Buyer's guide
How to choose DPDP software in India
A buyer's guide built on the DPDP Act and Rules. TruePrivacy wrote it, and it ranks no one.
Short answer
Choose DPDP software by the duties that apply to you: notice (s.5, Rule 3), consent (s.6), security safeguards (Rule 6), breach intimation (Rule 7), retention (Rule 8), children's data (Rule 10), SDF duties if designated (Rule 13), and rights and grievances (Rule 14). Core obligations begin on 13 May 2027. TruePrivacy wrote this guide, so it gives criteria and a method, not rankings.
Who wrote this guide
TruePrivacy, a NamLabs Technologies product, wrote this guide. We sell DPDP software, so we have an interest. We do not rank vendors, name a best product or describe other vendors' products. The TruePrivacy column shows our own answers so you can check them.
Buying criteria mapped to the Act and Rules
| Criterion | Why it matters under DPDP | TruePrivacy | Ask every vendor |
|---|---|---|---|
| Discovery | Duties apply wherever personal data sits | Connectors and 59 detection rules, including India identifiers | Which of our systems can you scan? |
| Notices | Itemised notice (Rule 3) in English or an Eighth Schedule language (s.5(3)) | Banner interface text in English and 22 languages; email notice campaigns | Which languages ship, and who writes the notice? |
| Consent records | You prove notice and consent (s.6(10)) | Record per person and purpose, event log, receipts | Can we export one person's history? |
| Children | Verifiable parental consent (s.9(1), Rule 10) | Guardian consent with code verification and evidence | How is a parent verified and recorded? |
| Rights and grievances | Rule 14; grievance period of no more than 90 days | Privacy center, identity verification, deadline tracking, grievance desk | How are deadlines tracked and escalated? |
| Breach | Without delay to both audiences; 72-hour report (Rule 7) | A clock per audience, individual notifications | Which clocks start at awareness? |
| Retention and logs | Erase when the purpose is served (s.8(7)); logs kept one year (Rule 6) | Retention rules with actions on expiry; logs kept at least one year | How are retention rules enforced? |
| Processors | Valid contract with security terms (s.8(2), Rule 6) | Vendor records, portal assessments, DPA tracking | How are processor contracts tracked? |
| SDF duties | If designated: DPO, data auditor, yearly DPIA and data audit (s.10, Rule 13) | SDF workspace with yearly clocks | How do you support the yearly cycle? |
| Pricing basis | Many teams touch DPDP work | Priced on scope, never per seat; unlimited users | What changes the price over time? |
Pitfalls to avoid
- Treating a cookie banner as the programme. Website consent is one duty. Rights, grievances, breach and retention still need a home.
- Confusing a CMP with a Consent Manager. A Consent Manager is registered with the Board under Rule 4. Registration starts on 13 November 2026, and the form is not published yet.
- Buying a feature list. Ask which section or rule each feature serves, and see it run on your own scenarios.
- Skipping discovery. Notices, erasure and breach scoping all depend on knowing where personal data sits.
- Accepting promises of compliance. Software tracks work and keeps evidence. Your organisation stays accountable.
- Ignoring how price grows. Ask what changes the price: users, data sources, volumes or modules.
A shortlist method
- 01List your duties
Note which rules apply: children's data, processors, transfers abroad. The readiness quiz helps.
- 02Write five scenarios
A withdrawal, an access request, a breach, a child sign-up and an erasure, using labelled sample data such as DPR-1042 at Example Finance.
- 03Build a long list
Collect vendors from your own research and send each the same written questions.
- 04Run the same demo
Ask each vendor to run your scenarios live. Mark each one pass, partial or fail.
- 05Check evidence and price
Ask for sample exports of consent records and audit trails, and the pricing basis in writing.
- 06Decide with counsel
Review contract terms, data location and processor terms with counsel before you sign.
How to decide
Pick the tool that covers the duties that apply to you, passes your scenarios and gives you evidence you can export. Our comparison pages list questions to ask specific vendors.
To put TruePrivacy through the same method, see the platform and pricing, or contact us. Priced on scope, never per seat. Unlimited users. Quotes in INR, GST extra.
What is the best DPDP software in India?
There is no single answer, and we do not rank vendors. The right tool covers the duties that apply to you, runs your scenarios and gives you evidence you can export.
Do I need DPDP software before 13 May 2027?
The Act does not require software. You need to meet the duties that begin on 13 May 2027 and prove it; software helps with clocks, records and evidence.
Is a cookie consent tool enough for DPDP?
Cookie consent alone does not cover the programme. Notices, rights, grievances, breach intimation, retention and processor duties also apply.
Who wrote this guide?
TruePrivacy, a NamLabs Technologies product. We say so because we sell DPDP software.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin