DPDP Act security testing for your personal data safeguards
The DPDP Act asks data fiduciaries to protect personal data with reasonable security safeguards, but it does not name penetration testing, and a security test is one way to show whether your safeguards hold. BERRY9 tests the web apps, APIs, mobile apps and cloud storage where your personal data lives, by hand from Hyderabad, and reports each finding with a proof of concept, a CVSS 3.1 score and a fix in a remediation matrix.
- Tests start from
- INR 27,000 + 18% GST
- What we test
- Technical safeguards
- Legal advice
- From your counsel
- Delivery
- Remote from Hyderabad
Last reviewed
Access control: whether one user, role or tenant can read another's personal data.
Encryption: whether personal data crosses the network or sits on a device in clear text.
API exposure: whether responses carry more personal data than the screen that asked for them.
Logging: whether access to personal data leaves a record your team can find.
01 / What the Act asks
What the DPDP Act asks of your security
The Digital Personal Data Protection Act, 2023 sets duties for anyone who processes digital personal data in India, and for processing outside India connected with offering goods or services to people in India. Its security duty is short and general, which leaves each organization to decide what reasonable means for its own systems.
Who carries the duty
The Act calls whoever decides why and how personal data is processed a data fiduciary. The data fiduciary stays responsible for that data even when a data processor handles it on its behalf.
Reasonable security safeguards
Section 8 asks a data fiduciary to protect the personal data in its possession or under its control by taking reasonable security safeguards to prevent a personal data breach. The Act does not list those safeguards, and it does not name penetration testing.
Breaches are reported
If a personal data breach happens, the data fiduciary must inform the Data Protection Board of India and each person affected, in the form and manner the Rules prescribe.
Some fiduciaries carry more
The government can notify a data fiduciary as a Significant Data Fiduciary. Such a fiduciary must appoint a Data Protection Officer based in India and an independent data auditor, and carry out periodic data protection impact assessments and audits.
The Digital Personal Data Protection Rules made under the Act describe the safeguards in more detail, naming measures such as encryption or masking, access control, and logs that help detect unauthorized access. The Schedule to the Act sets penalties, including for failing to take reasonable security safeguards. Which provisions apply to you, and from when, is a question for your counsel; read the current text on the government's own site rather than a summary.
What BERRY9 is, and is not. BERRY9 tests technical safeguards. We are not a law firm and do not give legal advice, we do not issue a DPDP compliance certificate, and we do not act as your Data Protection Officer. A penetration test is also not the independent data audit a Significant Data Fiduciary needs.
02 / Safeguards and evidence
What a security test shows about your safeguards
A penetration test cannot tell you whether you comply with the Act. What it can show is whether the technical controls guarding personal data hold up when someone tries to get around them. The table pairs each safeguard area with what we check, what the report records and where the test stops.
| Safeguard area | What the test checks | Evidence in the report | What it cannot show |
|---|---|---|---|
| Access control | Whether each role, account and tenant you give us can reach only its own records, including by changing record numbers in requests | Each broken access rule as a finding, with the request that proved it and the fix | Roles and accounts that were not in scope |
| Encryption in transit | Transport encryption on the web, API and mobile endpoints in scope, cleartext channels, and whether the mobile app checks certificates | Weak or missing transport encryption listed per endpoint, scored with CVSS 3.1 | Channels between systems the test cannot reach |
| Encryption at rest, as far as a test can see | Personal data left readable in mobile app storage, in backups or files reachable over the network, and in cloud storage open to the internet | Where readable personal data was found and how it was reached | Database or disk encryption settings, unless cloud accounts are in scope |
| Personal data in APIs | Fields an endpoint returns beyond what the app displays, lists that can be pulled in bulk, and error messages that leak records | The endpoint, the request and the extra fields returned, for your developers to trim | Endpoints the test was not told about or could not discover |
| Logging and detection | Whether sign-ins, failed access attempts and admin actions during the test leave a record you can find afterwards | The engineering report's reproduction steps, to compare with what your logs recorded | Log retention, monitoring staff or your incident process |
| Exposed secrets and services | Keys and credentials in app binaries or front-end code, and debug or admin interfaces open to the internet | Each exposure with its location, its severity and the fix | Systems outside the agreed scope |
This table is a planning aid, not a promise. A clean area means the test found no issue there; it does not show that your safeguards are reasonable under the Act, which is a judgment for you and your counsel.
03 / Scoping
Scope the test around where personal data lives
Start from the data, not from the network diagram. Wherever personal data is collected, stored, shown or sent belongs on the list, including systems a vendor runs for you.
Show details for Scope the test around where personal data lives
Web applications
Sign-up forms, profiles, dashboards and admin consoles: the screens where customers and staff enter, view and export personal records.
APIs
The endpoints behind your app, partner integrations and webhooks, which often return personal data in bulk and are easy to miss in a data map.
Mobile apps
Android and iOS apps that cache names, phone numbers, health or payment details on the device, and the traffic they send to your servers.
Cloud storage
Buckets, blob containers, database snapshots and backups, where a single wrong permission can put a whole customer table online.
Processors and vendors
Systems a data processor runs for you remain your responsibility under the Act, but testing them needs the vendor's written permission, so ask early.
Children's data
If children use your service, put the parental consent flow in scope. Section 9 asks for verifiable consent from a parent before a child's personal data is processed.
Bring these to the scoping call:
- A list of systems that hold personal data. A data map, a records register or a plain spreadsheet will do; it tells us where to look first.
- The kinds of personal data. Contact details, identity numbers, health, financial or children's data, so the riskiest stores are tested first.
- Test accounts for each role. At least two accounts per role, so we can check whether one user can see another's data.
- Environments. Whether testing runs against production, staging or both, and whether staging holds real personal data.
- Vendor permissions. Written consent from any processor or hosting provider whose systems are in scope.
- Who approves the rules of engagement. The person who signs off on what testing may and may not touch.
04 / Deliverables
What you receive after a DPDP Act security test
All six items come with every BERRY9 test. The reports serve two readers: the engineers who fix what was found, and the privacy or compliance lead who keeps the record that it was fixed.
Show details for What you receive after a DPDP Act security test
- An executive report that explains in plain language which personal data was exposed and how much it matters to the business, for your leadership and privacy team.
- An engineering report with reproduction steps, a proof of concept and a recommended fix for each finding.
- CVSS 3.1 severity for every finding, adjusted to the personal data and systems involved.
- A remediation matrix that lines up each finding with its fix, so your team can record what was closed and when.
- Retest terms, written as in the price section of this page.
- Logging record: Every test records which test actions showed up in your logs, so your team can match them to its own monitoring.
Working toward SOC 2 or ISO 27001 as well? See SOC 2 penetration testing and ISO 27001 penetration testing: one test report can support those programs too, if the auditor for each agrees the scope.
Every test follows the five phases on our VAPT methodology page. The sample VAPT report shows the layout your privacy team and developers will receive.
05 / Who it fits
Who DPDP Act security testing fits
The fit is closest for companies that hold a lot of personal data in software they build and run themselves. If you need a legal gap analysis, a Data Protection Officer or a data audit as a Significant Data Fiduciary, that is different work from a security test, and you should hire for it separately.
Show details for Who DPDP Act security testing fits
Consumer apps
Shopping, travel, social and delivery apps with large numbers of Indian users, where one access flaw can expose many accounts at once.
Healthtech
Telemedicine, diagnostics and clinic software holding patient records, prescriptions and reports that people expect to stay private.
Edtech
Learning platforms with student records, often including children, where the parental consent flow belongs in scope.
Fintech
Lending, payments and wealth apps that collect identity documents, bank details and transaction history.
SaaS with Indian users
Software companies whose customers in India, or whose enterprise buyers, ask how personal data in the product is protected.
Processors serving fiduciaries
Vendors that handle personal data for other companies and are asked by those clients for independent evidence of their safeguards.
Testing is delivered remotely from our one office in Hyderabad to teams anywhere in India, with on-site work by arrangement. BERRY9 publishes its own privacy notice for the personal data this website collects.
06 / Price
What a DPDP Act security test costs
A DPDP Act security test with BERRY9 starts from INR 27,000 + 18% GST. Larger scopes cost more, and the figure for yours comes in a written proposal after scoping, once we know which systems hold personal data and how many roles they serve.
DPDP Act security test
Starts fromINR 27,000 + 18% GST
Starting price for a manual test of the web apps, APIs, mobile apps or cloud storage that hold your personal data. The final figure depends on how many systems, roles and endpoints are in scope.
- Executive and engineering reports
- Proof of concept and CVSS 3.1 severity per finding
- Remediation matrix
What moves the figure
Priced byScope
For a DPDP Act test, three things set the price:
- Systems that hold personal data
- User roles and tenants to test as
- Production, staging or both
The starting price for small scopes includes one free retest. For larger scopes, the retest terms are written into the proposal before work starts.
The VAPT cost guide for India explains each factor that turns a starting price into the final figure. To compare every test we run, see all offensive security services.
07 / Inquiry
Tell us where your personal data lives
Send a short list of the apps, APIs and storage that hold personal data, the kinds of data involved, and any deadline your customers or counsel have set. The written proposal comes back with the scope and timeline.
If you would rather talk first, call +91 86868 92922 or write to contact@berry9.com.
08 / FAQ
Frequently asked questions
Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.
Does the DPDP Act require penetration testing?
No. The Act does not name penetration testing or any other specific test. Section 8 asks a data fiduciary to take reasonable security safeguards to prevent a personal data breach, and a penetration test is one common way to produce evidence that those safeguards work in practice. See the section on What the DPDP Act asks of your security above.
What are reasonable security safeguards under the DPDP Act?
The Act leaves the term open. The Rules made under it name measures such as encryption or masking, access control, and logs that help detect unauthorized access. What counts as reasonable for your systems is a judgment for your organization and its counsel; a security test shows whether the technical measures you chose actually hold. See the section on What a security test shows about your safeguards above.
Can BERRY9 make us DPDP compliant or issue a DPDP certificate?
No. BERRY9 tests technical safeguards and reports what it finds. We do not issue a DPDP compliance certificate, and no security test on its own can make an organization compliant with the Act, which also covers consent, notices, the rights of data principals and more.
Do you give legal advice or act as our Data Protection Officer?
No. BERRY9 is not a law firm and does not give legal advice on the DPDP Act, and we do not provide a Data Protection Officer service. Our part is testing the systems that hold personal data and helping your engineers fix what the test finds.
Which systems should a DPDP security test cover?
Every system that collects, stores, shows or sends personal data: customer-facing web apps, the APIs behind them, mobile apps, and cloud storage such as buckets, snapshots and backups. Systems a vendor runs for you count too, but testing them needs the vendor's written permission. See the section on Scope the test around where personal data lives above.
Does the DPDP Act apply to companies outside India?
It can. Section 3 extends the Act to processing outside India when it is connected with offering goods or services to people in India. A company abroad with Indian users should ask its counsel whether that applies to it.
What if the test finds personal data exposed?
Each finding comes with a fix, and fixed findings are checked again on the retest terms in your proposal. Whether an exposure means a personal data breach actually happened, and so must be reported to the Data Protection Board of India and the people affected, is a legal question to take to your counsel.
How much does a DPDP Act security test cost?
With BERRY9, a DPDP Act security test starts from INR 27,000 + 18% GST. The number of systems holding personal data, the roles to test as and the environments in scope set the final figure, which comes in a written proposal after scoping. See the section on What a DPDP Act security test costs above.