Compare
TruePrivacy vs Zecurix
Evaluate on DPDP duties and ask for proof. We describe TruePrivacy; for Zecurix we give questions and proof points to request.
Short answer
Evaluate DPDP software on the duties in the Act and Rules, such as notice (Rule 3), consent (s.6), breach intimation (Rule 7) and grievances (Rule 14(3)), and ask for proof rather than slides. This page shows what TruePrivacy does for each duty. We have not verified Zecurix's products, so check its current product pages and ask the questions below.
Capability themes for a DPDP programme
Group your needs into five themes: find personal data, give notice and take consent, handle rights and grievances, respond to breaches, and prove what you did. Core obligations for each begin on 13 May 2027 (Rule 1). The table maps each theme to the law.
Criteria side by side
| Criterion | Why it matters under DPDP | TruePrivacy | Ask Zecurix |
|---|---|---|---|
| Discovery | Notice, erasure and breach scoping depend on knowing where personal data sits | Connectors and 59 detection rules, including Aadhaar, PAN, UPI ID and ABHA; samples masked at the source | Which of our systems can you scan, and do raw samples leave our environment? |
| Consent and notice | Itemised notice (Rule 3) and provable consent (s.6(10)) | Records per person and purpose, event log, receipts; banner interface text in English and 22 languages | How do we export one person's consent history? |
| Rights and grievances | Rule 14; grievance period of no more than 90 days | Privacy center, identity verification, deadline tracking, grievance desk | How are deadlines and escalations tracked? |
| Breach | Without delay to the Board and Data Principals; 72-hour detailed report (Rule 7) | Incident record, risk assessment, a clock per audience | Which clocks run from the time we record awareness? |
| Processors | Valid contract with security terms (s.8(2), Rule 6) | Vendor records, portal assessments, DPA tracking | How do you track processor contracts and assessments? |
| Security logs | Logs retained for one year to investigate unauthorised access (Rule 6) | Audit trail of every action with before and after, exportable as CSV; SSO and MFA | How long are logs kept, and can we export them? |
| Data residency | Rule 13 can require an SDF to keep specified personal data in India | India data residency for customer personal data, where offered | Where is our personal data stored and processed? |
Residency and support questions
DPDP takes a negative-list approach to transfers: s.16 lets the Central Government restrict transfers to countries it notifies, and stricter sectoral laws still apply (s.16(2)). Rule 13 can also require a Significant Data Fiduciary to keep specified personal data in India.
For TruePrivacy, see trust: India data residency for customer personal data, where offered, and a subprocessor list with change notice. Ask both vendors to state support hours and named contacts in writing.
Questions to ask Zecurix
Ask for these proof points. Ask TruePrivacy for the same.
- A live demo on your own scenarios, using sample data.
- A sample consent record export for one person, with its event history.
- A sample audit trail export showing who changed what, and when.
- The subprocessor list, and how you are told about changes.
- A written statement of where personal data is stored and processed.
- Which Eighth Schedule languages the interface ships in.
- The pricing basis in writing, in INR.
How to decide
Score both vendors on the same proof points, not on slides. TruePrivacy can show consent receipts, a CSV export of the audit trail and its subprocessor list; see consent management and data discovery.
Priced on scope, never per seat. Unlimited users. Quotes in INR, GST extra. See pricing.
Does DPDP require all personal data to stay in India?
Not as a general rule. s.16 lets the Central Government restrict transfers to notified countries, and Rule 13 can require an SDF to keep specified data in India. Sectoral laws may be stricter (s.16(2)).
What proof should I ask a DPDP vendor for?
A live demo on your scenarios, sample exports of consent records and audit trails, the subprocessor list, a residency statement and the pricing basis, all in writing.
Why does this page not list Zecurix's features?
We have not verified them. Ask Zecurix for the proof points on this page and compare them with ours.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin