Solutions · Data Protection Officer

Show me who touched this person's data.

The estate scan shows where it lives. The consent record shows what was agreed and when. The breach clock started the moment you recorded awareness, not when the alert fired.

Runs in your cloud, on your premises, or air-gapped. No managed SaaS.

Last reviewed

Book a working session Watch it work

Illustrative. No customer data.

The difference

Their way, and ours.

Their wayRaidu
Manual search across data stores.Reads your databases without changing them, and limits how many rows any scan can read.
Consent tracked in a spreadsheet.Tamper-evident receipts in an append-only chain. Withdrawal no harder than giving.
A breach clock started from the alert timestamp.Two clocks from a recorded awareness decision: 6 hours to CERT-In, 72 hours to the Data Protection Board.

What you get asked

And the record that answers it.

Where do we hold this person's data?

Personal Data Detection reads your databases without changing them, and limits how many rows any scan can read. 13 identifier types, 9 of them Indian are validated by checksum or grammar: Aadhaar, PAN, GSTIN, IFSC, UPI VPA, Indian mobile, email, payment card, Indian passport, voter ID, vehicle registration, IP address, and date of birth. The detector returns where an entity is found, never the value.

Did they consent, and to what?

Wheelhouse records consent as a tamper-evident receipt in an append-only chain. Each receipt carries the purpose, the timestamp, and the method of verification. Withdrawal is no harder than giving. Guardians of children are verified by a stated method; self-declaration is refused.

When did we become aware of the breach?

Awareness is recorded as a decision, not inferred from an alert timestamp. From that decision, two clocks run: 6 hours to CERT-In under the CERT-In Directions 2022, and 72 hours to the Data Protection Board under the DPDP Rules. Both filings are built on the same screen.

Products

What covers this.

Personal Data Detection

13 identifier types, 9 of them Indian. Reads your databases without changing them. The detector returns where, never the value.

Read more ›

Consent

Tamper-evident receipts in an append-only chain. Withdrawal no harder than giving.

Read more ›

Breach Clocks

CERT-In 6-hour and Data Protection Board 72-hour clocks, from one recorded awareness decision.

Read more ›

Rights and Retention

Access, correction, erasure, nomination, and portability requests fan out across the estate.

Read more ›

The product

See the screens.

Product windows from the films, with sample data. No customer data.

Personal Data Detection ›

The record

The consent receipt, on the record.

Consent is a tamper-evident receipt in an append-only chain, with the purpose, timestamp, and verification method. Withdrawal updates the same chain.

Entry 81 Consent receipt · 09:14:22Z
Purpose
Product improvement · analytics
Given
09:14:22 IST · method on record
Receipt
Tamper-evident
Withdrawal
Same effort as giving
Chain
Append-only
sha256 94ee2d8070ab27c40dd9cc26ad7638c9…
entry 81 of 4,293 · write-once

The clock

The DPDP dates that apply.

13 November 2026

Consent manager rules commence under the DPDP Act. Wheelhouse records consent as a tamper-evident receipt in an append-only chain.

DPDP Rules 2025

13 May 2027

Full DPDP obligations commence. Penalties up to ₹250 crore per instance. 130 provisions tracked from the Gazette.

DPDP Gazette G.S.R. 843(E) to 846(E)

Common questions

Answered straight.

Does Wheelhouse cover the DPDP Act 2023 and the 2025 Rules?
Yes. Wheelhouse encodes India’s DPDP Act 2023, the DPDP Rules 2025, and the CERT-In Directions 2022. 130 provisions are indexed from the Gazette.
How does Wheelhouse handle personal data discovery?
Personal Data Detection reads your databases without changing them, and limits how many rows any scan can read. 13 identifier types, 9 of them Indian are validated by checksum or grammar. The detector returns where an entity is found, never the value itself.
What is the CERT-In deadline for breach notification?
CERT-In’s Directions 2022 require notification within 6 hours. The clock starts from the moment awareness is recorded as a decision, not from the alert timestamp.
How long do we have to notify the Data Protection Board?
72 hours from the recorded awareness decision, under the DPDP Rules. Wheelhouse builds both the CERT-In notification and the Board intimation on the same screen.
Can we handle data subject access and erasure requests?
Yes. Rights and Retention fans access, correction, erasure, nomination, and portability requests out across the estate. Retention clocks run under Rule 8 of the DPDP Rules, with a one-year floor under Rule 8(3).
What is in the Proof Pack?
Tamper-evident evidence: the records and receipts, linked so any change shows.

Related

The law as obligations. The evidence as proof.

Book a working session