Wheelhouse for DPDP

Find personal data where it lives,
prove consent, answer rights requests.

Wheelhouse scans your databases and cloud warehouses for personal data, keeps a receipt for every consent, runs rights requests and breach clocks, and exports the evidence as a proof pack, inside your own cloud account.

Book a working session See how it works

Illustrative film, no customer data.

The product

Wheelhouse, feature by feature.

Six capabilities, each mapped to a DPDP obligation.

Find personal data where it lives

Scans your databases and cloud warehouses for 13 identifier types, 9 of them Indian, including Aadhaar, PAN, UPI and GSTIN. Returns where each identifier is, not its value.

Read more ›

Consent that holds up

A receipt for every consent: notice shown first, withdrawal one click. iOS, Android and web SDKs included.

Read more ›

Rights requests, start to finish

A portal with identity check, owner, deadline and the answer on record. Grievance route included.

Read more ›

Breach clocks

From the moment you know: CERT-In's 6-hour filing and the Board's 72-hour report, tracked and drafted.

Read more ›

Proof, not paperwork

Every record is chained so any change shows, and exports as a proof pack an auditor or the Board can check.

Read more ›

DPDP Act and Rules, mapped

130 provisions of the Act, the Rules and the CERT-In Directions indexed, each obligation citing its section and going live on its own date.

Read more ›

See Wheelhouse ›

Why change

The old way will not hold under DPDP.

The DPDP Act makes you answerable for each piece of personal data you hold: why it was collected, who consented, when it must be erased and how fast a breach was reported. A spreadsheet cannot answer that record by record.

The old wayThe new way, with Wheelhouse
A spreadsheet of systems, updated once a year.A live map, built by scanning your systems.
A cookie banner that logs 'accepted'.A receipt per purpose: notice first, and withdrawing as easy as agreeing (section 6).
Rights requests in a shared inbox.A portal with an identity check, an owner, a deadline and the answer on record.
One breach timer that starts when someone notices.Two clocks from the moment you know: CERT-In and the Board.
Policy PDFs handed to an auditor.Evidence on a tamper-evident record that shows any change.
Personal data copied into a vendor's cloud to be scanned.Everything runs in your own cloud account.

Consent manager rules apply from 13 November 2026. Full obligations, with penalties up to Rs 250 crore per instance, from 13 May 2027.

How it works

Three steps, each on the record.

  1. 01

    Find the personal data.

    Reads your databases and cloud warehouses without changing them. 13 identifier types, 9 of them Indian. Returns where each identifier is, never the value.

  2. 02

    Turn the law into obligations.

    130 provisions from the DPDP Act 2023, Rules 2025 and CERT-In Directions indexed. Each obligation carries its source clause and commencement date.

  3. 03

    Obligations go live on their own.

    On the commencement date, scheduled obligations become live without manual intervention. Every deadline has provenance.

Runs in your cloud, on your premises, or air-gapped. No managed SaaS.

Start with your role

Four buyers. One answer.

DPOCan I show consent, rights and breach records to the Board?Start here › CISOCan we find personal data without copying it anywhere?Start here › CIO and CTODoes it run in our cloud, with no data leaving?Start here › Risk and complianceCan we map every DPDP obligation to its section?Start here ›

Also from Raidu

Tower (AI protection).

Tower governs calls to AI models; Wheelhouse governs personal data. Separate products, one design, both keeping tamper-evident records in your cloud.

Tower, illustrative film. No customer data.

Three layers, one install: AI Firewall, Console and Agent control.

AI Firewall

Stop the prompt before the model

Read more ›

AI Console

467 models, one policy stack

Read more ›

Agent Firewall

Every tool call checked

Read more ›

Common questions

Answered straight.

Does the detector read the actual values?
No. It returns where each identifier is in the estate, not what the value is.
Can we deploy Wheelhouse in our own cloud?
Yes. Wheelhouse runs in your cloud, on your premises, or air-gapped. No telemetry, no CDN, no error reporting leaves the install.
What is the 13 May 2027 deadline?
Full DPDP obligations come into effect. Penalties can reach Rs. 250 crore per instance under Gazette G.S.R. 843(E) to 846(E).
Where does Tower run, and when does it check AI calls?
Tower runs in your own cloud account on AWS, Google Cloud or Kubernetes. Every AI call passes through it before the model sees the prompt, and each decision is written to a tamper-evident record inside your own infrastructure.

The law as obligations. The evidence as proof. In your cloud.

Book a working session Get DPDP-ready