- Home
- Platform
Platform
TruePrivacy DPDP platform overview
Every module maps to the section or rule of the DPDP Act and Rules it supports. Start with the duty you need to meet first.
Short answer
TruePrivacy is DPDP compliance software for Data Fiduciaries, made by NamLabs Technologies. It finds personal data across your systems, runs consent and notices (s.5, s.6), handles rights requests and grievances (ss.11 to 13, Rule 14), tracks breach intimation (Rule 7) and records Significant Data Fiduciary duties (Rule 13). It is not a registered Consent Manager under Rule 4. Core obligations begin on 13 May 2027.
Find your personal data
Data discovery for DPDP data fiduciaries
Find personal data across databases, cloud storage and SaaS tools for DPDP. Map digital personal data before core obligations begin on 13 May 2027.
Section 8(5) · Rule 6Classify Indian personal data for DPDP
Detect Aadhaar, PAN, GSTIN, UPI ID, ABHA and more with 59 detection rules. Masked samples, data classes by sensitivity and human confirmation.
Section 8(5) · Rule 6DSPM endpoint agent for laptops and desktops
Find personal data in local files on employee laptops and desktops. A macOS, Windows and Linux agent that reports masked findings, not raw files.
Section 8(5) · Rule 6Data security posture for DPDP safeguards
See who can reach personal data across devices, cloud stores and databases, and fix it through an approved remediation flow. Supports s.8(5) and Rule 6.
Section 8 · Rule 14Integrations for your DPDP data map
Connect databases, cloud storage and SaaS tools with OAuth or API keys, find shadow SaaS with system discovery, and use the API and webhooks.
Section 8 · Section 11Records of processing for DPDP
Keep a record of processing activities and a data map for DPDP accountability, synced from data discovery and exportable for auditors.
Consent and notices
Consent management under the DPDP Act
Record consent under DPDP s.6 per person and purpose, with withdrawal as easy as giving it, consent receipts and a log of every grant and withdrawal.
Section 5 · Rule 3DPDP notices for Indian Data Principals
Show a DPDP notice with every consent request, in clear and plain language, and send s.5(2) notices to existing users by email campaign.
Section 6Cookie and tracker consent for DPDP
Consent banner with reject-all for DPDP, a website tracker scan, interface text in 22 Eighth Schedule languages, and iOS, Android and React Native SDKs.
Section 9 · Rules 10–12Children's data and guardian consent under DPDP
Record verifiable parental consent under DPDP s.9 and Rule 10. Understand Rule 11 guardian checks and Rule 12 exemptions before you rely on them.
Rule 4 · Section 6(7)Prepare for DPDP Consent Managers (Rule 4)
Rule 4 Consent Manager registration starts 13 Nov 2026 (₹2 crore net worth; form not yet published). What it means for your own consent record.
Section 6 · Section 8(7)Purpose limitation for DPDP compliance
Tie personal data to specified purposes under DPDP: one list of purposes for consent, notices, processing records and retention rules.
Rule 14 · Rule 3A privacy center for your Data Principals
A branded self-service portal where Data Principals submit DPDP requests, manage preferences, check status and download their data by secure link.
Respond to people and incidents
Data principal requests (DSR) under DPDP
Handle DPDP access, correction, erasure, nomination and withdrawal requests with identity checks, tasks to connected systems and deadline tracking.
Section 13 · Rule 14(3)Grievance redressal for DPDP fiduciaries
Run a DPDP grievance desk with categories, SLA states and escalation. Rule 14(3) caps your published grievance response period at 90 days.
Rule 7DPDP Rule 7 breach notification workflow
Rule 7 breach workflow: intimate the Board and each affected Data Principal without delay, then give the Board a detailed report within 72 hours.
Govern and prove
Rule 13 SDF: DPIA, DPO and data audit support
For Significant Data Fiduciaries: record the DPO (s.10(2)(a)) and independent data auditor (s.10(2)(b)), and track yearly DPIA and data audit clocks.
Section 8(7) · Rule 8Retention and erasure under DPDP
Keep personal data only while the purpose is served under DPDP s.8(7). Retention rules by category, system or activity, with an executions log.
Section 8(2) · Rule 6Vendors and processors under DPDP
Manage Data Processors under DPDP s.8: vendor records with risk levels, assessments through a vendor portal link and contract (DPA) tracking.
Section 16 · Rule 15Cross-border personal data transfers (DPDP)
Check personal data transfers out of India under DPDP s.16. Keep your own restriction list and get a warning when a vendor or destination matches.
Section 8(3) · Rule 13AI governance for personal data under DPDP
Keep an inventory of the AI models and datasets you use, with assessments. Check AI use against DPDP purposes, notices and Rule 13.
One workspace shares one data map
The modules in one workspace share one data map: the record of what personal data you hold and where. Data discovery scans your connected systems, and the records of processing sync from what it finds. Retention rules then run per data category, connected system or processing activity.
When a Data Principal asks for access, correction or erasure through the privacy center, tasks fan out to those same connected systems. Vendors are checked against your transfer restriction list, and every action is logged on one audit trail.
What TruePrivacy is not
TruePrivacy is software that a Data Fiduciary runs. It is not a registered Consent Manager under s.6(9) and Rule 4, and it is not only a cookie banner: cookie consent is one module among many.
The DPDP checklist and posture score give a readiness view worked out from your live records. They are not a certification. Check legal positions with counsel.
Is TruePrivacy a Consent Manager under Rule 4?
No. A Consent Manager is a person registered with the Data Protection Board who lets Data Principals give, manage, review and withdraw consent (s.6(7) to (9), Rule 4). TruePrivacy is compliance software for Data Fiduciaries and is not registered as a Consent Manager.
Do I need a registered Consent Manager to collect consent?
No. Section 6(7) says a Data Principal may give, manage, review or withdraw consent through a Consent Manager, so consent given directly to you remains possible. TruePrivacy keeps that direct consent record per person and purpose.
Is TruePrivacy only a consent tool?
No. It also finds and classifies personal data, tracks rights requests and grievances, runs breach clocks, manages vendors, transfers and retention, and records SDF duties. Consent is one part of the programme.
How is TruePrivacy priced?
Priced on scope, never per seat. Unlimited users. Quotes in INR, GST extra. See pricing for the tiers and modules.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin