DPDP asks what your systems actually do. Xyla answers it from the code.
Policies, consent records and vendor agreements prove the process. They cannot show whether a code path erases on request, gates a write on consent, or moves personal data across a border without a safeguard. That question is only answerable by reading the software.
- 13 May 2027
- when the substantive obligations take effect
- ₹250 Cr
- maximum penalty per contravention
- 13
- DPDP finding categories in the engine
- 5
- independently scored with precision and recall
Seven obligations. Some are met by a document; the rest by the software.
Section and Rule numbers are given so you can check each one against the Act rather than take our word for it.
- 01Section 8(4) / Rule 6
Reasonable security safeguards
Encryption, access control and logging proportionate to the personal data being processed.
- 02Sections 5–6 / Rule 3
Notice and consent
Free, specific, informed consent through clear affirmative action, with withdrawal as easy as giving it.
- 03Sections 11–14 / Rule 14
Data principal rights
Access, correction, completion, updating and erasure, with a route to grievance redressal.
- 04Section 8(6) / Rule 7
Breach notification
Notify affected data principals and the Data Protection Board on becoming aware of a breach.
- 05Section 8(7) / Rule 8
Retention and erasure
Erase personal data once the specified purpose is no longer served, unless retention is required by law.
- 06Section 16 / Rule 15
Cross-border transfer
Transfers outside India must satisfy the restrictions the central government notifies.
- 07Section 9 / Rules 10–12
Children's data
Verifiable parental consent before processing a child's data, and no behavioural tracking.
An obligation board, including the row we could not answer
Coverage is reported as a count with its denominator, never as a percentage. A single number invites a comparison the underlying data does not support.
Rule 6(1)provenPersonal data written without encryption
names the database column, with the write path attached
Rule 6(2)partialProcessing without recorded consent
consent gating proven on 3 of 7 write paths
Section 16provenCross-border transfer without a safeguard
walks the data-flow path looking for a residency check
Section 13not coveredGrievance officer contact published
repository-level — there is no line to cite, so none is offered
Section 13 is repository-level. The engine cannot point at a line, so it does not pretend to — the row says so rather than offering a plausible location. Volunteering the gap is the point.
We supply evidence. The auditor concludes.
- Reads the repository into a semantic graph and traces personal data from entry to sink
- Names the exact database column a finding concerns, not a file guess
- Walks a cross-border path looking for a residency safeguard
- Produces an evidence pack with per-Section citations
- States, per obligation, what it did not check and why
- Issue a certification, or return a verdict of compliant
- Process personal data — it reads source code, nothing else
- Publish a compliance score or a coverage percentage
- Replace your consent manager, DPIA workflow or grievance process
- Claim coverage of an obligation the engine has no detector for
Xyla is not a certification body and no code path lets it sign its own evidence. Section and Rule references above are provided for orientation, not as legal advice — confirm your obligations with counsel.
