Know where personal data lives. Prove it is protected.
TrustNiq tests DPDP and CERT-In controls on live evidence from your cloud, identity, databases and code, finds personal data such as Aadhaar and PAN numbers, and keeps fixes moving until an automated re-test proves them. The same evidence covers ISO 27001, SOC 2, NIST CSF 2.0, GDPR and PCI DSS.
No card needed · Read-only connections · Data residency in India by default
Compliance built on spreadsheets fails at the first audit
The DPDP Act asks you to know what personal data you hold, why, where it goes and how it is protected, and to show it. CERT-In expects a reportable incident on its desk within six hours. Questionnaires and self-assessments cannot keep up with systems that change every day.
Unknown data
Customer exports in open storage, Aadhaar numbers in a test database, logs in another country. You cannot protect what you have not found.
Claims without evidence
"MFA is enforced" is a statement. The list of accounts without it, taken from your directory this morning, is evidence.
Deadlines measured in hours
Six hours to report to CERT-In, and a detailed report to the Data Protection Board within 72 hours of learning of a personal data breach.
From discovery to proof, continuously
Connect
Read-only connections to AWS, Azure, Entra ID, Okta, Google Workspace, GitHub and your databases.
Discover
An inventory of systems, identities and datasets, with personal data classified column by column.
Test
Controls mapped to DPDP sections, DPDP Rules and CERT-In directions, tested on the evidence collected.
Fix
Findings with owners and due dates, sent to Jira, ServiceNow or Slack, closed only by a passing re-test.
Prove
Hashed evidence, a tamper-evident audit trail, Board reports and audit packages on demand.
One platform for privacy and security obligations
Personal data discovery
Classifies columns and files for names, contacts, Aadhaar, PAN, card and bank numbers, with a human review queue for uncertain matches.
Automated control testing
Encryption, public exposure, MFA, dormant accounts, log retention, backups, clock sync and more. Missing evidence shows as unknown, never as a pass.
Privacy operations
Consent ledger with withdrawal tracking, Data Principal requests on a 90-day clock, notices, records of processing and DPIAs.
Incident clocks
CERT-In six-hour and DPDP breach timelines tracked per incident, with draft reports prepared from what the platform already knows.
Vendors and contracts
Reads DPAs and certificates, flags missing clauses and expiring evidence, and lets vendors upload documents through an expiring link.
Frameworks, questionnaires and trust
The same evidence mapped to ISO 27001, NIST CSF 2.0, SOC 2, GDPR and PCI DSS, suggested answers for customer security questionnaires, and a public trust page.
India first, every framework on one set of evidence
Start with the DPDP Act and CERT-In, then add ISO 27001, SOC 2, NIST CSF 2.0, GDPR or PCI DSS without collecting the same evidence twice. One control library serves every framework you activate.
Framework library
DPDP Act, DPDP Rules, CERT-In, ISO 27001:2022, NIST CSF 2.0, SOC 2, GDPR and PCI DSS 4.0.1. A setup wizard recommends frameworks from your sector, customers and data, and explains why.
Unified controls
One control tested once counts towards every framework it maps to. Add your own controls and mappings; attested controls are labelled apart from tested ones.
Statement of Applicability
Applicability, justification, status and owner per requirement. Exclusions need an approver. Issue a frozen, hashed SoA and export it for your auditor.
Policy library
Versioned policies with maker-checker approval, review dates and acknowledgement tracking by audience, linked to the controls they support.
Risk register
Risks raised from failing tests or entered by people, rated by likelihood and impact, with treatment plans, owners, review dates and approved acceptance.
Gap analysis
Every requirement that fails, is unknown or is not covered, prioritised with a next step, and turned into owned gap tasks with due dates.
Audit workspace
Scope frozen at fieldwork, evidence requests, reproducible samples, observations and auditor sign-off, with the final report kept as hashed evidence.
Document sources
Policies and procedures pulled read-only from Google Drive, SharePoint and Confluence, refreshed when they change at source.
One set of evidence, the view each role needs
Board, CISO, DPO and auditor see the same measured results, each with the work that is theirs.
