The Bengaluru start-up is building a compliance platform for banks, insurers and market firms that maps personal data across India’s overlapping privacy and financial regulations without copying customer information into its systems.
Vipul Abhishek, co-founder and chief technology officer of ComplyDP, says India’s coming privacy regime demands more than a software layer adapted from European rules. The Bengaluru-based platform is positioning itself as a purpose-built compliance suite for banks, non-banking financial companies, insurers and capital market firms preparing for the Digital Personal Data Protection Act, which brings most obligations into force on 13 May 2027.
According to ComplyDP, the challenge for financial institutions is not limited to one law. The DPDP framework will sit alongside Reserve Bank of India directions, Securities and Exchange Board of India norms, CERT-In incident reporting requirements and, for some businesses, filings linked to the Central KYC Registry and CERSAI. Abhishek argues that a usable compliance programme has to account for that wider regulatory web from the outset, rather than treating privacy as a standalone exercise.
ComplyDP says its system is built around what it calls neurosymbolic compliance, a model that turns legal requirements into rules a machine can test while reserving artificial intelligence for areas that need interpretation. The company also claims a zero-PII ingestion design, meaning customer data stays inside the client’s own environment while the platform receives only metadata and findings. In Abhishek’s view, that approach answers a common concern among financial firms that do not want personal data copied into a vendor’s systems.
The company says the starting point is discovery: identifying where personal data sits, how it moves and which business units or third parties can access it. That includes loan systems, call centre recordings, know-your-customer files, marketing platforms and external filings. From there, ComplyDP builds a Record of Processing Activities, or ROPA, which the firm says is central to proving compliance even though the DPDP Act itself does not use that term. Abhishek has also argued that group structures create special problems, because accountability can become blurred when a single financial group spans lending, insurance, broking and technology entities.
ComplyDP says its platform also aims to streamline breach response, bringing together reporting duties that may arise under the DPDP Rules, CERT-In directions and sector-specific RBI or SEBI requirements. The company says its workflow identifies the affected data, tracks deadlines and prepares notices for the relevant authorities and individuals. It also presents consent handling, Data Principal Request processing, compliance audits and breach response as part of one system rather than a patchwork of tools and spreadsheets.
The company’s timing reflects a wider deadline that many Indian organisations are still digesting. DPDP-related rules were notified in November 2025, while most operational obligations are slated to take effect on 13 May 2027. ComplyDP says it is already working with that date in mind, arguing that discovery and mapping across a large financial group can take months. It says the platform is operated by Nihonium Labs Private Limited and supported by a number of startup and industry programmes, including NVIDIA Inception, Google Cloud for Startups, T-Hub and DST.
Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.
