100% free · Built for India's DPDP Act
The DPDP Act fines a single failure to protect personal data up to ₹250 crore. You can't protect what you haven't found. Sumrite's free tool scans your databases, email, cloud and endpoints for Aadhaar, PAN, passport, mobile and bank data and builds the inventory every DPDP programme starts with.
The cost of not knowing
That is the maximum the Data Protection Board can impose for failing to take reasonable security safeguards to prevent a personal data breach, under Section 8(5) and the Schedule to the DPDP Act, 2023. It is one of seven penalty lines, and they can stack.
Source: Schedule to the Digital Personal Data Protection Act, 2023 (section 33). Amounts are maximums; the Board sets each penalty by the nature, gravity and duration of the breach and the steps taken to reduce it.
₹250 crvs₹0
Every one of these starts with personal data you didn't know you had. Finding it costs nothing.
See it work
One discovery hub. Agents across Oracle, MySQL, Exchange mail, file shares, cloud drives and every endpoint. A live count of what was found, where, and how exposed you are.
What the video shows: the Sumrite discovery hub connects to an Oracle database, a MySQL cluster, Exchange mail, a file share, a cloud drive and 512 endpoints. As agents report in, it counts records scanned and personal data found, lists Aadhaar, PAN, mobile, passport, Aadhaar card scans and bank account numbers by source, and scores DPDP exposure.
You can't write a notice, honour an erasure request or report a breach within 72 hours for data you haven't found. The inventory comes first. We made that step free.
01 · PII data discovery & inventory · Free
An admin portal runs on a host inside your network. Lightweight agents on Windows and Linux machines and connectors to your data stores report back to it. Nothing is uploaded to us.
Install the admin portal on one host, then roll agents out to endpoints and servers. Built for networks of 500+ nodes.
Oracle, SQL Server and MySQL databases, email, cloud drives, file shares, and files on endpoints: spreadsheets, text files and scanned images of ID cards.
See what personal data sits where, how much of it there is and how exposed it is, mapped to the DPDP Rules 2025.
Start with banks, NBFCs and universities: large volumes of KYC and student records spread across many systems, and the most to lose under the penalty schedule.
100% free · No credit card · Not a trial
The Sumrite DPDP suite
Each module answers a duty in the DPDP Act and Rules, and the penalty that comes with getting it wrong. Every one starts from the inventory your free discovery tool creates.
Agents scan databases, email, cloud and endpoints for Aadhaar, PAN and similar data. You can't write notices, answer erasure requests or classify breaches without an inventory, so this is where every programme starts.
Get it free →Plain-language notices, including all 22 Eighth Schedule languages, granular consent capture, withdrawal as easy as giving consent, and consent logs. Most businesses need a CMP for their own users; a registered "consent manager" is a separate, regulated entity.
A portal and workflow for access, correction, erasure, grievance and nomination requests, with response-time tracking and a full audit trail. Pairs naturally with the CMP.
Delete data once its purpose is served, notify the person before erasure and keep the logs. Built on the discovery agents: once the data is found, schedule its deletion.
Templates and timers for the Data Protection Board: the initial notice without delay, then the detailed report within 72 hours, plus notices to affected people. Bundles with our SOC and VAPT work.
For edtech, gaming, schools and universities with many users under 18: verify that the adult giving consent is a real parent or lawful guardian before any processing.
SDFs need a data protection impact assessment and an audit every year. Get the software and Sumrite's audit service together: one team for the tooling, the assessment and the evidence.
Talk to us about SDF readiness →The clock is running
Definitions and the Data Protection Board of India take effect.
Registration and duties of consent managers apply.
Notice, consent, security safeguards, 72-hour breach reporting, retention and erasure, children's data, rights and SDF duties. The full penalty schedule bites.
Building an inventory across hundreds of systems takes months, not weeks. Read our rule-by-rule checklist →
Why Sumrite
Discovery is free, not a 14-day trial with the export button greyed out. Your inventory is yours to keep.
The portal and agents run inside your network. We never see the personal data the tool finds.
Aadhaar, PAN, passport, mobile and bank formats out of the box, including Aadhaar card scans sitting in shared folders.
We are a VAPT and risk-assessment firm. When discovery shows where the data is, we can test whether it is actually safe, the "reasonable safeguards" the ₹250 crore line is about.
Discovery, consent, rights, breach response and SDF audits from one partner, with formal attestations routed through our partner firms.
250+ clients cleared through audits, with work mapped to 23 compliance frameworks, from ISO 27001 to RBI and SEBI.
Learn more: India DPDP compliance with Sumrite · What is the DPDP Act? · Free external security scan
Get started
Tell us a little about your environment. We'll send the installer and a short deployment guide, and help you get the first scan running.
Up to ₹250 crore in penalties. ₹0 to find out where you stand.
Prefer email? sales@sumrite.com
We'll email the installer and deployment guide shortly. Meanwhile, run a free external scan at scan.sumrite.com.
FAQ
Up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach. Failing to notify the Data Protection Board and affected people of a breach, and breaching the duties for children's data, can each cost up to ₹200 crore. Breaching the extra duties of a Significant Data Fiduciary can cost up to ₹150 crore, and any other breach of the Act or Rules up to ₹50 crore.
Yes. The discovery and inventory tool is 100% free. It is not a trial and there is no credit card. You pay only if you later choose Sumrite's other DPDP modules or services.
No. The admin portal runs on a host inside your own network and the agents report to it. The inventory stays with you.
Databases such as Oracle, Microsoft SQL Server and MySQL, email, cloud drives, file shares and Windows and Linux endpoints, including spreadsheets, text files and scanned images such as Aadhaar cards.
The DPDP Rules were notified on 13 November 2025. Consent manager rules apply from November 2026 and most obligations on data fiduciaries, including security safeguards and breach reporting, apply from May 2027.
Most businesses need a consent management platform to handle their own users' consent. A "consent manager" under the Act is a separate entity registered with the Data Protection Board that people use to manage consent across many companies.