Data Principal requests on the clock
- Every rights request shows its 90-day deadline, identity check and tasks across systems and processors
- Consent ledger with withdrawals tracked until each downstream system confirms
- Records of processing, DPIAs, and a review queue for uncertain personal data matches
- Ask the platform which systems hold Aadhaar numbers, with references you can open
Findings that close only on proof
- Each finding explains what failed, why it matters, the evidence and the requirement it maps to
- Owners and due dates, tickets in Jira or ServiceNow, and a re-test button instead of a follow-up meeting
- Severity weighed by the personal data at risk and the exposure of the system
- CERT-In six-hour and DPDP clocks per incident, with draft reports ready
Evidence an auditor can check
- Every evidence item hashed at collection, with integrity verified each time it is read
- Read-only auditor accounts and an audit workspace with frozen scope, samples and observations
- The state of any control as the platform knew it on a past date
- A hash-chained audit trail you can verify at any time
Every result shows its working
Auditors and the Data Protection Board will not accept a green tick. TrustNiq keeps the configuration snapshot, query result or signed-off attestation behind every status, hashed at the moment it was collected.
- SHA-256 hash for every evidence item and file
- Hash-chained audit trail you can verify at any time
- Findings close only after an automated re-test passes
- Exceptions need an approver, a reason and an expiry date
Built for the way Indian organisations are regulated
- Controls mapped to DPDP Act sections and DPDP Rules
- CERT-In Directions: 6-hour reporting, 180-day logs in India, NIC/NPL time sync, point of contact
- High-risk Indian identifiers: Aadhaar, PAN, passport, bank and card numbers
- Significant Data Fiduciary duties: DPO, annual DPIA and audit, algorithmic due diligence
- Regulatory summaries marked for legal review until checked against the Gazette
Guides to the DPDP Act and CERT-In
Practical, sourced explanations for DPOs, CISOs and founders.
Significant Data Fiduciary obligations: DPO, DPIA, audit
Significant Data Fiduciary duties under the DPDP Act: a DPO in India, an independent auditor, annual DPIA and audit, and algorithmic due diligence.
2 min readGovernanceShadow AI and personal data: governing AI tools under DPDP
Pasting customer data into AI tools is processing under the DPDP Act. How to find shadow AI, what AI vendors need, and an AI governance checklist.
2 min readGovernanceMapping DPDP to ISO 27001 and SOC 2: collect evidence once
How DPDP and CERT-In obligations map to ISO 27001:2022, NIST CSF 2.0 and SOC 2, and how to use one control library and one set of evidence.
2 min readQuestions
What does TrustNiq do?
TrustNiq connects to your cloud accounts, identity directories, databases and code repositories, finds where personal data sits, and tests the controls the DPDP Act 2023, DPDP Rules 2025 and CERT-In Directions expect. Every result links to the evidence it was based on, and gaps become tracked findings that close only after an automated re-test. Around that evidence it runs the rest of your compliance programme: frameworks, policies, risks, the Statement of Applicability, audits, privacy operations, incidents, vendors and customer trust.
Which frameworks besides the DPDP Act does TrustNiq support?
ISO 27001:2022, SOC 2, NIST CSF 2.0, GDPR and PCI DSS 4.0.1 can be activated alongside the DPDP Act, DPDP Rules and CERT-In Directions. One control library serves every framework, so evidence collected once counts towards each framework it maps to. Each additional framework is an add-on, so you pay only for the ones you need.
Does using TrustNiq make us DPDP compliant?
No software can make an organisation compliant on its own. TrustNiq shows where you stand, what is missing and what to fix first, and keeps the evidence your auditors, Board and regulators will ask for. Decisions about legal interpretation remain with your DPO and legal advisers.
When do DPDP obligations apply?
The DPDP Rules 2025 were notified on 14 November 2025 with an eighteen-month phased rollout. Most Data Fiduciary obligations apply from May 2027, and the Consent Manager framework from November 2026. The CERT-In Directions of April 2022 already apply.
Is there a free trial?
Yes. The 14-day trial needs no card and lets you connect up to two systems, scan up to five data stores and run full assessments with up to three colleagues.
See your compliance posture on your own systems
DPDP, CERT-In, ISO 27001, SOC 2 and more. Connect one cloud account and one identity directory in a 14-day trial. No card needed.