DEMO

DPDP Act Compliance Journey

An end-to-end demo of India's DPDP Act 2023 compliance journey, showing how IBM technology helps close data-privacy risk gaps across the data subject's lifecycle.

Building Blocks used:

ai.agents

automation.secure

Skills used

Download skills for IBM Bob →

Products Used

1 Review use case

Cross-Industry — Data Privacy & Regulatory Compliance (India DPDP Act 2023) This demo is industry-agnostic — it applies to any organization handling personal data under the DPDP Act, not one specific sector. If the form's dropdown doesn't offer a "Cross-Industry" option, pick the closest generic option it has (e.g. "General" / "Other") rather than naming a specific vertical.

India's Digital Personal Data Protection (DPDP) Act, 2023 requires organizations to protect personal data across its lifecycle — from the moment it is collected through to its use, storage, and eventual disposal. In many enterprises, that responsibility is scattered across identity, security, and governance teams, making it hard to show, in one narrative, how a data subject's information is actually protected end to end. This demo tells that story: it follows a data subject's personal data as it moves through an organization, illustrates the kinds of DPDP-related risks that can emerge at each stage, and shows how IBM technology can help address them.

The demo is structured as six phases mapped to the data lifecycle — Collect, Discover, Protect, Use, Detect, and Govern — each paired with a relevant IBM capability: IBM Verify for consent management at the point of collection, IBM Guardium Discover and Classify for locating and classifying sensitive data, IBM Guardium Data Protection for access controls and data masking, HashiCorp Vault for key/secret management and encryption, IBM QRadar SIEM for breach detection and response, and IBM OpenPages for GRC reporting and compliance visibility. Interactive walkthroughs at each stage let a seller show how a compliance gap can be identified and addressed.

The demo is presented through four personas whose day-to-day actions map to DPDP-related responsibilities: the Data Principal / Customer, whose consent and data rights are central to the journey; the Security Admin / DB Admin, who is involved in discovering, classifying, and protecting sensitive data and managing encryption keys; the Data Analyst, whose access to customer data is shaped by masking and role-based policies; and the Data Protection Officer (DPO), who is involved in breach response and compliance reporting. Together these personas give sellers a role-based way to walk a customer through consent capture, data discovery, protection, breach detection, and governance.

Start Here

Watch this short overview

Preview the application

Explore key screens from the demo

2 Try the interactive application

Experience the interactive demo and explore its features. A demo script is provided to help when presenting the application to partners.

Try the demo

Have questions, want a walkthrough or found a bug?

Contact the demo owner for assistance.

Submit a request →

3 Explore how it was built

The application is a single-page app which has structured as a guided, six-stage story. A central stage-state layer drives navigation across the six DPDP lifecycle phases — Collect, Discover, Protect, Use, Detect, Govern — each rendered by its own stage component and themed around one IBM product: IBM Verify, IBM Guardium Discover and Classify, IBM Guardium Data Protection, HashiCorp Vault, IBM QRadar SIEM, and IBM OpenPages respectively. A left panel shows overall progress and persona context, while a right panel renders the active stage's interactive walkthrough, using synthetic demo data reflecting an Indian data context (names, ID formats, phone numbers), consistent with the DPDP Act's jurisdiction. Each stage captures user input (consent choices, scan triggers, role switches, encryption input, breach simulation, report generation) and updates the UI to reflect the resulting outcome, using simulated data for demo purposes. A floating "IBM Bob" assistant component sits on top of the app, letting a seller show how an Agentic SDLC platform can be used to create and deploy DPDP-focused compliance agents on IBM watsonx Orchestrate, connecting the lifecycle narrative to IBM's broader automation and agentic AI capabilities.

Architecture

4 Download and modify with IBM Bob

Download the source code and specifications for this application to set up and run it locally. Once downloaded, open the code in IBM Bob to modify and adapt it to your own use case.

Source Code

DPDP Act Compliance Journey — Demo Script

Setup

Open the live demo URL. The app opens on Stage 1 (Consent), with a progress indicator in the header and a stage list in the left panel.
Optionally enable “Guided Mode” to walk the customer through the narrative automatically.

Opening — Set the Context

Seller: “Before we jump into the demo, let me quickly set the context. With India’s Digital Personal Data Protection requirements, organizations need to think beyond just protecting data. They need to understand what personal data they have, why they are collecting it, how they are using and protecting it, who has access to it, and what happens when something goes wrong. So rather than looking at DPDP as a standalone compliance exercise, this demo shows how IBM can help address the end-to-end personal data lifecycle — from consent and discovery through protection, encryption, threat detection, and governance. Let’s walk through that journey from the perspective of different personas in an organization.”

Introduce the Data Principal persona. Show them granting consent for specific purposes (e.g. identity verification, service enrollment) while leaving optional purposes (e.g. marketing) unchecked.
Submit the consent form and point out the resulting consent status.
Revoke a consent to show that withdrawal is immediately reflected — this illustrates the DPDP consent requirement in action.

Seller takeaway: “From a business perspective, this gives organizations a more structured way to manage consent and establish a foundation for DPDP compliance.”

Stage 2 — Discover: Know Your Data (IBM Guardium Discover and Classify)

Switch to the Security Admin / DPO persona.
Run the discovery scan and show it identifying sensitive data across the organization’s databases.
Submit a sample Data Subject Access Request (DSAR) and show the resulting report — this illustrates how discovery supports DSAR response.

Seller takeaway: “Know your data before you can govern your data — discovery becomes a critical foundation for responding to data rights requests and protecting personal information.”

Stage 3 — Protect: Control Access (IBM Guardium Data Protection)

Switch to the Data Analyst persona and query customer data.
Toggle masking on/off to show sensitive fields (e.g. national ID numbers) being dynamically masked based on role.
Switch between roles (Analyst / Admin / DPO) to show how access policy changes what is visible.

Seller takeaway: “This allows organizations to apply more granular controls around sensitive information while still enabling employees to do their jobs.”

Stage 4 — Use: Encrypt and Manage Keys (IBM Vault)

As the Security Admin, encrypt a piece of sample data and decrypt it again to show authorized access.
Walk through the key-rotation view and the audit log to show ongoing key management.

Seller takeaway: “This provides another layer of protection for sensitive information and supports stronger security controls around critical data.”

Stage 5 — Detect: Respond to a Data Breach (IBM QRadar SIEM)

Trigger the simulated breach scenario — an unusual/unauthorized data export.
Walk through the automated response flow: session termination, access revocation, endpoint isolation, and DPO notification.
Show the breach-notification workflow.

Seller takeaway: “The objective is to reduce the time between detection, containment and notification when a potential data breach occurs.”

Stage 6 — Govern: Demonstrate Compliance (IBM OpenPages)

Switch to the DPO persona and open the compliance dashboard.
Walk through the control areas being tracked: consent, data protection, encryption, breach response, and data rights requests.
Generate and show a sample compliance report.

Close — Connect the IBM Story

Seller: “So, what we have demonstrated today is not six disconnected products. We’ve walked through one connected personal-data journey: Collect → Discover → Protect → Encrypt → Detect → Govern. At each stage, IBM provides capabilities that can help address a different part of the data protection and compliance lifecycle. The bigger business value is that organizations don’t have to look at DPDP as just a compliance checkbox. They can build a more structured approach to understanding their personal data, protecting it, controlling access, responding to incidents and demonstrating their compliance posture.”