Section 6(10) puts the burden of proof on you. Safexa finds the personal data you hold, governs how it is used, and keeps evidence that holds up the day the Data Protection Board asks — built for India's law, not adapted from Europe's.
Live illustration of the evidence spine. Every event is hashed, batched and externally timestamped.
The DPDP Rules, 2025 were notified on 13 November 2025. Consent Manager registration opens on 13 November 2026, and the substantive obligations — notice, consent, rights, security, breach reporting, retention, children's data — commence on 13 May 2027.
The work that takes longest is the work nobody can shortcut: finding where personal data actually sits, rebuilding consent so it is purpose-specific, and retrofitting nomination and grievance into systems that were never designed for them. Those are quarters of work, not weeks.
Compliance fails in the joins — the discovery scan that never reaches the consent record, the withdrawal that never reaches the vendor, the breach report that cannot name a number. Safexa is one system so the joins are not yours to build.
Every vendor in this market puts their product behind a demo request. Ours is a link. Open the Safexa console, sign in as a Data Protection Officer at a general insurer, and work a real queue — 14,283 consent records, live statutory clocks, an open breach with the 72-hour report half-written.
The global platforms are excellent GDPR products with an India module mapped on top. That mapping is where the specifically Indian obligations go missing.
| Obligation | A GDPR platform with an India module | Safexa |
|---|---|---|
| Notice in 22 Eighth Schedule languages s.5(3) | Usually treated as a localisation backlog item. English and Hindi ship; the rest is "on request". | All 23 as first-class templates. A purpose served in a language with no registered template is raised as a finding, not silently downgraded. |
| Right to nominate s.14 | No GDPR equivalent, so there is nothing to map. Commonly absent entirely. | A nominee record on the data model from the start, with a verified activation path. |
| Verifiable parental consent s.9 + Rule 10 | Mapped to GDPR Article 8, which sets a different bar and no due-diligence requirement. | Rule 10 as written: age assurance, guardian identification, and the evidence that both happened. |
| Rule 7 breach report s.8(6) | GDPR's 72-hour Article 33 shape, which asks for different fields and has no CERT-In equivalent. | The eight prescribed Rule 7 fields, the six-hour CERT-In filing, and your sectoral intimation from one incident record. |
| Burden of proof s.6(10) | GDPR's accountability principle is broader and softer. Records are kept; provability is not the design goal. | The entire architecture is built backwards from this section. Append-only journal, verbatim notice storage, external timestamp anchoring. |
| Data residency | Often US or EU primary, with India as a region option at extra cost. | ap-south-1 only. Primary, standby, backups and keys. No cross-border transfer. |
Comparison describes the general architecture of platforms built for GDPR and extended to India. Individual vendors differ; evaluate against your own requirements.
We publish the full obligations map — every section and Rule, what it actually requires, the maximum penalty, and which part of Safexa addresses it. Including the ones we do not address, because a vendor who claims to cover everything is telling you something about their honesty rather than their product.
Penalties are per contravention and cumulative. The Board weighs gravity, duration, repetition, remedial action taken, and the gain made or loss avoided.
Not a roadmap. Not on request. Every one of them, as a first-class notice template.
Not a lead-capture quiz that returns "you scored 6/10, book a call". It returns a prioritised gap list mapped to the specific section or Rule you are exposed on, with the reason each one matters. No email required to see the result.
No, and it is worth being precise about this because the market confuses the two constantly.
A Consent Manager is a specific entity registered with the Data Protection Board that acts as a single point of contact for a Data Principal across many Data Fiduciaries, is accountable to her rather than to any company, must run a consumer-facing website or app, must not be able to read the data being shared, and must hold a net worth of at least ₹2 crore. Registration opens on 13 November 2026, so no entity in India holds it today.
Safexa is a Data Processor under Section 8(2). It processes personal data on your documented instructions, under contract with you. Under Section 8(1) you remain responsible for that processing. A vendor claiming Consent Manager status today is either mistaken or hoping you will not check.
No. Section 16 is a negative-list regime — transfer outside India is permitted except to countries the Central Government restricts. There is no general localisation mandate in the Act.
Localisation obligations come from elsewhere: IRDAI for insurers, RBI for banks and payment systems, and often from your own board policy. Safexa holds everything in ap-south-1 regardless, because for regulated Indian customers the sectoral requirement is the binding one.
If DPDP is one obligation among GDPR, CCPA and a global privacy programme, you probably should not. A single global platform is the right answer when the reporting line is global.
Where Safexa fits is the organisation for which DPDP is the obligation — Indian BFSI, insurance, health, telecom and consumer platforms, where the notice is in Marathi, the regulator is IRDAI as well as the Board, and nomination and grievance are real product requirements rather than mapping exercises. Some customers run both: the global platform for the group programme, Safexa for the Indian entity where the specifics bite.
Discovery connectors and a first scan: days. A working consent flow on one purpose, one channel and two languages: weeks. A full programme across every purpose, channel and downstream system: quarters — and anyone quoting you a fixed 90 days without having seen your estate is quoting a number, not an estimate.
The long pole is almost never the software. It is deciding what your purposes actually are, getting notice text through legal review, and getting downstream systems to honour a withdrawal webhook.
You get the full journal as a signed, self-verifying export — the records, the notice text as presented, the Merkle inclusion proofs and the RFC 3161 timestamp tokens. It verifies without Safexa existing, which is the whole design intent of anchoring to an external authority rather than to us.
Your consent evidence has to outlive your vendor relationship. A platform that holds it hostage has misunderstood what it is for.
Safexa is built by Teknowxa Solutions Pvt. Ltd., an Indian company. We publish our architecture, our legal position and our limitations in more detail than is comfortable, because in a compliance purchase the vendor's own rigour is part of what you are buying.
Not "what does DPDP require" — you can read that on this site. Bring the one your counsel and your CTO disagree about. Those are the conversations worth having before you buy anything.
Or email safexa@teknowxa.com directly — a person reads it.