DPDP Consent Manager phase
Rule 4 is scheduled to commence one year after Gazette publication.
Compliance, assurance and AI governance for regulated organisations.
Navigate RBI, SEBI, IRDAI, CERT-In, DPDP, ISO 27001, ISO/IEC 42001, SOC 2 and responsible AI with confidence.
CERT-In Empanelled Information Security Auditing Organisation
Authorised to conduct information-security audits within the categories covered by our active CERT-In empanelment.
Which compliance requirement applies to you?
Select your sector or regulatory need to learn more about how we can help.
Banking / NBFC / UCB
- Regulator
- RBI
- Our service
- CSF / IS Audit
Payments & FinTech
- Regulator
- RBI
- Our service
- System Audit Report (SAR)
Capital Markets
- Regulator
- SEBI
- Our service
- CSCRF Compliance Audit
Insurance / TPA
- Regulator
- IRDAI
- Our service
- Cybersecurity Audit
Government / PSU
- Regulator
- CERT-In
- Our service
- Empanelled Security Audit
Personal Data / Privacy
- Framework
- DPDP
- Our service
- Privacy Governance & SDF Readiness
AI-enabled Organisations
- Frameworks
- India AI Guidelines · ISO/IEC 42001 · NIST AI RMF
- Our service
- AI Governance
EU-facing AI
- Regulator
- EU AI Act
- Our service
- AI Act Readiness
From regulatory requirement to continuous assurance
A structured, practical approach from assessment to ongoing assurance.
- 1 Assess
Understand your business, regulatory scope and current state.
- 2 Gap Analysis
Identify gaps against applicable regulations and standards.
- 3 Remediate
Implement targeted controls with practical roadmaps.
- 4 Independent Audit
Support for regulatory or third-party audits.
- 5 Continuous Assurance
Monitor, evidence and stay audit-ready.
Regulatory milestones
Keep upcoming dates and ongoing obligations in focus.
Major DPDP operational obligations
Core operational rules are scheduled to commence eighteen months after Gazette publication.
Other obligations are licence-driven or continuous
RBI, SEBI, IRDAI, CERT-In and sector-specific requirements depend on entity type, licence and engagement scope.
Dates above are presented from the Gazette commencement periods and should be re-verified against the latest official notification before publication or client advice. Last reviewed 19 September 2026.
A complete compliance & assurance architecture
End-to-end support across regulatory, privacy, AI and certification frameworks.
Regulatory Assurance
- RBI CSF / IS Audit for applicable banks, NBFCs & UCBs
- RBI System Audit Report (SAR)
- SEBI CSCRF Compliance Audit
- IRDAI Cybersecurity Audit
- CERT-In Empanelled Security Audit
Privacy & Data Governance
- DPDP readiness and compliance
- DPIA and privacy risk assessments
- SDF readiness where applicable
- Independent data-audit support
- Policy, consent and data-subject-rights design
AI Governance & Assurance
- India AI Governance Guidelines alignment
- RBI FREE-AI readiness for relevant financial entities
- AI inventory and risk classification
- Model-risk assessment & red teaming
- ISO/IEC 42001 readiness
- Responsible AI controls and evidence
Certification & Continuous Assurance
- ISO 27001 readiness & certification support
- ISO/IEC 42001 readiness & certification support
- SOC 2 readiness & attestation support
- Continuous control monitoring
- Evidence management with QStellar
- Recurring gap assessments
AI Governance & Responsible AI
Practical, risk-based advisory and assurance for trustworthy AI, aligned to current guidelines, standards and applicable sector expectations.
From strategy to audit evidence, aligned with global best practices.
- 1AI InventoryIdentify and document AI use cases and models
- 2Risk ClassificationAssess risk and business impact
- 3Governance PoliciesDefine controls, roles and accountability
- 4Model OversightTesting, red teaming and monitoring
- 5Privacy & Security ControlsProtect data and AI systems
- 6Audit EvidenceMaintain evidence for internal and external assurance
What you actually receive
Clear, actionable artefacts that help move from compliance to confidence.
Final deliverables depend on the selected engagement and independence requirements.
Signed / independent report
Where the engagement or filing requires it.
Findings register
Detailed observations with risk ratings.
Remediation plan
Prioritised and practical action plan.
Re-test evidence
Validation of implemented controls.
Evidence pack
Templates, policies and supporting documents.
Board summary
Executive briefing for leadership and stakeholders.
QStellar: From point-in-time compliance to continuous evidence
Use the QuassrCyberTech security-intelligence ecosystem to improve evidence collection, remediation visibility and audit readiness.
- AssetsDiscover & inventory
- VulnerabilitiesIdentify & prioritise
- RiskContextual risk scoring
- RemediationTrack & verify
- EvidenceAutomate collection
- AssuranceStay audit-ready
Check us on the list
Verify empanelment independently before engaging. The legal entity name, audit scope and validity period should all match the current CERT-In record.
1Search legal entity nameUse the registered legal entity, not only the brand name.
2Confirm scopeEnsure the engagement falls within the current authorised audit categories.
3Confirm validity periodVerify the current validity dates cover report delivery.
Go to CERT-In empanelled list (opens in a new tab)