Privacy education, consultancy & implementation, in 50+ jurisdictions.contact@vedhacon.com
Asia-Pacific
IndiaDPDP Act 2023 & Rules 2025 ChinaPIPL, DSL & CSL Japan & South KoreaAPPI and PIPA South East AsiaSix ASEAN regimes compared Australia & New ZealandPrivacy Act 1988 and Privacy Act 2020
Europe
European UnionGDPR, obligations & implementation United KingdomUK GDPR and DPA 2018 Switzerland & EEArevFADP and EEA adoption Türkiye & wider EuropeKVKK, Serbia, Ukraine, Russia EU AI ActRisk tiers and privacy overlap
Americas, Middle East & Africa
CaliforniaCCPA / CPRA consumer rights United StatesState laws and sectoral rules Canada & Latin AmericaPIPEDA, Law 25, LGPD and more Middle EastUAE, Saudi Arabia, Qatar, Bahrain, Oman AfricaNDPA, POPIA, Kenya DPA and more
Plain-language guides for 50+ jurisdictions, updated as the law changes.Browse every jurisdiction
Featured jurisdictionIndia, DPDP Act 2023

Notice, consent, Data Fiduciary duties, SDF obligations and breach intimation, explained.

Open the guide
How we help
Privacy educationBoards, engineers, HR & legal Consultancy & DPOStrategy, gap analysis, DPO as a service ImplementationData mapping, notices, consent, DPIAs Certification readinessISO/IEC 27001, 27701 & 42001 Audit & assuranceInternal audit and evidence packs AI governanceControls for models in production Breach & incident responsePlaybooks, drills and notification All servicesThe full engagement model
Where most engagements startA readiness assessment, then a plan

We scope against the laws that actually apply to you, then sequence the work by risk.

Start the assessment
By type
WhitepapersIn-depth research & briefings BlogNotes from practitioners News & updatesRegulatory change, explained GuidesPractical how-to resources
Featured whitepaperThe DPDP implementation clock

What must be operational before the substantive obligations commence in 2027.

Read the briefing
Diagnostics & toolkits
Readiness checker18-question diagnostic DPIA & RoPA templatesReady-to-adopt toolkits Consent & vendor toolsRegisters & questionnaires Regulatory trackerHorizon scanning More ToolsThe full toolkit
Free, no sign-upCheck your readiness in 10 minutes

Answer 18 questions and get a prioritised control roadmap instantly.

Start the assessment
Grow your expertise
GRC AcademyFrom zero to practitioner AI ExplainedAI, GenAI & RPA in plain English CommunityAsk a moderator AI AssistantAnswers in seconds Learning tracksFoundation to certification Careers in GRCEnter from any background Expert networkContribute & mentor
Free, alwaysZero to practitioner

Track 01 assumes no prior knowledge of governance, risk and compliance.

Start Track 01
Blog

Notes from the build

Shorter, sharper pieces from our consultants and engineers, what actually happens when controls meet real systems, vendors and deadlines.

Recent posts

Fresh from the team

Implementation

When the RoPA meets the real estate

Why data mapping always finds a system nobody mentioned.

6 minAug 2026
Consent

Dark patterns are a compliance risk, not a growth hack

Designing consent that holds up when a regulator looks.

5 minAug 2026
Breach

The 72 hours you don't want to improvise

A breach playbook is only useful before the breach.

7 minJul 2026
Archive

Browse by topic

28 Aug 2026DPIA templates are not DPIAs4 min read 14 Aug 2026What "certain legitimate uses" actually means under the DPDP Act6 min read 02 Aug 2026Retention schedules: the control everyone writes and no one runs5 min read 19 Jul 2026Reading a transfer clause without falling asleep4 min read 05 Jul 2026Your first 90 days as a one-person privacy team8 min read
Write with us

Have something worth sharing?

Practitioners are welcome to publish guidance and analysis for a global professional readership. Contribution is credited.

Apply to contribute