Compare
TruePrivacy vs OneTrust for India DPDP
OneTrust is a global privacy platform built for many laws. This page gives a DPDP scorecard: TruePrivacy's answers, and questions for OneTrust.
Short answer
OneTrust is a global privacy platform built for many laws. For DPDP, test localisation (22 Eighth Schedule languages, Indian identifiers, age 18 for children), the Rule 7 breach clocks and the Rule 14(3) grievance limit, and remember that a consent management platform is not a registered Consent Manager (Rule 4). This page describes TruePrivacy's answers and gives questions for OneTrust, not claims about it.
What DPDP localisation means
- Language: the notice can be read in English or any of the 22 languages in the Eighth Schedule (s.5(3)).
- Grounds: processing needs consent (s.6) or a legitimate use in s.7, such as employment purposes or a medical emergency (s.4).
- Children: a child is under 18; no tracking, behavioural monitoring or targeted advertising directed at children (s.9(3)).
- Grievances: Data Principals must use your grievance process before approaching the Board (s.13(3)).
- Identifiers: your data may hold Aadhaar numbers, PAN, UPI IDs, ABHA numbers and voter IDs (EPIC).
A CMP is not a registered Consent Manager
Under DPDP, a Consent Manager is a person registered with the Board (s.6(9)), accountable to the Data Principal (s.6(8)). Rule 4 registration starts on 13 November 2026, and the First Schedule (Part A) conditions include incorporation in India and a net worth of not less than ₹2 crore.
A consent management platform is software. As of 4 November 2026 the Rule 4 application form is not published. TruePrivacy is not a registered Consent Manager. See Consent Manager vs CMP.
Evaluation scorecard
After a demo, mark each row pass, partial or fail for both products.
| Criterion | Why it matters under DPDP | TruePrivacy | Ask OneTrust |
|---|---|---|---|
| Notice languages | s.5(3): English or any Eighth Schedule language | Banner interface text in English and all 22 languages; your own notice text | Which Eighth Schedule languages ship today? |
| Notice content | Rule 3: itemised data, purposes and links to withdraw, use rights and complain to the Board | You write your notice text; email notice and re-consent campaigns for existing users (s.5(2)) | How is a Rule 3 notice built and versioned? |
| Indian identifiers | Rule 6 safeguards need you to know where data sits | 59 detection rules, including India-specific ones; masked samples | Which Indian identifiers do you detect? |
| Children | Verifiable parental consent for under-18s (s.9(1), Rule 10) | Guardian consent with code verification and evidence | How is a parent's consent verified? |
| Breach | Rule 7: two audiences without delay, 72-hour report | A clock per audience; individual notifications | How are the Rule 7 clocks set? |
| Grievances | Rule 14(3): published period of no more than 90 days | Grievance desk with the 90-day limit as the clock | Is the DPDP 90-day limit preset? |
| Pricing | Rights and breach work involves many teams | Priced on scope, never per seat; quotes in INR, GST extra | What drives your price, and do you quote in INR? |
Questions to ask OneTrust
- How is DPDP configured in your product, and who keeps it current as the Rules commence?
- Which Eighth Schedule languages does your consent interface ship in?
- Are you applying to be a Consent Manager under Rule 4, or is your product software for the fiduciary?
- How do you handle verifiable parental consent for under-18s?
- Where is our personal data stored?
- What scope does our quote cover, and what changes the price?
How to decide
If you run privacy programmes under several laws, compare both products on each law you need. If DPDP is your main law, weigh the localisation rows most.
To check TruePrivacy's answers, see notices, children's data and pricing: priced on scope, never per seat. Unlimited users. Quotes in INR, GST extra.
What is OneTrust?
OneTrust is a global privacy platform built for many laws. For its current DPDP features, check its product pages and ask the questions on this page.
Is a CMP enough to act as a DPDP Consent Manager?
No. A Consent Manager must be registered with the Board (s.6(9), Rule 4). Registration starts on 13 November 2026, and the form is not published yet.
What should a DPDP scorecard include?
Notice languages and content, Indian identifiers, children's consent, Rule 7 breach clocks, the Rule 14(3) grievance limit and the pricing basis.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin