Compare
TruePrivacy vs Perfios
This page does not describe Perfios's products. It explains what a DPDP operations platform for a Data Fiduciary covers, and the questions to put to any vendor, Perfios included.
Short answer
We have not verified Perfios's products, so this page does not describe them. A DPDP fiduciary platform helps a Data Fiduciary run duties such as notice (s.5, Rule 3), consent (s.6), breach intimation (Rule 7) and grievances (Rule 14(3)). Any vendor that processes personal data on your behalf is a Data Processor, and you remain responsible for that processing (s.8), so ask it the questions below.
Two different questions
Comparing a DPDP platform with another vendor can mix two questions. First: what software runs your own DPDP programme? Second: if a vendor processes personal data for you, does it meet your processor terms?
A Data Processor is any person who processes personal data on behalf of a Data Fiduciary (s.2). You may engage one only under a valid contract (s.8(2)), and Rule 6 lists security terms in that contract among the safeguards. Check with counsel how each vendor's role is set out in your contracts.
What a DPDP fiduciary platform covers
| Criterion | Why it matters under DPDP | TruePrivacy | Ask Perfios |
|---|---|---|---|
| Finding personal data | You cannot give notice, erase or size a breach for data you have not found | Connectors and 59 detection rules, including PAN, Aadhaar number, IFSC and UPI ID; samples masked before they leave the source | Which personal data fields do you receive from us, and for what purpose? |
| Notice and consent | Notice (s.5, Rule 3) and provable consent (s.6(10)) | Consent records per person and purpose with an event log and receipts; web banner script plus SDKs for iOS, Android and React Native | Does your service rely on consent we collect, and how do we pass a withdrawal to you? |
| Processors | Processing only under a valid contract with security terms (s.8(2), Rule 6) | Vendor records with risk levels, assessments through a vendor portal link, DPA tracking | Will you complete our processor assessment and sign our data processing terms? |
| Breach | You intimate the Board and each affected Data Principal without delay (Rule 7) | Breach records with a clock per audience; a vendor question template on reporting breaches without delay | How soon will you tell us about a breach affecting our data? |
| Erasure | Erase when consent is withdrawn or the purpose is served, and make processors erase (s.8(7)) | Retention rules with actions on expiry; erasure requests fan out as tasks to connected systems | How do you erase our data on instruction, and how do you confirm it? |
| Grievances | Rule 14(3) caps your published grievance response period at 90 days | Grievance desk with SLA states and escalation | Who at your company helps us answer a grievance that involves your processing? |
Questions to ask Perfios, or any vendor
- For this data, do you act as our Data Processor, or do you decide purposes yourself as a Data Fiduciary?
- Which Rule 6 safeguards apply: encryption or masking, access control, access logs, backups?
- Do you keep logs for at least one year, so we can meet Rule 6?
- Will you report a breach to us without delay, and to whom?
- Is any of our data transferred outside India (s.16, Rule 15)?
- How do you stop processing after a withdrawal (s.6(6)) and erase on our instruction (s.8(7))?
- Which other companies process our data on your behalf?
Check sector rules alongside DPDP
Sector regulators such as RBI may have their own rules. We do not summarise them here. Check your regulator's directions alongside DPDP, and ask counsel how they fit together.
How to decide
Treat this as two decisions. Choose software for your own DPDP programme on the duties above. Review each vendor that processes personal data for you, with counsel, using the questions above.
For the first decision, see our fintech and NBFC page and vendor management. For the second, use the vendor due diligence guide. Priced on scope, never per seat. Unlimited users. Quotes in INR, GST extra.
Does this page describe Perfios's products?
No. We have not verified them. The page covers what a DPDP fiduciary platform does and the questions to ask any vendor.
Is every vendor a Data Processor?
Not always. A vendor is a Data Processor when it processes personal data on your behalf (s.2); the role depends on the facts, so check with counsel.
What must a processor contract cover under DPDP?
s.8(2) requires a valid contract, and Rule 6 lists security terms in contracts with Data Processors among the safeguards. Our processor contracts guide covers the details.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin