IDfy Wins DPDP Innovation Challenge

IDfy has won Code for Consent: The DPDP Innovation Challenge, a competition run by MeitY Startup Hub and the National e-Governance Division under India's Ministry of Electronics and Information Technology. Jio Platforms was named runner-up. The challenge tested consent management and data governance platforms on their ability to meet the operational demands of the Digital Personal Data Protection Act, 2023, evaluating technical robustness, legal readiness, and real-world applicability through live demonstrations rather than pitches alone.

The result places Privy, IDfy's privacy and data governance platform, at a pivotal point as India shifts from DPDP readiness to enforcement. IDfy's central argument, one the evaluation appears to validate, is that consent capture is only the starting point. Enterprises collecting consent at scale still need to know where personal data resides, how it moves across systems and vendors, who can access it, how rights requests get fulfilled, and whether they can produce verifiable evidence when regulators ask.

Privy covers that full arc: consent governance, data discovery and classification through its Data Compass tool, rights management, privacy risk assessments, third-party risk management, privacy-enhancing technologies, and audit-ready evidence. It builds on IDfy's 15 years in identity verification and fraud prevention. The platform is already deployed across more than 50 enterprise environments, including Axis Bank, HSBC, Federal Bank, Shriram Finance, Aditya Birla Capital, Housing.com, Airtel, Shoppers Stop, and Teleperformance, covering close to 500 million users and 70-80 million processed consent notices.

"The DPDP Act is forcing a boardroom shift in how companies treat trust and accountability," said Malcolm Gomes, COO of IDfy and head of Privy. He noted the challenge tested legal readiness, technical robustness, and interoperability through live demonstration, calling consent capture "the easy part" compared to governing data across discovery, access, rights, and evidence at scale.

The win adds visibility to a broader trend: as the DPDP deadline approaches, enterprises are increasingly treating privacy compliance as continuous infrastructure rather than a one-time legal checklist, and the systems capable of running that infrastructure are being selected now.