Achieving DPDP Act. and GDPR Privacy Compliance with MYITMANAGER
Background
Penguin International, a leading knowledge services firm offering Research, Analytics and HR outsourcing services across Asia, US and the EUU, needed to elevate its data protection posture in light of tightening global privacy regulations. With operations across multiple jurisdictions, including US, EUU and India, the organization was exposed to GDPR, DPDP Act, 2023, and other regional data protection laws.
Challenges
- No formally designated Data Protection Officer (DPO)
- Limited awareness of data privacy roles and obligations among teams
- No structured Data Subject Rights (DSR) handling process
- Absence of Data Protection Impact Assessments (DPIA)
- Third-party contracts lacked adequate privacy clauses
- Lack of automation in consent and grievance mechanisms
- Cross-border data transfer exposure without compliance documentation
MYITMANAGER's Engagement
MYITMANAGER was engaged to serve as the vCISO and DPO, tasked with bringing the organization in line with both GDPR and DPDP Act requirements.
Our Approach
🔍 Assessment & Gap Analysis
- Performed a thorough audit of data flows, policies, systems, and vendor practices
- Delivered a clause-by-clause GDPR and DPDP Act Compliance Gap Report
📜 Governance & Policy Framework
- Defined and documented policies: Privacy Policy, Consent Management, Data Breach Notification, Data Retention, DSR Handling SOPs
- Established a cross-functional Privacy Governance Committee
🧠 Awareness & Training
- Conducted tailored workshops for leadership, HR, and IT teams
- Rolled out privacy awareness material to all staff
🧰 Technical & Process Enhancements
- Implemented a DSR & Consent Management process
- Built DPIA templates and review workflows
- Suggested automation tools to manage consent logs and third-party risk
📑 Vendor & Contract Review
- Reviewed and updated third-party contracts
- Introduced standard Data Processing Addendums (DPAs)
🌍 Cross-border Compliance
- Implemented compliant cross-border data transfer protocols
- Mapped data transfers with legal basis under GDPR and DPDP
Results Achieved
Client Testimonial
“MYITMANAGER has been instrumental in transforming our data privacy posture globally. Their deep understanding of both Indian and international regulations, combined with a practical approach, helped us implement strong, scalable, and compliant processes without disrupting operations. Saurabh and his team have been true partners in our journey towards compliance and trust.”
— Gautam Jain (CEO, Penguin International)
Services Delivered
- DPDP Act, 2023 Compliance Implementation
- GDPR Alignment Roadmap
- vCISO + DPO-as-a-Service
- DPIA and Vendor Risk Management
- Policy Development & Awareness