Dhristhi DPDP
Legal Register
Product Showcase
Procurement Suite
Product Showcase

DPDP Procurement Decision Workspace

Vendor Scorecards, Proof-of-Value (PoV) Framework & TCO Calculator

Engineered By: Dhristhi Privacy Engineering
Edition: Enterprise Edition
Release: 2026 Release

Product Overview & Key Capabilities

A rigorous enterprise procurement and vendor evaluation workspace that enables CIOs, CISOs, and DPOs to objectively score third-party privacy software, enforce mandatory statutory knockout criteria, execute synthetic Proof-of-Value (PoV) tests, and model 3-year Total Cost of Ownership.

Core Enterprise Capabilities
Weighted RFP evaluation scorecards with automated statutory knockout gates (e.g. Schedule 8 language support, data localization).
Synthetic sandbox Proof-of-Value (PoV) test contracts replacing subjective marketing claims with empirical verification.
Comprehensive 3-year TCO financial calculator modeling software licenses, implementation fees, infrastructure, and ongoing maintenance.
Automated executive selection dossier generation for Board and investment committee sign-off.
Deliverable & Core Artifact

Vendor evaluation matrices, synthetic PoV testing framework, 3-year TCO calculation models, and procurement audit workpapers.

Target Roles & Operational Impact

Target Persona & Role Decision Authority Operational Value & Impact
Head of Procurement & Sourcing Procurement Lead Run objective, weighted RFP scorecards and eliminate vendors failing mandatory statutory criteria.
DPO & Legal Privacy Lead Statutory Compliance Veto Verify that proposed solutions enforce Indian data localization and statutory notice templates.
Chief Information Security Officer Technical & Security Veto Evaluate integration architecture, encryption key ownership, and processor sub-delegation risks.

Data Schema & Architecture Interface Contracts

The following data schemas and interface contracts define the structured payloads and integration endpoints of this product:

vendor_scorecard
vendor_id; vendor_name; architecture_type (SAAS, HYBRID, ACCELERATOR, PRIMITIVE); mandatory_gate_results (PASS, FAIL, INCOMPLETE); weighted_criteria_scores; composite_score; disqualification_reason; evaluator_id
tco_model
vendor_id; license_tier; implementation_fee; annual_maintenance_cost; cloud_infrastructure_cost; internal_engineering_overhead; 3_year_total_cost

Operational Workflow & Product Invariants

Execution Workflow Procedure

  1. Define enterprise procurement perimeter, target system integrations, and mandatory statutory knockout criteria.
  2. Distribute standardized DPDP RFP questionnaires to participating software vendors.
  3. Conduct synthetic Proof-of-Value (PoV) testing in an isolated sandbox environment.
  4. Compute weighted capability scores across consent management, discovery, DSAR, and breach response.
  5. Run 3-year Total Cost of Ownership (TCO) financial modeling and generate executive selection dossiers.

Mandatory Product Invariants

  • P08-R01: Any vendor failing a mandatory statutory gate (e.g. inability to support Schedule 8 languages) is disqualified regardless of overall score.
  • P08-R02: Distinguish marketing claims from independently verified proof in sandbox testbeds.
  • P08-R03: Include hidden integration costs, ongoing rule-change maintenance, and exit transition fees in TCO calculations.
  • P08-R04: Maintain full audit trails of vendor scoring decisions for board and compliance review.

Operational Boundaries & Architecture Assumptions

  • • No commercial endorsement or paid promotion of specific software vendors.
  • • No binding contractual guarantees regarding third-party software performance.
  • • No automated procurement negotiation without executive sign-off.

Built-in Quality Verification & Compliance Test Harness

P08-A01-TEST Verified
Mandatory Knockout Execution

Verify that failing a critical criterion (e.g. Schedule 8 languages) immediately marks the vendor as DISQUALIFIED.

P08-A02-TEST Verified
TCO Cost Projection Formula

Validate accurate calculation of license, infrastructure, implementation, and maintenance costs over 36 months.

P08-A03-TEST Verified
Scorecard PDF & Excel Export

Ensure complete exportability of evaluation matrices and audit workpapers.

Statutory Grounding & Regulatory Crosswalk

10 Enforced Provisions

The following primary Act sections and subordinate Rule provisions establish the direct legal grounding, mandatory statutory constraints, and operational compliance duties enforced by this product:

Direct Citations: Section 8Section 10Section 16Section 27Section 28Section 33Rule 3Rule 6Rule 11Rule 13
ACT-8 s.8
Tranche 3 (13 May 2027)

Section 8

Actor: Data Fiduciary
Trigger: Processing by it or its processor

Responsibility despite agreements/principal default; valid processor contract; conditional data accuracy; safeguards; breach intimation; erasure; contact and grievance mechanism.

Product Invariant: Receipt is not proof of erasure; fulfilment of one test is not statutory assurance.
Exception: s8(7) lawful-retention exception; s17 preserves s8(1),(5) under subsection (1).
Gazette Verified View Provision (s.8)
ACT-10 s.10
Tranche 3 (13 May 2027)

Section 10

Actor: Central Government; notified SDF
Trigger: Notification of fiduciary or class following relevant-factor assessment

India-based individual DPO responsible to governing body; independent auditor; periodic DPIA/audit and prescribed measures.

