Partner with us on DPDP. You keep the client. We build the controls.
DPDP compliance needs three kinds of work at once: legal judgement, engineering inside the client's systems, and ongoing operations. Few firms do all three. We are the engineering and implementation team, and we work best alongside the people who already advise the client.
Your client
Stays yours, always
Legal opinions
Never from us
Confidentiality
Mutual NDA first
Exclusivity
Not required
Billing
Each firm bills its own work
DPDP is a legal question with an engineering answer. Most clients need both.
A lawyer can say what a notice must contain, what counts as valid consent and how long records must be kept. Someone then has to change the sign-up flow, record every consent, make deletion reach every database and vendor, keep a year of access logs and rehearse a breach against the 72-hour clock. That is the part we do, so your advice turns into something the client can prove.
You keep the judgement
Interpretation, legal opinions, contracts, regulator engagement and disputes stay with the client's counsel.
We do the build
Data mapping, consent records, rights requests, deletion, security safeguards, breach drills and the evidence pack.
The client gets proof
One evidence pack that shows the regulator, auditors and big customers what is in place, with evidence that it works.
Partners across legal, audit, security and technology
If your clients are asking about DPDP, there is probably a fit. These are the collaborations we are set up for.
Law firms and in-house legal teams
You advise on the law and draft notices and contracts. We map the data, build the controls and produce the evidence your advice depends on.
- Joint assessments
- Implementation after your gap opinion
- Technical input for breach notices
CA, CS and audit firms
Your clients ask you about compliance first. We take on the DPDP assessment and build, and give you a clear status to report on.
- Readiness assessments for your clients
- Evidence you can review
- Summaries for the client's board of directors
Cybersecurity, VAPT and SOC providers
You find and monitor the risks. We handle the DPDP-specific work: notices, consent, rights, deletion, one-year logs and breach notices to the regulator.
- Breach response with your incident team
- Log retention and access records
- Shared client roadmaps
ISO 27001, SOC 2 and GRC consultancies
Much of your control work carries over. We map it to the DPDP Act and close the gaps that certification frameworks do not cover.
- DPDP gap mapping on existing controls
- Implementation under your programme
- Delivery under your brand where agreed
Consent, privacy and security software vendors
Your product captures consent or handles requests. We connect it to the client's real systems so deletion and withdrawal actually reach everywhere.
- Implementation partner for your customers
- Integration with client databases and vendors
- Joint DPDP readiness offers
Cloud providers, MSPs and system integrators
You run the infrastructure and applications. We add the DPDP layer: data map, retention, logging, rights workflows and breach readiness.
- DPDP add-on for managed services
- Sub-contracted implementation
- Hosting and transfer documentation
SaaS platforms and marketplaces
Your customers become data fiduciaries on your platform. We help you build tenant-level privacy controls once, so every customer benefits.
- Platform-level controls
- Processing terms for your customers
- DPDP kits for your users
Industry bodies, accelerators and incubators
Your members and startups need a practical starting point. We run workshops and readiness clinics in plain language.
- Workshops and clinics
- Member readiness checks
- Free guides you can share
Cyber insurers and brokers
DPDP penalties and breach costs change the risk you cover. We provide readiness assessments that give you and your clients a clear picture.
- Pre-cover readiness assessments
- Breach readiness drills
- Remediation plans
Who does what, when we work with your firm
Clear lines from day one, so nobody steps on anyone's work and the client sees one joined-up programme.
| Work | Your firm | DPDP Ready |
|---|---|---|
| Reading of the Act for this client | Leads and decides | Provides the facts about data and systems |
| Lawful basis for each purpose | Decides | Maps every purpose and data flow |
| Notice wording and privacy policy | Drafts and approves | Supplies the itemised data list and builds the notice into the product |
| Contracts with vendors and customers | Drafts and negotiates | Provides the vendor register and technical schedules |
| Data map and role map | Reviews | Builds |
| Consent records, rights, deletion, logs | Reviews the outcome | Builds and tests |
| Breach response | Advises on notices and liability | Runs the technical response and the 72-hour report data |
| Regulator and disputes | Represents the client | Supplies evidence on request |
Three simple ways to collaborate
Introduce
Lightest touch
- You introduce a client who needs implementation
- We scope and propose directly, with you copied if you like
- Each firm contracts and bills the client separately
- You stay the client's adviser throughout
Deliver together
Joint programme
- One combined plan: your legal workstream and our build workstream
- Shared kick-off, status reviews and evidence pack
- Clear split of responsibilities, agreed per client
- Separate contracts, or prime and sub-contractor, as suits the client
Build for you
Your programme, our engineers
- We deliver the implementation inside your engagement
- Under your brand where agreed in writing
- Your methodology and reporting, our engineering
- Capacity planned with you ahead of May 2027
Ground rules we commit to in writing
Referring a client is a matter of trust. These are the terms every partnership starts from.
Start a conversation- Your client stays yoursWe do not pitch competing services to clients you introduce, during the work or for 12 months after it.
- No legal advice from usWe are an implementation team. Legal questions go back to you.
- Confidential from the first callA mutual NDA before you share any client name or detail.
- No exclusivity, no lock-inStart with one client. Continue only if it works for both sides.
- Clean commercialsEach firm bills the client for its own work. Any terms between us are agreed in writing before the first introduction.
- You see what we deliverShared scope, status reviews and the same evidence pack the client gets.
From first call to first joint client
30 minutes, no preparation
Before any client detail
One client or one workshop
Only if both want to continue
Technology partnerships, too
DPDP Ready is the privacy practice of Mirav Labs, which builds and runs production software. That opens up wider collaboration.
- Security and incident readinessCERT-In logging and six-hour incident reporting, alongside DPDP breach response.
- Multi-tenant SaaS and platformsPrivacy-by-design architecture for products that hold many customers' data.
- Systems for regulated sectorsSoftware for telecom, banking, healthcare and commerce, built with their compliance reviews in mind.
- Content and trainingOur guides, checklist and status tracker are free to cite and share with your clients.
Deepak Mittal
Practice lead, DPDP Ready · Founder, Mirav Labs
25 years building telecom, payments and SaaS platforms, including the early technology platform at Paytm and Credence at Oorja (ACL, now Sinch, acquired the business). Partnership conversations usually start with him.
Before you reach out
Will you approach our client for legal work or other services?
No. We do not give legal opinions, and we do not pitch services that compete with yours to clients you introduce, during the work or for 12 months after it. Legal questions that come up during implementation go back to you.
Do you pay or ask for referral fees?
Each firm contracts with and bills the client for its own work. Any referral or co-delivery terms are agreed in writing before the first introduction.
Do we need to sign an exclusive agreement?
No. Most partnerships start with one client or one joint workshop under a mutual NDA, and a simple written agreement follows only if both sides want to continue.
Can you work under our brand?
For implementation work delivered through consultancies, auditors and integrators, yes, if agreed in writing. We will not appear as a law firm or hold ourselves out as giving legal advice under any brand.
What if the client already has a law firm or a consent tool?
That is the usual case. We work alongside the existing counsel and connect to the tools the client already uses, rather than replacing them.
Tell us a little about your practice
No client names needed at this stage. We aim to reply within one working day to set up a 30-minute intro call, and send a mutual NDA before anything confidential is discussed.
- Prefer email?support@d2c.in
- Prefer WhatsApp?+91 96502 10909