Whorl by Aizzentec · India's DPDP compliance platform
Built in line with MeitY's Consent Management System BRDEvery person, at the centre.
People first. Data second.
Get DPDP-ready before May 2027, not after the first complaint. Whorl gives your customers consent they can see and change in a tap, answers every rights request on time, maps every system that holds personal data, and keeps the evidence ready before the Data Protection Board ever asks.
- Collect
- Validate
- Update
- Renew
- Withdraw
Or get your free readiness score in five minutes.
Withdrawals reach your CRM, diallers and processorsHosted in India: our cloud, yours or on-premiseBuilt for DPOs, CISOs and boards
- ₹250 croreMaximum penalty for failing to take reasonable security safeguardsDPDP Act, 2023, Schedule
- 72 hoursTo send the Data Protection Board a detailed breach reportDPDP Rules, 2025, Rule 7
- May 2027When most duties of Data Fiduciaries applyDPDP Rules, 2025, notified 13 Nov 2025
- 10 of 10MeitY consent management BRD requirements mapped in WhorlMeitY BRD, June 2025
In the product
Your whole DPDP programme, live on one screen
Readiness across the four gates, every consent and withdrawal, every rights request and its deadline. This is what your DPO, CISO and board see in Whorl.
78%DPDP readiness+37 pts since May
Consent withdrawn · 9:12Marketing SMS, Ananya R.
- CRM
- Dialler
- SMS gateway
Rights requestRR-1042 · Access2 of 3 systems done · due in 6 days
Happening in Whorl
- 9:12 · Consent withdrawn · Marketing SMS · synced to CRM, dialler and SMS gateway
- 9:14 · Rights request RR-1042 · identity verified
- 9:20 · Card cross-sell list updated · 1 person removed
- 9:31 · Notice v3.2 in Tamil published for branch onboarding
- 9:40 · Processor review closed · collection agency · evidence sealed
- 9:52 · Grievance GR-208 resolved inside 7 days
- 10:05 · Cookie choice recorded · analytics declined
- 10:42 · Evidence ledger · 41 entries for Ananya R.
Where the DPDP Act stands
- 13 November 2025DPDP Rules, 2025 notified, with obligations phased in.
- November 2026Rule 4 on Consent Managers comes into force.
- May 2027Most remaining obligations apply, including notice, consent, rights, breach reporting and retention.
Source: DPDP Rules, 2025, G.S.R. 846(E) and G.S.R. 843(E). See the Rules guide.
Four gates, one centre
Nothing reaches the person except through a gate
Data comes in only with consent, is used only for its stated purpose, and leaves when the person asks. Each gate of the Whorl mark carries one commitment, and every record in Whorl is built around one person.
Consent · north-west3 of 4 purposes agreedWithdrew SMS offers on 2 Oct. CRM, dialler and 1 processor confirmed.Clarity · north-eastHeld in 5 systemsCore lending, CRM, dialler, warehouse and one payments processor.Rights · south-westCorrection request openAddress update, verified. Due in 6 days. 2 of 3 systems done.Readiness · south-east41 evidence entriesEvery consent, request and change sealed. Last entry 10:42.
Ananya R.Data Principal · customer since 2019
At the centreConsent people can see, and change.
Clear notices, recorded consent, and withdrawal as easy as agreeing.
Explore Consent- 22 + EnglishLanguages a notice can be offered in: English or any language in the Eighth ScheduleSection 5(3)
- As easyWithdrawing consent must be as easy as giving itSection 6(4)
- Under 18A child under the Act; processing needs verifiable consent from a parentSection 9 and Rule 10
Every request, answered on time.
Access, correction, erasure, grievance and nomination, tracked from receipt to response.
Explore Rights- 4 rightsAccess, correction and erasure, grievance redressal, and nominationSections 11 to 14
- 90 daysThe longest a Data Fiduciary may take to answer a grievanceDPDP Rules, 2025
- NomineeA person can name someone to exercise their rights after death or incapacitySection 14
Know where personal data lives.
One map of what you hold, where it flows and who processes it.
Explore Clarity- 1 yearMinimum period to keep personal data, traffic data and processing logsRules 6 and 8
- 3 yearsInactivity after which large platforms must erase personal dataRule 8, Third Schedule
- Every processorYou remain responsible for each one, under a valid contractSection 8(1) and 8(2)
Ready before the Board asks.
Breach response and evidence prepared in advance, not assembled in a hurry.
Explore Readiness- 72 hoursTo send the Data Protection Board a detailed breach reportRule 7
- ₹250 croreMaximum penalty for failing to take reasonable security safeguardsSchedule
- 6 hoursTo report specified cyber incidents to CERT-InCERT-In Directions, 2022
Product tour
See Whorl at work, gate by gate
Four everyday screens from one fictional lender. Choose a gate to see how Whorl handles it.
Kaveri Finance / ConsentSample dataThe notice a customer sees
KFKaveri Finance
Your data, your say
Choose how Kaveri Finance may use your personal data. Section 6, DPDP Act.
- Loan servicingRequired for your account
- Offers on SMS and WhatsApp
- Credit bureau check
- App usage analytics
You can withdraw any time, as easily as you gave it.
Consent recorded
- Consent ID
- CN-48213
- Recorded at
- 22:47:05
- Notice
- v3.2, English
- Purposes
- Loan servicing, Offers
What Whorl records
- ActiveOffers on SMS and WhatsAppGiven in app · notice v3.2 · English
- WithdrawnOffers on SMS and WhatsAppCRM, dialler and processor confirmed
- ActiveCredit bureau checkGiven at branch · notice v3.2 · Tamil
- In reviewCustomer notice v3.3Draft, awaiting legal review
Try it: save choices in the notice, then withdraw. Watch the change reach each system.
Requests this week
| Request | Channel | Progress | Due |
|---|---|---|---|
| Access to personal data | App | Data found in 4 systems | In 9 days |
| Correction of address | Branch | 2 of 3 systems updated | In 6 days |
| Erasure of marketing data | CRM done, processors instructed | In 12 days | |
| Grievance about a call | Call centre | With the grievance officer | In 21 days |
One queue for every channel. Identity is checked before any data moves, and each step is kept on record.
Where customer data lives
Your systemsProcessors, under contractPersonal data
Discovery runs inside your environment. Owners confirm what each store holds, why, and who processes it.
Breach drill: data exposure scenario
- 09:30Incident logged, response lead named
- 09:41Affected data and people identified from the data map
- 10:05Board intimation drafted for review
- 10:20Notices to affected people drafted
- 10:42Drill reviewed and sealed as evidence
Evidence record
- SealedConsent withdrawn, marketing3 systems confirmed
- SealedDPIA approved: new lending appApproved by the DPO
- SealedErasure completed, REQ-1043Certificate attached
- SealedSafeguards review, core systemsTwo actions raised
Prepare your breach notification before you need it. Every action is recorded as it happens, ready to export.
Sample screens with illustrative data. Fictional lender, nothing you select is stored.
Inside the product
This is Whorl, at work
One dashboard for the whole programme: readiness across the four gates, what needs attention, and the KPIs your DPO, CISO and board ask for. Behind every gate, a working product screen.
Product screens behind each gate
Kaveri Finance / Consent recordsProduct screen
Kaveri Finance / Rights requestsProduct screen
Kaveri Finance / Data flowsProduct screen
Kaveri Finance / Obligation registerProduct screen
Screenshot from Whorl. Kaveri Finance, the people and the figures shown are illustrative.
The DPDP Act, mapped to the work
Each line is an obligation from the DPDP Act, the Whorl capability that helps you meet it, and the pillar it belongs to.
