# TrustOS

> TrustOS is a DPDP Act compliance platform for organisations in India. It maps your personal data, runs notices, consent, rights requests, erasure and breach response as assigned work, and keeps the evidence ready for review.

TrustOS is a product of Code Colonies Private Limited. Contact: consulting@codecolonies.com, +91 97234 99901. It does not replace legal advice. Statements of the law are as of October 2026.

Full text of the key pages and the facts: https://dpdpatrustos.com/llms-full.txt. Feed of guides and articles: https://dpdpatrustos.com/feed.xml.

## Platform
- [Data inventory](https://dpdpatrustos.com/platform/data-inventory): Data inventory records each system that holds personal data, the fields it keeps, the purposes it serves and the vendors who can reach it. Every other module in TrustOS reads from it, so a notice, an erasure task or a breach assessment starts from the same facts.
- [Purposes and notices](https://dpdpatrustos.com/platform/purposes-and-notices): Purposes and notices keeps a register of every reason you process personal data, with its ground, data categories and retention period. Notices are built from that register, approved by legal, versioned and published in the languages your customers read.
- [Consent](https://dpdpatrustos.com/platform/consent): Consent keeps one record per person, purpose and notice version, from every channel where you ask. When someone withdraws, TrustOS tells each system that relies on that consent and records which ones confirmed.
- [Privacy Centre](https://dpdpatrustos.com/platform/privacy-centre): The Privacy Centre is the part of TrustOS your customers, patients or students use. They read your privacy information, change their consents, raise requests and grievances, nominate someone, and see where each request stands.
- [Rights and grievances](https://dpdpatrustos.com/platform/rights-and-grievances): Rights and grievances brings requests from the Privacy Centre, email, branches and support tools into one queue. Each request is verified, assigned, worked across systems and closed with a reply and the evidence behind it.
- [Retention and erasure](https://dpdpatrustos.com/platform/retention-and-erasure): Set a retention period for each purpose, with the law or business reason behind it, and let TrustOS raise erasure work when that period ends. Legal holds, tax records and other exceptions are recorded, so nothing is deleted that should stay and nothing stays that should go.
- [Connectors and actions](https://dpdpatrustos.com/platform/connectors-and-actions): Connectors link TrustOS to the systems that hold personal data, within permissions you set. They search for a person's records, carry out approved actions such as erasure or correction, and confirm the result, including the cases that only partly worked.
- [Breach response](https://dpdpatrustos.com/platform/breach-response): Open an incident the moment personal data may be affected, record when you became aware, and work through scoping, containment and notices with every step timed. TrustOS keeps the intimation to affected people and the Board, and the detailed report due within 72 hours, in one record.
- [Processors and assessments](https://dpdpatrustos.com/platform/processors-and-assessments): Keep a register of every processor, what data it receives and the contract terms that govern it, with reviews on a schedule. Run impact assessments for risky processing, including the yearly assessment a Significant Data Fiduciary owes, and track the fixes they lead to.
- [Evidence and audit](https://dpdpatrustos.com/platform/evidence-and-audit): Every task in TrustOS ends with evidence attached, so proof is gathered as the work happens. When an auditor, the board or the Data Protection Board asks, you assemble an evidence pack for a period or a question, and it can be verified cryptographically.

- [The Privacy Centre](https://dpdpatrustos.com/privacy-centre): the page people use to see their choices, raise requests and grievances, nominate and track status
- [Evidence](https://dpdpatrustos.com/evidence): what evidence TrustOS keeps for each duty and how a review is answered
- [Roles](https://dpdpatrustos.com/roles): what the Data Protection Officer, Privacy manager or privacy office, Legal counsel, Security lead, IT and engineering, Operations and customer service each do in TrustOS

## Free tools (indicative only; they are not legal advice)
- [Breach clock](https://dpdpatrustos.com/tools/breach-clock): Enter when you became aware of a breach. See the 72 hour deadline for the detailed report to the Board, the CERT-In 6 hour window, and what to do in each.
- [Penalty exposure and readiness score](https://dpdpatrustos.com/tools/dpdp-penalty-exposure): Describe your organisation, your data and the controls that run today. See which heads of the DPDP Schedule apply, their ceilings in rupees, a readiness score and the gaps to close first.
- [Privacy notice checker](https://dpdpatrustos.com/tools/notice-checker): Tick what your privacy notice contains against what the Act and Rules ask. Get the gaps, each with the fix and the provision behind it.
- [Request deadline planner](https://dpdpatrustos.com/tools/request-deadlines): Enter the date a request arrived and its type. See your own targets and the 90 day outer limit for grievances under Rule 14.
- [DPDP readiness score](https://dpdpatrustos.com/assess): Nine statements about how your DPDP work runs today. Get a score, a band and the gaps to look at first.

## Films
- [All films](https://dpdpatrustos.com/films): short films for organisations by sector, and for partner firms
- The TrustOS partner programme (for partner firms, 68 seconds): Why CA, CS and compliance firms are adding DPDP work for their clients, and how the partner programme works.
- Your clients are asking (for partner firms, 16 seconds): Fifteen seconds on the questions clients are already bringing to their advisers.
- Clinics, labs and hospitals (for organisations, 65 seconds): Patients trust you with their health. What the DPDP Act asks of a clinic, and how proof for audits becomes everyday work.
- Guide your healthcare clients (for partner firms, 60 seconds): For firms that advise doctors, labs, nursing homes and hospitals on their DPDP duties.
- Schools, colleges and coaching centres (for organisations, 72 seconds): Student and parent data, children's consent, and what an education provider needs in place before the duties apply.
- Guide your education clients (for partner firms, 60 seconds): For firms that advise schools and education groups on DPDP readiness.
- Lenders and NBFCs (for organisations, 67 seconds): Loan applications, KYC files and collections calls: the DPDP Act for lenders, and how TrustOS keeps the record.
- Guide your lending clients (for partner firms, 60 seconds): For firms that advise NBFCs and lenders on consent, requests and breach response.
- IT and SaaS companies (for organisations, 66 seconds): Customer data in your product and your clients' data in your care: what the Act asks of software companies.
- Guide your IT and SaaS clients (for partner firms, 60 seconds): For firms that advise software and IT services companies on DPDP work.
- Online stores and D2C brands (for organisations, 63 seconds): Every order starts at checkout. Shopper data, partner contracts and breaches, for online stores.

## Comparisons
- [TrustOS or spreadsheets and email for DPDP work](https://dpdpatrustos.com/compare/spreadsheets-and-email): When a spreadsheet and a shared inbox are enough for DPDP Act work, and where they start to strain: requests, withdrawal, erasure, breaches and evidence.
- [TrustOS or a consent only tool for the DPDP Act](https://dpdpatrustos.com/compare/consent-only-tools): What a consent or cookie banner tool covers under the DPDP Act, what it leaves out, and how the two can work together. A fair comparison.
- [TrustOS or building DPDP compliance tools in house](https://dpdpatrustos.com/compare/building-it-yourself): When building your own DPDP workflows makes sense, what it really takes to build and keep up, and the middle path of self hosting with source code.

## The DPDP Act explained
- [DPDP Act timeline: when each part applies](https://dpdpatrustos.com/dpdp-act/timeline): When the DPDP Act and the DPDP Rules, 2025 apply, phase by phase, with the dates as notified and what could still change.
- [Rights of Data Principals under the DPDP Act](https://dpdpatrustos.com/dpdp-act/rights-of-data-principals): The rights the DPDP Act gives individuals: access, correction, completion, updating, erasure, grievances and nomination, and how to handle requests.
- [Notice and consent under the DPDP Act](https://dpdpatrustos.com/dpdp-act/notice-and-consent): What a DPDP notice must cover, what valid consent looks like, how withdrawal works, and where consent is not the right basis.
- [Personal data breach notification under the DPDP Rules](https://dpdpatrustos.com/dpdp-act/breach-notification): Who to tell after a personal data breach under the DPDP Rules, how fast, and the 72 hour detailed report to the Board.
- [Children's personal data under the DPDP Act](https://dpdpatrustos.com/dpdp-act/childrens-data): Verifiable parental consent, the ban on tracking and targeted ads aimed at children, and what it means for schools, edtech and consumer apps.
- [Significant Data Fiduciaries: who they are and what they must do](https://dpdpatrustos.com/dpdp-act/significant-data-fiduciaries): How the government notifies Significant Data Fiduciaries and the extra duties: an India based DPO, an independent auditor, yearly DPIAs and audits.
- [Consent Managers under the DPDP Act](https://dpdpatrustos.com/dpdp-act/consent-managers): What a Consent Manager is, who can register with the Data Protection Board, the 2 crore rupee net worth test, and what it means for Data Fiduciaries.
- [DPDP Act penalties: the Schedule explained](https://dpdpatrustos.com/dpdp-act/penalties): The maximum penalties in the Schedule to the DPDP Act, from 10,000 rupees to 250 crore rupees, and how the Data Protection Board decides the amount.
- [Legitimate uses: processing without consent under section 7](https://dpdpatrustos.com/dpdp-act/legitimate-uses): The closed list of legitimate uses in section 7 of the DPDP Act, where you can process personal data without consent, with examples and limits.
- [Who the DPDP Act applies to](https://dpdpatrustos.com/dpdp-act/who-it-applies-to): Which organisations and which data the DPDP Act covers, including processing outside India, and what section 3 leaves out.
- [Data Protection Officers and contact persons under the DPDP Act](https://dpdpatrustos.com/dpdp-act/data-protection-officer): The contact person every Data Fiduciary must publish, the DPO a Significant Data Fiduciary must appoint, and the auditor and DPIA duties around it.
- [Transferring personal data outside India under the DPDP Act](https://dpdpatrustos.com/dpdp-act/cross-border-transfers): How section 16 of the DPDP Act handles transfers outside India, how sector rules such as RBI payment data storage still apply, and what to record.
- [Data retention and erasure under the DPDP Act](https://dpdpatrustos.com/dpdp-act/retention-and-erasure): When the DPDP Act requires you to erase personal data, the three year rule for large platforms, the 48 hour notice and what processors must do.
- [Reasonable security safeguards under the DPDP Act and Rules](https://dpdpatrustos.com/dpdp-act/security-safeguards): What section 8(5) and the DPDP Rules expect for security safeguards, from encryption and access control to logs kept for a year.
- [Working with Data Processors under the DPDP Act](https://dpdpatrustos.com/dpdp-act/data-processors): Why you stay responsible for your vendors under the DPDP Act, the valid contract section 8(2) requires, and what the contract should cover.
- [DPDP Act and GDPR: the main differences](https://dpdpatrustos.com/dpdp-act/dpdp-and-gdpr): A plain comparison of the DPDP Act and the GDPR for teams that already run a GDPR programme, covering grounds, children, rights, breaches and penalties.
- [The Data Protection Board of India](https://dpdpatrustos.com/dpdp-act/data-protection-board): What the Data Protection Board of India does, how complaints reach it, voluntary undertakings, and appeals to the Appellate Tribunal within 60 days.
- [DPDP Act glossary: the terms in plain English](https://dpdpatrustos.com/dpdp-act/glossary): Plain English meanings of the key terms in the DPDP Act and the DPDP Rules, 2025, from Data Fiduciary to Consent Manager.

## Industries
- [Banking and NBFCs](https://dpdpatrustos.com/industries/banking-and-nbfc): Loan data passes through many hands. Keep track of every one.
- [Insurance](https://dpdpatrustos.com/industries/insurance): Health and claims data needs firmer limits than a sales lead
- [Fintech and payments](https://dpdpatrustos.com/industries/fintech-and-payments): Products ship weekly. Your consent records need to keep up.
- [Healthcare](https://dpdpatrustos.com/industries/healthcare): Patient records outlive the visit. Know who can see them and why.
- [Telecom and digital platforms](https://dpdpatrustos.com/industries/telecom-and-digital-platforms): Millions of users, one standard for how each is treated
- [E-commerce and D2C](https://dpdpatrustos.com/industries/ecommerce-and-d2c): From the WhatsApp order to the courier label, know where customer data goes
- [Education](https://dpdpatrustos.com/industries/education): Most of your learners are children. The Act treats them that way.
- [Software and IT services](https://dpdpatrustos.com/industries/software-and-it-services): Your clients will ask how you handle their data. Have the answer ready.
- [BPO and professional services](https://dpdpatrustos.com/industries/bpo-and-professional-services): You handle other people's customers. Show you handle them carefully.
- [Government services](https://dpdpatrustos.com/industries/government-services): Citizen data held for public services, handled with the same care

## Guides
- [Choosing where to begin](https://dpdpatrustos.com/blogs/choosing-where-to-begin): Most DPDP programmes stall because the whole Act looks like one project. A short assessment tells you which area to start with, who owns it and what the first phase should leave behind.
- [Configuring for the data environment you have](https://dpdpatrustos.com/blogs/configuring-for-the-data-environment-you-have): A sector example saves you from the blank page. It describes a typical organisation, and TrustOS earns its place once it uses your service names, your systems, your vendors and your owners.
- [Connecting TrustOS to the systems you already run](https://dpdpatrustos.com/blogs/connecting-trustos-to-the-systems-you-already-run): An erasure that someone says they did is weaker evidence than one the system itself confirms. TrustOS connectors are scoped, approved and checked, and systems without a connector are still covered.
- [Meeting Significant Data Fiduciary obligations](https://dpdpatrustos.com/blogs/meeting-significant-data-fiduciary-obligations): A Significant Data Fiduciary needs a Data Protection Officer in India, an independent data auditor, yearly impact assessments and audits, and a review of its algorithmic software. Each duty takes time to set up, and the order of preparation matters.
- [Running TrustOS on your own infrastructure](https://dpdpatrustos.com/blogs/running-trustos-on-your-own-infrastructure): A compliance platform holds personal data, so where it runs is itself a compliance decision. Deploying TrustOS inside your own environment keeps the platform and its records under your control, and hosting remains the better choice for some organisations.
- [Coordinating a breach from detection to closure](https://dpdpatrustos.com/blogs/coordinating-a-breach-from-detection-to-closure): A personal data breach starts two notification duties and a 72 hour report, all counted from when you became aware. That work runs best from one shared incident record.
- [Executing retention and erasure across systems](https://dpdpatrustos.com/blogs/executing-retention-and-erasure-across-systems): A retention schedule changes nothing until something acts on it. Set periods you can defend, reach every copy, handle legal holds and backups, and record what was actually deleted.
- [Giving each team the view it needs](https://dpdpatrustos.com/blogs/giving-each-team-the-view-it-needs): No serious DPDP duty sits inside one department. TrustOS gives each team a view of the same underlying record, so handovers become assigned work and nobody has to reconcile three lists.
- [Linking purposes to grounds and notices](https://dpdpatrustos.com/blogs/linking-purposes-to-grounds-and-notices): Under the DPDP Act almost everything follows from the purpose you process data for. A purpose register keeps the ground, the notice versions and the retention rule moving together.
- [Mapping the personal data you hold](https://dpdpatrustos.com/blogs/mapping-the-personal-data-you-hold): Almost every DPDP duty assumes you know where personal data sits. A useful inventory records the right details, finds the copies people forget and stays current as systems change.
- [Preparing evidence for review and audit](https://dpdpatrustos.com/blogs/preparing-evidence-for-review-and-audit): Management, internal auditors, enterprise customers and the Data Protection Board all ask for evidence, and each wants something different from the same records. Records kept as the work happens let you assemble a package for any of them.
- [Recording consent and acting on withdrawal](https://dpdpatrustos.com/blogs/recording-consent-and-acting-on-withdrawal): A consent record is only useful if your systems read it. Capture the right details when someone agrees, make a withdrawal reach every system, and prepare for registered Consent Managers.
- [Reviewing processors and assessing impact](https://dpdpatrustos.com/blogs/reviewing-processors-and-assessing-impact): You stay answerable for personal data your vendors hold for you. That calls for an accurate processor list, the contract terms that matter, regular reviews, and impact assessments that lead to real changes.
- [Taking a Data Principal request to closure](https://dpdpatrustos.com/blogs/taking-a-data-principal-request-to-closure): Every rights request under the DPDP Act comes down to finding one person's data across all your systems and acting on it. The work runs in six steps: intake, identity checks, search, decisions, action and response.
- [Turning an obligation into assigned work](https://dpdpatrustos.com/blogs/turning-an-obligation-into-assigned-work): A privacy policy says what you intend. It does not say who does the work, whether it is done, or how anyone would check. TrustOS moves each duty from requirement to responsibility, action and evidence.

## Articles
- [Meeting the reasonable security safeguards](https://dpdpatrustos.com/articles/breach-under-the-dpdp-act/meeting-the-reasonable-security-safeguards): Rule 6 of the DPDP Rules sets out what reasonable security safeguards means. Each measure has a practical form in an ordinary Indian company's systems and vendor contracts.
- [Discovering a personal data breach](https://dpdpatrustos.com/articles/breach-under-the-dpdp-act/discovering-a-personal-data-breach): You can only report what you can see. Detection rests on what the DPDP Act counts as a breach, the logs Rule 6 asks for and how those logs are monitored, and the moment of awareness needs a timestamp.
- [Reporting to the Board and your users](https://dpdpatrustos.com/articles/breach-under-the-dpdp-act/reporting-to-the-board-and-your-users): After a personal data breach you owe two sets of notices: one to the people affected and two to the Data Protection Board. Each has required contents, and the work has to fit inside the 72 hour window.
- [Preparing for registered Consent Managers](https://dpdpatrustos.com/articles/consent-under-the-dpdp-act/preparing-for-registered-consent-managers): Registered Consent Managers will let people give, review and withdraw consent across many companies from one place. Most of the work to receive that consent happens inside your own systems.
- [Handling the personal data of children](https://dpdpatrustos.com/articles/consent-under-the-dpdp-act/handling-the-personal-data-of-children): Under the DPDP Act everyone under 18 is a child. You need a parent's verifiable consent first, and some processing stays off limits whatever consent you hold.
- [Processing under the legitimate uses](https://dpdpatrustos.com/articles/consent-under-the-dpdp-act/processing-under-the-legitimate-uses): Section 7 of the DPDP Act lets you process personal data without consent in a short, closed list of situations. A business will rely on only a few of them, and each needs a record of the ground used.
- [The engineering work inside the DPDP Act](https://dpdpatrustos.com/articles/dpdp-act-in-practice/engineering-work-inside-the-dpdp-act): Most DPDP Act commentary is written by lawyers for lawyers. Six of its core duties end up as databases, scheduled jobs and logs that your teams have to build and run.
- [When systems cannot do what the policy promises](https://dpdpatrustos.com/articles/dpdp-act-in-practice/when-systems-cannot-do-what-the-policy-promises): A complete set of privacy documents says what you intend. The DPDP Act judges what your systems actually do. The gap between the two can be found and measured.
- [Building DPDP Act compliance that survives an audit](https://dpdpatrustos.com/articles/dpdp-act-in-practice/building-dpdp-act-compliance-that-survives-an-audit): An examiner does not ask whether you have a retention policy. They pick a data category and ask to see proof it was deleted. A programme built in the right order can answer.

## Company
- [Deployment](https://dpdpatrustos.com/deployment): self hosted with source code handover, or hosted in India
- [Implementation](https://dpdpatrustos.com/implementation)
- [Security](https://dpdpatrustos.com/security)
- [Partner programme](https://dpdpatrustos.com/partners)
- [Gap assessment](https://dpdpatrustos.com/assess)
- [DPDP readiness checklist](https://dpdpatrustos.com/dpdp-readiness-checklist): nine areas and 36 checks, with the provision behind each and the evidence to keep
- [Book a demo](https://dpdpatrustos.com/contact)