Most of the DPDP Act is a question about your code.
Notice, erasure, purpose limitation and security safeguards are all statements about what your software does. No amount of policy drafting answers any of them.
What the code can answer, and what it cannot.
Being honest about the second column is the point. A tool that claims to make you DPDP compliant is lying; a tool that tells you which obligations it can evidence, and evidences them, is useful.
Withdrawal means deletion. Can your code do it?
Every organisation says it honours withdrawal. Very few have checked whether a delete path exists for every field they hold. Scrutora looks for the code that would delete or export each one and tells you which fields have none, before someone asks.
On a real scan of a public banking platform, no delete or export path existed for a third of the personal-data fields it stored. That is not an unusual result.
Eighth Schedule languages, without a translation project.
The banner auto-translates to the visitor’s browser language. Hindi, Marathi, Gujarati, Tamil, Kannada, Telugu, Bengali, Malayalam and Punjabi ship pre-translated, and you can override any wording per language when your counsel wants their own phrasing.
Where §8(5) actually breaks.
An identifier written in the clear for debugging. The most common finding we raise, and the easiest to fix.
A store holding personal data with no encryption asserted, or a backup whose access control was widened and never narrowed.
A processor receiving more than it needs, or one nobody recorded as a recipient at all.
Seven safeguards. Each one has a page, and each one has a check.
The Rules are due by May 2027. Rule 6(1) lists the minimum technical controls a Data Fiduciary must show. For each one: what the clause asks for, what the code can evidence, and what it cannot.