Multi-language ready
22 scheduled languages

DPDP compliance software built for Indian companies

Discover personal data, manage consent and privacy notices, fulfil rights requests, handle Rule 7 breaches and prepare for SDF duties before core obligations begin on 13 May 2027.

Start your readiness assessment See pricing in INR

Priced on scope, never per seat. Unlimited users. Quotes in INR, GST extra.

  1. Rules notified

  2. Consent Manager registration

  3. Core obligations begin

Sample scanData classes

Aadhaar in 3 data stores

PANUPI IDABHA

Samples masked at source

Sample notice from Example Finance

सहमति सूचना

  • ऋण आवेदन
  • WhatsApp पर ऑफ़र
मैं सहमत हूँसहमति कभी भी वापस लें

Sample incidentRule 7

Hour 14 of 72

Detailed report next

Audit trail recorded

Consent in the language your customer reads

Notices may be offered in English or any language of the Eighth Schedule. TruePrivacy is multi-language ready.

Sample notice from Example Finance

सहमति सूचना

  • ऋण आवेदन
  • WhatsApp पर ऑफ़र
मैं सहमत हूँसहमति कभी भी वापस लें

The 22 languages of the Eighth Schedule

  • অসমীয়া
  • বাংলা
  • बड़ो
  • डोगरी
  • ગુજરાતી
  • हिन्दी
  • ಕನ್ನಡ
  • कॉशुर
  • कोंकणी
  • मैथिली
  • മലയാളം
  • মৈতৈলোন্
  • मराठी
  • नेपाली
  • ଓଡ଼ିଆ
  • ਪੰਜਾਬੀ
  • संस्कृतम्
  • ᱥᱟᱱᱛᱟᱲᱤ
  • سنڌي
  • தமிழ்
  • తెలుగు
  • اردو
See how notices work

Short answer

Under the Digital Personal Data Protection Act, 2023, the DPDP Rules, 2025 (G.S.R. 846(E)) were notified on 13 November 2025. Consent Manager registration starts on 13 November 2026 and core obligations apply from 13 May 2027. No members of the Data Protection Board have been appointed yet.

Read the DPDP Act guide

Every feature maps to the Act and the Rules

From finding personal data to proving what you did. Each module cites the section or rule it supports.

Section 8

Data discovery

Connect databases, cloud storage and SaaS tools, and keep a list of the systems that hold personal data, shadow SaaS included.

Rule 6

Data classification

Aadhaar, PAN, UPI IDs, ABHA numbers and more, classified with samples masked at the source.

Rule 6

Data security posture (DSPM)

See who can reach personal data, from open links to outside domains, and fix it at the source.

Rule 6

DSPM endpoint agent

Find personal data in files on employee laptops and desktops. Only masked findings leave the device.

Section 6

Consent management

Purpose-by-purpose consent, consent receipts and withdrawal as easy as giving it, with every change logged.

Section 5 · Rule 3

Privacy notices

Banner text in English and all 22 scheduled languages, plus email notice and re-consent campaigns.

Section 6

Cookie consent

A consent banner with reject‑all, a tracker scan of your website, and SDKs for iOS, Android and React Native.

Section 9 · Rule 10

Children's data

Verifiable guardian consent by email and code, with the decision, its timeline and evidence recorded.

Sections 11 to 14

Data principal requests (DSR)

Access, correction, erasure and nomination requests: identity checked, sent to connected systems, tracked to closure.

Section 13 · Rule 14(3)

Grievance redressal

A grievance desk with categories and escalation, each grievance tracked against the 90-day limit.

Rule 7

Breach management

Tell affected people and the Board without delay, then file the detailed report within 72 hours.

Section 10 · Rule 13

SDF: DPO, DPIA and data audit

Record the India-based DPO and independent data auditor, and run the yearly DPIA and data audit clocks.

See all features

See the work, duty by duty

Five sample moments from one workspace.

Book a demo
s.8(5) · Rule 6

Know where Aadhaar and PAN sit before anyone asks

Scans classify personal data in databases, cloud storage, SaaS tools and laptops, with samples masked before they leave the source.

See data discovery

Sample workspace

Data classes Sample scan

  • Aadhaar number3 stores
  • PAN5 stores
  • UPI ID2 stores
  • ABHA number1 store

Latest finding

  1. Found in kyc_documents
  2. Sample masked at source: XXXX XXXX 4821
  3. Classification awaiting confirmation
Sections 11 to 14

Every data principal request tracked to closure

Access, correction, erasure and nomination requests are identity-checked, sent to connected systems and tracked against your response period.

See data principal rights

Sample workspace

Open requests

  • DPR-1042ErasureDay 12 of 90
  • DPR-1039AccessDay 41 of 90
  • DPR-1036CorrectionDay 58 of 90
  • DPR-1031NominationClosed on day 9
Rule 7

Inform without delay, report within 72 hours

Prepare your playbook and evidence now, then run every incident against one clock.

See breach management

Sample workspace

Incident INC-207

Hour 14of 72

  1. Risk assessment saved
  2. Affected people and the Board informed
  3. Detailed report due within 72 hours
Rule 13

Ready if you are notified as an SDF

Record the designation, the India-based DPO and the independent data auditor, then run the yearly clocks.

See SDF controls

Sample workspace

Significant Data Fiduciary Rule 13

  • India-based DPOs.10(2)(a)
  • Independent data auditors.10(2)(b)
  • YearlyDPIADay 151 of 365
  • YearlyData auditDay 151 of 365

A Consent Manager is not a consent tool

Two different things share a name. TruePrivacy is the second one.

Registered Consent ManagerTruePrivacy
What it isA role under Rule 4, registered with the Data Protection BoardCompliance software for data fiduciaries
What it doesLets a data principal give, manage, review and withdraw consentFinds your personal data and runs your consent records, rights requests, grievances and breach response
How it fitsNeeds ₹2 crore net worth; the application form is not published yetNot a Consent Manager; it keeps your records whichever route people use to consent
Rule 4 explained Consent Manager vs CMP

Start with your sector

Shared DPDP duties, different pressure points.

By sizeStartupsMSMEsEnterprisesGCCs

By roleDPOsCISOsFoundersLegalProductHR

India data residency for customer personal data, where offered

  • Access control and an audit trail
  • Subprocessor list with change notice
Visit the trust centre

Priced on scope, never per seat

  • Unlimited users; headcount never changes the price
  • All connectors on every plan, no per-source fee
  • Quotes in INR, GST extra
See pricing in INR Book a demo

Free tools and guides

DPDP questions, answered

Educational, not legal advice.

All DPDP FAQs
When do DPDP obligations start?

Core obligations for data fiduciaries apply from 13 May 2027. Registration of Consent Managers under Rule 4 starts on 13 November 2026. The DPDP Rules, 2025 (G.S.R. 846(E)) were notified on 13 November 2025.

Does TruePrivacy only handle consent?

No. TruePrivacy finds and classifies personal data across databases, cloud storage, SaaS tools and laptops, including Aadhaar, PAN and UPI IDs. It also shows who can reach that data, runs rights requests and grievances, manages breaches under Rule 7, and keeps records of processing, DPIAs, vendor checks and retention rules.

Is TruePrivacy a registered Consent Manager?

No. TruePrivacy is compliance software for data fiduciaries. A Consent Manager is a separate role registered with the Data Protection Board under Rule 4, with a net worth requirement of ₹2 crore; the application form has not been published yet. TruePrivacy keeps the consent records and notices you need whichever route people use.

How long do we have to answer a data principal request or grievance?

Rule 14(3) requires you to publish a grievance response period of no more than 90 days. TruePrivacy tracks every access, correction, erasure and nomination request, and every grievance, against that outer limit so your team can close them sooner.

What does Rule 7 require after a personal data breach?

Rule 7 requires you to inform each affected Data Principal and the Data Protection Board without delay, and to give the Board a detailed report within 72 hours. No Board members have been appointed yet, so prepare your playbook and evidence now.

What changes if we are a Significant Data Fiduciary?

The government notifies Significant Data Fiduciaries. A notified SDF must appoint a Data Protection Officer under section 10(2)(a), engage an independent data auditor under section 10(2)(b) and meet the Rule 13 duties.

Did the Removal of Difficulties Order change our duties?

No. S.O. 5458(E), published in the Gazette on 6 October 2026, is editorial only: it inserts the word 'of' in section 9(1) and changes 'audit' to 'data audit' in section 10(2)(c)(ii).

How is TruePrivacy priced?

On scope of work, never per seat: unlimited users, all connectors on every plan and no per-source fee. Quotes are in INR and GST applies.

Your DPDP plan, starting today

Three moves between now and the day core obligations begin.

13 May 2027

Core obligations begin

  1. 1NowKnow your data and fix your notices
  2. 2From 13 Nov 2026Decide how you will work with Consent Managers
  3. 3Before 13 May 2027Consent, rights, Rule 7 breach response and evidence live
Start your readiness assessment See pricing in INR