Compare
TruePrivacy vs Consentin
Start from the DPDP duties, see what TruePrivacy does for each, then put the same questions to Consentin. TruePrivacy wrote this page.
Short answer
A DPDP programme needs notices (s.5, Rule 3), provable consent with easy withdrawal (s.6), rights and grievance handling (Rule 14) and breach intimation (Rule 7), and core obligations begin on 13 May 2027. This page shows what TruePrivacy does for each duty. We have not verified Consentin's products, so we do not describe them: check its current product pages and ask the questions below.
What a DPDP programme needs from software
Core obligations for Data Fiduciaries begin on 13 May 2027, when Rules 3 and 5 to 16 commence (Rule 1). Software should help you meet these duties and keep evidence that you did.
- Give a notice with every consent request, itemising the data and purposes, with links to withdraw consent, exercise rights and complain to the Board (s.5, Rule 3).
- Prove notice and consent (s.6(10)), and make withdrawal as easy as giving consent (s.6(4)).
- Act on access, correction, erasure and nomination, and publish a grievance response period of no more than 90 days (s.11 to s.14, Rule 14).
- Intimate the Board and each affected Data Principal of a breach without delay, with a detailed report to the Board within 72 hours (Rule 7).
- Get verifiable parental consent for children's data (s.9, Rule 10), and engage processors only under a valid contract (s.8(2)).
Consent Manager or consent software
A Consent Manager is a person registered with the Board who acts as a single point of contact for a Data Principal to give, manage, review and withdraw consent (s.2, s.6(9)). Under s.6(7) a Data Principal may act through one; consenting directly to the fiduciary remains possible.
Rule 4 registration starts on 13 November 2026. The First Schedule (Part A) conditions include being a company incorporated in India with a net worth of not less than ₹2 crore.
As of 4 November 2026 the application form is not published and the Board has no members yet. TruePrivacy is software for the Data Fiduciary, not a registered Consent Manager. Ask Consentin which role it plays. Our Consent Manager vs CMP guide explains the difference.
Criteria side by side
| Criterion | Why it matters under DPDP | TruePrivacy | Ask Consentin |
|---|---|---|---|
| Notices | s.5 and Rule 3 require an itemised notice, readable in English or any Eighth Schedule language (s.5(3)) | Banner interface text in English and all 22 Eighth Schedule languages; you write your own notice text; email campaigns for notices to existing users | How do you show an itemised notice in the user's chosen language? |
| Consent records | s.6(10) puts the burden of proving notice and consent on you | A record per person and purpose, an event log of every grant, withdrawal, rejection and update, and consent receipts | Can we export one person's full consent history as evidence? |
| Withdrawal | Withdrawal must be as easy as giving consent (s.6(4)), and processing must stop within a reasonable time (s.6(6)) | Preference page and privacy center; withdrawal requests fan out as tasks to connected systems | How does a withdrawal reach our downstream systems and processors? |
| Rights requests | Access, correction, erasure and nomination (s.11 to s.14, Rule 14) | Privacy center intake, identity verification before work starts, deadline tracking | How do you verify identity and track each request to closure? |
| Grievances | Rule 14(3) caps your published response period at 90 days | Grievance desk with categories, SLA states and escalation | How are grievances escalated and closed within our published period? |
| Breach intimation | Data Principals and the Board without delay; detailed report within 72 hours (Rule 7) | Incident record, risk assessment, a clock per audience, individual notifications | Does your product handle breach intimation, and how? |
| Consent Manager status | A Consent Manager must be registered with the Board (s.6(9), Rule 4) | Software for the Data Fiduciary, not a registered Consent Manager | Do you intend to register under Rule 4, and on what timeline? |
Questions to ask Consentin
- Which DPDP duties does your product cover today: notice, consent, rights, grievances, breach, children's data, processors?
- Are you a Consent Manager applying under Rule 4, or software that the Data Fiduciary runs?
- How do we prove one person's notice and consent under s.6(10)?
- How does a withdrawal stop processing in our systems and at our processors (s.6(6))?
- Which Eighth Schedule languages does your interface support, and who writes the notice text?
- Where is our personal data stored, and what is your pricing basis?
How to decide
Write down which duties apply to you. Then ask both vendors to run the same scenario with sample data, such as a withdrawal by sample user DPR-1042 at Example Finance, and to answer the questions above in writing.
Consider TruePrivacy if you want discovery, consent, rights, grievances, breach and vendors in one product. See the platform and pricing: priced on scope, never per seat. Unlimited users. Quotes in INR, GST extra.
Is TruePrivacy a registered DPDP Consent Manager?
No. TruePrivacy is software that a Data Fiduciary runs. Registration under Rule 4 starts on 13 November 2026, and the application form is not published yet.
Do I need a Consent Manager to comply with DPDP?
No. Under s.6(7) a Data Principal may give, manage, review or withdraw consent through a Consent Manager, and consenting directly to the fiduciary remains possible. Either way, s.6(10) makes you prove notice and consent.
Why does this page not list Consentin's features?
We have not verified them, and we do not publish claims we cannot check. Ask Consentin the questions on this page and compare the written answers.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin