For every organisation that handles personal data of people in India
If you collect names, phone numbers, e-mail addresses, Aadhaar or PAN numbers, payment details or health records in digital form, the DPDP Act applies to you. If you run IT systems in India, the CERT-In Directions do too.
By organisation
Startups and SMEs
You need to show customers and investors that personal data is handled properly, without a compliance team. TrustNiq gives you the inventory, the gaps and the evidence in days rather than months.
Growing and mid-size companies
Several clouds, many SaaS tools, vendors in other countries and customers sending security questionnaires. TrustNiq keeps DPDP, CERT-In, ISO 27001 and SOC 2 evidence in one place.
Large and Significant Data Fiduciaries
Banks, insurers, e-commerce, health, telecom and platforms with high volumes of sensitive data. Annual DPIAs, independent audits and a DPO accountable to the board need continuous evidence.
Data processors and IT services
Your clients are Data Fiduciaries and will pass their obligations to you by contract. Prove your safeguards, answer their questionnaires and publish a trust page.
Cloud, data centre and VPN providers
CERT-In adds specific duties, such as keeping validated subscriber records for five years. TrustNiq tracks those alongside the general directions.
Consultants and auditors
Run engagements on live evidence instead of screenshots, with read-only auditor access, frozen audit scope, reproducible samples, hashed evidence and an exportable audit package.
Fintech, payments and e-commerce
Card data, KYC documents and high transaction volumes. Track PCI DSS 4.0.1 alongside the DPDP Act and CERT-In, with one set of evidence for every assessor.
SaaS and IT exporters
Customers in the US, EU and UK ask for SOC 2, ISO 27001 and GDPR answers. Show them a live trust page and answer questionnaires from tested controls.
Teams preparing for certification
Getting ready for ISO 27001 certification or a SOC 2 audit: gap analysis, Statement of Applicability, policies, risk register and an audit workspace for your auditor.
By role
Data Protection Officer and privacy team
- Records of processing with purposes, lawful basis and retention
- Consent ledger and withdrawal tracking
- Data Principal requests on the 90-day clock
- DPIAs, notices and purpose-drift alerts
- Breach notification timelines and drafts
CISO and security team
- Continuous tests of identity, network, encryption, logging and backups
- CERT-In six-hour reporting, 180-day logs and time sync
- Vulnerabilities ranked by exposure and personal data at risk
- ISO 27001, SOC 2, NIST CSF 2.0 and PCI DSS posture
- Shadow AI and unregistered assets
Engineering and IT
- Findings arrive in Jira, ServiceNow or Slack with the exact resource and fix
- A re-test button instead of a follow-up meeting
- Read-only connectors; nothing changes without you
- API access for consent and request events
Leadership and board
- A posture summary with trends, not a traffic-light guess
- Top risks with owners and due dates
- A Board pack PDF generated from live results
- Evidence that obligations are being met when regulators ask
Compliance and GRC manager
- Framework library with a setup wizard
- Gap analysis turned into owned gap tasks
- Statement of Applicability with approved exclusions
- Policy approvals, reviews and acknowledgements
- Risk register with treatment and acceptance
Internal and external auditors
- Read-only auditor accounts
- Scope frozen when fieldwork starts
- Evidence requests, samples and observations in one place
- The state of any control as of a past date
- Hash-verified evidence and audit trail
Questions
Does the DPDP Act apply to small businesses?
The Act applies to processing of digital personal data within India, and to processing outside India connected with offering goods or services to people in India. It does not exempt organisations by size, although the government can exempt classes of Data Fiduciaries, including startups, from some provisions by notification.
We are a data processor for our clients. Is TrustNiq useful?
Yes. Your clients remain responsible as Data Fiduciaries and will ask you for evidence: security safeguards, breach notification ability, deletion on instruction and sub-processor control. TrustNiq produces that evidence and answers their security questionnaires from it.
We also need ISO 27001, SOC 2, GDPR or PCI DSS. Do we need another tool?
No. Those frameworks can be activated in TrustNiq alongside the DPDP Act and CERT-In. Controls are shared, so evidence collected once counts towards every framework it maps to, and policies, risks, the Statement of Applicability and audits are managed in the same place. You add each framework as an add-on when you need it.
What is a Significant Data Fiduciary?
A Data Fiduciary the Central Government notifies as significant, based on factors such as the volume and sensitivity of personal data and risk to the rights of Data Principals. It must appoint a Data Protection Officer based in India, an independent data auditor, and carry out periodic DPIAs and audits.
See your compliance posture on your own systems
DPDP, CERT-In, ISO 27001, SOC 2 and more. Connect one cloud account and one identity directory in a 14-day trial. No card needed.