Find your way to DPDP-ready on Salesforce, before the deadline finds you.
Consent, notices, data-principal rights, erasure and security safeguards, built inside the Salesforce you already run. Choose Essentials on your current licences, or Shield+ when your data needs it. We'll tell you honestly which one.
The law says May. Your project plan says February.
DPDP doesn't ask whether you have a privacy policy. It asks whether your systems can prove what you did with each person's data. Building that proof into Salesforce takes weeks, and budget cycles take longer.
DPDP Rules notified; Data Protection Board set up
Consent Managers can register
Last comfortable start for a Shield+ rollout
Last comfortable start for Essentials
Notice, consent, safeguards, breach reporting, rights and erasure all apply
Six things DPDP changes inside Salesforce
And how digiDPDP Compass handles each one, natively and with evidence your DPO can show.
Notice before consent
Clear notice in English or any of the 22 Eighth Schedule languages, versioned.
Compass: multilingual notice manager; the version shown is stored with every consent.
Consent per purpose
No bundling. Withdrawal as easy as giving consent, and it must stop processing.
Compass: one toggle per purpose, a tamper-evident consent ledger, instant opt-out sync.
Data-principal rights
Access, correction, erasure, nomination and grievance, within your published timelines.
Compass: a public rights portal with email OTP, SLA tracking and one-click access exports.
Erasure when the purpose ends
Delete or anonymise data you no longer need, with prior notice where the Rules require it.
Compass: a retention engine with a 48-hour notice, re-checks and an audit log.
Security safeguards
Encryption or masking, access control, monitoring, backups, and logs kept for a year.
Compass: native hardening (Essentials) or Shield Event Monitoring and Encryption (Shield+).
72-hour breach reporting
A detailed report to the Data Protection Board within 72 hours, and notice to affected people.
Compass: access evidence, a breach runbook and a compliance dashboard ready for the call.
How DPDP-ready is your Salesforce?
Eight yes/no questions. You'll get a readiness score and the Compass flavour that fits. Nothing is sent until you choose to book.
Start with a Check. Go live with the flavour that fits.
Every engagement starts with a fixed-fee Compass Check that ends with a Shield-fit score, so you never pay for licences you don't need.
Compass Check
Every organisation. The fixed-fee starting point.
- Salesforce org scan and personal-data map
- Rule-by-rule DPDP gap report
- Shield-fit score and licence advice
- Costed go-live roadmap
Compass Essentials
B2B and mid-market orgs. DPDP-ready on the licences you already own.
- Consent ledger and multilingual notices
- Data-principal rights portal
- Retention and erasure engine
- Native security hardening and a 1-year log archive
- Compliance dashboard and team training
Compass Shield+
BFSI, insurance, healthcare and large B2C. The highest assurance.
- Everything in Essentials
- Shield Event Monitoring with 1-year retention
- Platform Encryption on sensitive fields
- Field Audit Trail and Data Detect
- Privacy Center, Data Mask & Seed, Backup & Recover where they fit
Compass Care
After go-live. Stay compliant and audit-ready.
- Rights-request operations
- Quarterly access reviews and evidence pack
- Release impact checks
- Breach drills with your DPO
Do you need Salesforce Shield for DPDP?
DPDP doesn't name any product. It requires "reasonable security safeguards": encryption or masking, access control, monitoring logs, backups, and logs kept for a year. Whether Shield is the right way to meet them depends on your data, not the deadline.
Strong fit Shield+ makes sense if…
- You hold financial, health or government-ID data in Salesforce
- You have lakhs of customer records or hundreds of users
- You may be designated a Significant Data Fiduciary
- You need to show who viewed or exported which record, for a full year
Often enough Essentials may do if…
- You mainly hold business contact data
- You have a few thousand records and a small user base
- Developers don't work in full-copy sandboxes
- Your risk team accepts native controls plus a 1-year log archive
Every Compass Check ends with a written Shield-fit score. We recommend Shield only where it's justified.
Maximum penalties under the DPDP Act
These are ceilings per breach, decided by the Data Protection Board. What counts as "reasonable" will be judged on the evidence you can produce.
Source: Digital Personal Data Protection Act, 2023, Schedule. This page is general information, not legal advice.
From first call to evidence pack
Discover
A 45-minute call with a DPDP-on-Salesforce consultant. We confirm scope and the Check plan.
Compass Check
Org scan, data map, gap report, Shield-fit score and a costed roadmap in 3 weeks.
Build & go live
Essentials or Shield+, configured in your org, tested, and handed over with training.
Prove & sustain
Dashboards, quarterly evidence packs and breach drills with Compass Care.
Questions we hear every week
We're a B2B company. Does DPDP apply to us?
Yes. DPDP covers digital personal data of individuals, including the names, emails and phone numbers of business contacts. B2B orgs usually have a smaller footprint, which is why Essentials often fits.
Salesforce is secure. Doesn't that make us compliant?
Salesforce acts as your processor; you are the Data Fiduciary. The platform gives you the tools, but consent records, notices, rights handling, retention and access monitoring have to be configured and run by you.
When exactly is the deadline?
The DPDP Rules were notified on 13 November 2025. Consent Manager provisions apply from 13 November 2026, and most Data Fiduciary obligations from 13 May 2027.
Do we have to buy Shield or Privacy Center?
No law requires a specific product. The Compass Check scores whether Shield or Privacy Center is justified for your data. If it isn't, Essentials delivers DPDP capability on your current licences.
We use Marketing Cloud, Data Cloud or a website outside Salesforce. Is that covered?
Yes. Compass publishes every consent change as an event and exposes an API, so withdrawals reach Marketing Cloud, Data Cloud, your website and other systems.
Is this legal advice?
No. We implement the technical and operational controls. We work alongside your counsel or DPO, who confirms notice text, purposes and retention periods.
Get a clear DPDP plan for your Salesforce org
Tell us a little about your org. A DPDP-on-Salesforce consultant will reply within one business day to set up a 45-minute discovery call.
- ✓Fixed fee, 3 weeks, credited if you proceed
- ✓Rule-by-rule gap report your DPO can sign off
- ✓An honest Shield-fit score, with no licence push
- ✓Go-live roadmap that lands before 13 May 2027
Prefer to talk now? +91 88891 23457 · sales@digicloudsolns.com