IDfy wins privacy challenge as India operationalizes DPDP Act

Identity verification firm IDfy has been declared winner of a competition dubbed “Code for Consent: The DPDP Innovation Challenge,” organized in collaboration with the National e-Governance Division (NeGD) under India’s Ministry of Electronics and Information Technology (MeitY).

The challenge was designed to test consent management systems on technical, functional, and legal readiness levels through live demonstrations.

IDfy’s submission emerged on top, with organizers describing the system as showing strong alignment with the DPDP Act. The firm entered its privacy and data governance platform, Privy by IDfy, for the challenge, which distinguished itself for its notable innovation, technical robustness, and practical applicability.

The platform, which has over 50 live implementations touching about 500 million users, covers consent governance, data discovery and classification (via Data Compass), data principal rights management, privacy impact assessments, third-party risk management, Data Security Posture Management (DSPM), and compliance evidence across the enterprise.

Privy draws on IDfy’s 15 years of experience in identity verification, fraud prevention, and risk intelligence, all domains where operating at scale and producing audit-ready records are already standard practice.

The innovation challenge comes as thousands of Indian enterprises brace for enforcement of the Digital Personal Data Protection (DPDP) Act, 2023. It marks a pivotal moment not only for the company but for India, which is embarking on a transition from privacy readiness to privacy execution. Also, it represents a new regulatory approach where a government-backed competition surfaces market-ready solutions before the law fully takes effect.

Efforts to operationalize India’s data protection act kicked off in earnest last November, with an enforcement timeline that extends to May 2027.

As the DPDP implementation moves closer, the MeitY challenge signaled that consent is moving from a compliance afterthought to a system-level requirement, while privacy and data governance are becoming enterprise infrastructure rather than a one-time project.

It is worth noting that India’s Digital Personal Data Protection Act is a foundational piece of the country’s DPI governance ecosystem which is increasingly viewed as a global reference. It provides the privacy and consent layer that will make the Aadhaar, UPI, and Digilocker Stack more trustworthy.

This aligns with the central argument in a World Bank wallet policy note which posits that technology alone does not create trust, but governance, compliance, and legal frameworks are essential. The DPDP Act, and the consent management systems it requires, can therefore be said to be the governance layer for the India Stack.

IDfy’s innovation challenge milestone comes not long after it announced that it had raised $23 million, part of which will be used to develop its risk detection tools suite.

Article Topics

data privacy  |  data protection  |  Digital Personal Data Protection (DPDP) Act  |  identity verification  |  IDfy  |  India