Product Invariant: Voluntary readiness is not a legal designation; independence is not an express firm-wide ban here.
Exception: Not automatic from scale/sensitivity; designation and effective timing matter.
Gazette Verified View Provision (s.10)
ACT-16 s.16
Tranche 3 (13 May 2027)

Section 16

Actor: Central Government; Data Fiduciary
Trigger: Offshore processing/transfer

Government may notify destination restrictions.

Product Invariant: Separate from general s38 conflict rule; a contract cannot override a binding restriction.
Exception: s16(2) preserves higher protection/restriction in other Indian law for transfers.
Gazette Verified View Provision (s.16)
ACT-27 s.27
Scheduled

Section 27

Actor: Board
Trigger: Listed intimation, complaint, reference or court direction

Breach mitigation/inquiry/penalty functions; consent-manager complaint vs registration breach are distinct; hearing/reasons for directions.

Product Invariant: No legitimate-use condition in s27(1)(d).
Exception: s27(1)(d) separately commences; later penalties/procedure remain staged.
Gazette Verified View Provision (s.27)
ACT-28 s.28
Tranche 3 (13 May 2027)

Section 28

Actor: Board
Trigger: Receipt of s27 material and sufficient grounds for inquiry

Independent digital design; recorded reasons/natural justice; listed civil-court powers; hearing and completion route to s33.

Product Invariant: Do not present inquiry as automatic penalty.
Exception: No premises-access prevention or equipment custody adversely affecting day-to-day functioning; insufficient grounds close; frivolous complaints costs/warning.
Gazette Verified View Provision (s.28)
ACT-33 s.33
Tranche 3 (13 May 2027)

Section 33

Actor: Board; person found in significant breach
Trigger: Conclusion of inquiry, significant breach and hearing

May impose scheduled penalty; seven statutory factors.

Product Invariant: No expected-loss formula from fixture pass rate; aggregate exposure requires separate legal analysis.
Exception: Discretionary maximum, no fixed multiplier from mitigation.
Gazette Verified View Provision (s.33)
RULE-3 r.3
Tranche 3 (13 May 2027)

Rule 3

Actor: Data Fiduciary
Trigger: Notice

Independent understandable clear/plain notice, itemised data, purposes and goods/services/uses description; withdrawal/rights/complaint links and other means.

Product Invariant: Comparable ease is statutory; identical screens/steps are an optional heuristic.
Exception: Read s5 and s6 language options.
Gazette Verified View Provision (r.3)
RULE-6 r.6
Tranche 3 (13 May 2027)

Rule 6

Actor: Data Fiduciary; processors by contractual propagation
Trigger: Protection of possessed/controlled data

Minimum security, access, visibility, continuity/backup, one-year security data/log retention, contract safeguards, organisational/technical measures.

Product Invariant: No required algorithm or proof that one passed test satisfies s8(5).
Exception: r6(1)(e): unless compliance with law requires otherwise.
Gazette Verified View Provision (r.6)
RULE-11 r.11
Tranche 3 (13 May 2027)

Rule 11

Actor: Data Fiduciary; claimed lawful guardian
Trigger: Covered disability guardian consent

Verify lawful appointment by court/designated authority/local committee under defined guardianship laws.

Product Invariant: Do not require guardians for all disabled adults or all healthcare users.
Exception: Covered disability definition includes inability despite adequate appropriate support.
Gazette Verified View Provision (r.11)
RULE-13 r.13
Tranche 3 (13 May 2027)

Rule 13

Actor: Notified SDF; assessment/audit person; Central Government
Trigger: Designation; algorithms; Government data specification

DPIA and audit once each twelve-month period from notification; significant observations report by assessor/auditor; algorithmic technical-measure diligence; specified data/traffic not abroad.

Product Invariant: No KS, AUC, fairness-code or API threshold supplied here; correct Departments in (5).
Exception: Data restriction requires specification on committee recommendation; no general all-data localisation.
Gazette Verified View Provision (r.13)

Target Systems Topology (SYS-001..014)

View Complete Architecture Topology →
SYS-001 System Spec →
Customer App & Web Portal

Public client boundary & untrusted intake surface for notices and consent capture

SYS-003 System Spec →
Marketing Automation Engine

Processor-operated messaging engine (ENT-004) gated by optional consent

SYS-010 System Spec →
Consent Ledger & Policy Decision Point

Immutable consent event store and Policy Decision Point issuing authority tokens

SYS-013 System Spec →
Processor Orchestration Gateway & Queue

Integration pipeline tracking downstream processor instructions and acknowledgements

Enterprise Evidence Artifacts Vault

The following verifiable artifacts and test workpapers are generated by this product:
DPDP_Vendor_Scorecard_Template.xlsx
PoV_Evaluation_Framework_Runbook.md
Privacy_Tech_TCO_Calculator.xlsx
Previous Product
The Implementation Book