Section 5Give a clear notice before you collect personal dataNotice manager, with notices in English and Indian languagesConsent
Section 6Collect valid consent, and let people withdraw it as easilyConsent records, consent checks for every system, withdrawal that reaches them allConsent
Section 8Protect personal data with reasonable security safeguardsSafeguards register with owners, reviews and evidenceReadiness
Section 8Oversee every Data Processor that handles data for youProcessor register, contracts and periodic assessmentsClarity
Across the ActKnow what personal data you hold, why, and for how longDiscovery, data inventory, purpose register and retention schedulesClarity
Section 11Tell a Data Principal what data you hold about themPrivacy centre with identity checks and tracked access requestsRights
Section 12Correct, complete, update or erase personal data on requestCorrection and erasure workflows that run across systems and processorsRights
Section 13Offer a working grievance redressal channelGrievance console with assignment, timelines and escalationRights
Section 14Let a Data Principal nominate someone to act for themNomination records linked to the Data Principal's profileRights
Section 10Meet the additional duties of a Significant Data FiduciaryDPIA workflows and periodic audit support, with evidence on fileReadiness
Interpretation of exemptions and edge cases is a matter for your legal counsel. Whorl gives them the records to work from.
Find your starting point
Start with the question you are asked most
DPO and privacy lead
Where do we stand, and what comes first?
CISO and security
How does it run in our environment?
Board and executives
What does the Act ask of us?
IT and data teams
What connects to what?
Six things to put in place after the policy is written
Most organisations already have a privacy policy. The work is in the everyday steps under it. These six come up in almost every first assessment, and each has a clear next step.
Know where data lives
Personal data sits across core systems, SaaS tools, exports and shared drives. Start with one map, so every notice, request and erasure begins from the same facts.
Consent that systems check
Record consent per purpose, and have campaigns, diallers and processors check it before they act, so a withdrawal changes what happens next.
One queue for requests
Bring requests from email, app, branch and call centre into one queue, with identity checks and a response time for each.
Processors under contract
List every vendor that holds personal data for you, put a valid contract in place, and review each one on a schedule.
One owner per obligation
Privacy duties are split across legal, IT and marketing. Name one owner for each obligation, with a due date and a record.
Evidence kept as you go
Record each action when it happens, so when an auditor asks what was done and when, the answer is one export.
A platform with practitioners behind it
Aizzentec builds Whorl and implements it. The people who configure the platform also run readiness assessments, support your DPIAs and sit with your auditors.
Whorl, the platform
- Four pillars: Consent, Rights, Clarity and Readiness
- AI-assisted discovery and drafting, approved by a person before it acts
- Hosted in India, in your private cloud, or on-premise
- APIs and webhooks for CRM, core systems, HRMS, ITSM and SIEM
Aizzentec, the practice
- DPDP readiness assessments and implementation
- DPIA and periodic audit support for Significant Data Fiduciaries
- Sector playbooks for BFSI and NBFCs, healthcare, IT/ITeS and manufacturing
- Security operations through Bhairava, our AI Native Security Operations Center
How Whorl uses AI with your personal data
A privacy platform should be clear about its own AI: where models run, what they learn from, and who approves what they suggest.
- Models run on infrastructure in India, and personal data stays in your environment
- Your data is not used to train models
- A person approves every AI suggestion before it becomes a compliance action
- Each suggestion, approval and override is kept in the audit log
Three packs. Start where you are.
Each pack adds capability as your programme matures. Assure, the top tier, adds the full evidence and audit support of the Readiness pillar.
Comply
Get DPDP-ready
Notices, consent, rights and grievance for one entity.
- Notice and consent manager
- Privacy centre for rights requests
- Grievance redressal
- Readiness dashboard
Govern
Run the programme
Adds discovery, inventory, processor oversight and breach readiness.
- Everything in Comply
- Discovery and data inventory
- Processor oversight
- Breach response workflows
Assure
Ready before the Board asks
Multi-entity, on-premise options and Significant Data Fiduciary support.
- Everything in Govern
- Multi-entity and on-premise deployment
- DPIA and periodic audit support
- Board reporting and evidence exports
The Whorl story
Every person, at the centre.
People first. Data second.
Behind every record an organisation holds is a person. Whorl is built on a simple order of priority: people first, data second.
Read the story behind the markBring one real processing activity.
In thirty minutes we map one journey, such as onboarding, lending, claims or patient intake, into Whorl. You leave with a working view of consent, rights, the data map and evidence for it.
Contact@aizzentec.com / +91 8220 359 506