 1 day
We call to fix a time
- 0320 min
Gap call in Hindi or English
- 04Clear
You know exactly what to fix
This is a compliance implementation and documentation service provided by Cosmoura Marketing Pvt Ltd. It does not constitute legal advice. Penalty amounts and timelines are as per the DPDP Act 2023 and DPDP Rules 2025 and may change; refer to official notifications.