Ayush Sahay
Dayitva LegalProvides the legal opinion and supports notices, contracts and legal review.
Sanctum by Meridian Bridge Strategy
All-in-one DPDP compliance.
Legal, technology, consulting and operations in one programme. Meridian Bridge Strategy leads the work with your team, from the first data map to the final assessment.
The work we bring together
Four areas. One team to lead them.
- 01
Legal
Set out your duties in writing.
- Legal opinion and privacy notices
- Consent wording and vendor contracts
- 02
Technology
Put the changes into your systems.
- Consent tools and data access
- Rules for storing and deleting data
- 03
Consulting
Decide what to fix first.
- Data map and gap assessment
- Action plan, team roles and reviews
- 04
Operations
Help people run the daily work.
- Requests, grievances and breach response
- Team training and records of completed work
The delivery journey
See what the programme produces.
Gap assessment takes four weeks. Implementation takes two to three months, followed by a final assessment.
- 014 weeks
Gap assessment
We map personal data across your customers, employees, systems and vendors. We use the findings to make a plan with your team.
- Data mapWhere data sits and moves
- Legal opinionYour role and duties
- Gap reportEvidence of what needs fixing
- Action planEach fix and who will do it
- 022 to 3 months
Implementation
We work with your legal, technology, and operations teams to put the agreed changes in place.
- Policies, notices, and vendor documents
- Changes to consent, data handling, and team processes
- Training and evidence of the completed work
- 03After implementation
Final assessment
We assess the completed work, review the evidence, and record any gaps that remain.
- Checks of system changes, documents and team processes
- Written readiness opinion and any remaining actions
After the final assessment
Ongoing support, where agreed
- Help with breach response and audit questions
- Review of new rules and changes in your business
- Support scope and response terms agreed in writing
Final assessment timing depends on the agreed scope and evidence available.
See how we work with your teamThe people behind the work
Specialists with clear roles.
Gopal Bhageria
AllyComp AI / Sujosu TechnologySupports technology implementation, consent tools and system changes.
Before we start
Can we use an assessment we already have?
Yes. Share the report and its evidence. We review what it covers and agree any further checks before implementation.
How is the price set?
We agree the systems, teams, locations and work involved, then send a private quote. Travel, tools and ongoing support are set out in the scope.
Your next step
Discuss your DPDP work Tell us what your business needs.
- Share your main concern and target date.
- Bring the systems involved and any existing assessment.
- We agree the next step and prepare a scope and quote.
Our public research
Explore State of Privacy →See how we review privacy practices.
Real Estate
MagicBricks
48
MagicBricks operates a high-volume platform handling sensitive financial and property data. Its current policy is a legacy document built for the IT Act 2000. It lacks the 'granular consent' and 'right to erasure' frameworks mandated by the DPDP Act 2023. The absence of an escalation path to the Data Protection Board of India (DPBI) and the lack of a 'Notice' in languages specified in the Eighth Schedule are significant compliance liabilities.
Primary framework remains the Information Technology Act, 2000 and SPDI Rules 2011
Notice does not meet Section 5 requirements regarding the right to withdraw consent and the right to grievance redressal with the DPB
+4 more gaps detected
FoodTech
Licious
52
Licious has a transparent list of what they collect, but their legal framework is stuck in the year 2000. Their 'agree-by-default' approach to consent is high-risk under the new DPDP Act requirements.
Explicitly built on the outdated IT Act 2000 instead of DPDP Act 2023
Uses 'implied consent' where just browsing counts as agreeing to everything
+4 more gaps detected
Entertainment / OTT
JioCinema
58
JioCinema's privacy policy remains largely structured around the legacy IT Act 2000 (SPDI Rules). While it excels in identifying 'what' is collected, it fails the 'how' and 'why' requirements of the DPDP Act 2023. Specifically, its handling of users under 18—a massive demographic for OTT—does not meet the 'verifiable parental consent' standard, and the lack of a consent withdrawal mechanism that is 'as easy as giving consent' poses significant legal risk.
Bundled consent framework — acceptance of policy tied to service access (violates Section 6)
Age of consent discrepancy — defines 'Children' as under 18 but lacks 'verifiable' parental consent mechanisms required by Section 9
+4 more gaps detected
InsurTech / BFSI
ICICI Lombard General Insurance
68
ICICI Lombard has made significant strides in DPDP Act 2023 readiness compared to its peers, formally initiating a 'DPDP Compliance Roadmap' and updating its Information Security framework as of April 2026. However, its public-facing privacy policy remains legacy-heavy, particularly regarding consent architecture and the new 'Right to Nominate.' While its security posture is top-tier, the transition from 'regulatory compliance' (IRDAI) to 'data principal empowerment' (DPDP) is still a work in progress.
Consent is still bundled with website usage — 'By using this website... you authorize us' fails the 'freely given' standard under Section 6
No explicit mention of the Right to Nominate (Section 14) in the primary privacy policy
+3 more gaps detected
Entertainment / OTT
Disney+ Hotstar
58
Disney+ Hotstar’s privacy policy remains heavily influenced by the IT Act 2000 and global GDPR-style frameworks. While it offers strong security disclosures and clear data categorization, it falls short of the DPDP Act 2023’s stringent requirements for granular consent, specific retention limits, and the unique Indian statutory rights like the Right to Nominate. Its handling of 'Children’s Data' is particularly high-risk given the Act’s 18-year threshold vs. the platform's current 'Kids Mode' protections.
Consent is largely bundled with the Terms of Use — lacks the 'granular' and 'separate' notice requirement of Section 5
No provision for the Right to Nominate a representative in the event of death or incapacity (Section 14)
+4 more gaps detected
Insurance
HDFC Ergo
58
HDFC Ergo maintains a high standard of data security dictated by the IRDAI, but its privacy policy is legally outdated. It remains tethered to the 2011 SPDI Rules. To achieve DPDP 2023 compliance, the company must decouple its consent architecture, introduce the right to nominate, and explicitly integrate the Data Protection Board into its grievance hierarchy.
Reliance on legacy IT Act 2000 and SPDI Rules 2011 framework rather than DPDP Act 2023
Consent is bundled and implied through 'continued use' — fails Section 6's specific/unambiguous standard
+4 more gaps detected