Quick answer: DPDP compliance software must do five jobs: give itemised notices and record consent, run a rights-and-grievance workflow, log access and retain logs, report breaches, and erase data on schedule. The Gazette-notified DPDP Rules, 2025 make most of these duties apply from 13 May 2027 (our calculation from the 18-month rule). India-focused options include PrivacyEngine, Ardent Privacy, OneTrust, TrustArc and Securiti; a plain cookie banner is not enough.
How we researched this: We read the Digital Personal Data Protection Act, 2023 as published in the Gazette on meity.gov.in, the DPDP Rules, 2025 (G.S.R. 846(E)) on meity.gov.in, Press Information Bureau releases on the Rules, and the product pages and pricing pages of the vendors named below. Facts are as checked in October 2026. This article explains the law for buyers and is not legal advice; confirm obligations with counsel.
What the Act and Rules actually demand
Two documents set the duties. The Act (No. 22 of 2023) was published in the Gazette on 11 August 2023. The Rules were notified on 13 November 2025 as G.S.R. 846(E); a PIB release on 14 November 2025 announced them. If your business decides why and how personal data is processed, the Act calls you a Data Fiduciary, and the people whose data you hold are Data Principals.
The Act applies to digital personal data processed in India, and to processing outside India connected with offering goods or services to people in India (section 3). Consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action" and limited to the data necessary for the specified purpose (section 6(1)). Here is how the main duties translate into software requirements.
| Duty | Where it sits | What your software needs |
|---|---|---|
| Notice before or with every consent request | Act s.5; Rule 3 | Itemised list of the personal data, the specified purpose, links to withdraw consent, exercise rights and complain to the Board; notice also available in English or any Eighth Schedule language (s.5(3)) |
| Withdrawal as easy as giving consent | Act s.6(4); Rule 3(c)(i) | One-click withdrawal; a consent ledger that stops downstream processing (s.6(6)) |
| Proof of notice and consent | Act s.6(10) | Timestamped consent records, because the Data Fiduciary must prove notice and consent in a proceeding |
| Security safeguards | Act s.8(5); Rule 6 | Encryption, masking or tokens, access control, logging and monitoring, backups, and contract terms with processors |
| Log and data retention | Rule 6(1)(e), Rule 8(3) | Logs retained for one year unless another law requires otherwise |
| Breach intimation | Act s.8(6); Rule 7 | Message to each affected person; report to the Board without delay and a detailed update within 72 hours |
| Erasure when purpose ends | Act s.8(7) | Retention schedules; deletion that also reaches processors |
| Rights and grievances | Act ss.11-14; Rule 14 | Published request channel and a grievance system responding within a period not exceeding 90 days |
| Children's data | Act s.9; Rule 10 | Verifiable parental consent; no tracking, behavioural monitoring or targeted advertising of children (s.9(3)) |
| Contact point | Act s.8(9); Rule 9 | DPO or named person's contact published on website or app |
Penalties come from the Schedule to the Act. A failure to take reasonable security safeguards may attract a penalty up to ₹250 crore; failure to notify the Board or affected Data Principals of a breach, and breach of the children's obligations, up to ₹200 crore each; extra duties of Significant Data Fiduciaries up to ₹150 crore; and any other breach up to ₹50 crore. Those are ceilings ("may extend to"), and a MeitY notice describes the Board as empowered to impose monetary penalties, but they explain why the security and breach rows should be the first software purchases.
The dates that matter in the 2027 buying season
Rule 1 of the Gazette notification staggers commencement. Rules 1, 2 and 17 to 21 came into force on publication. Rule 4, covering Consent Manager registration, comes into force one year after publication, which is 13 November 2026. Rules 3, 5 to 16, 22 and 23, which hold the notice, security, breach, retention, children's data, rights and Significant Data Fiduciary duties, come into force eighteen months after publication, which we calculate as 13 May 2027. A PIB release dated 5 August 2026 still describes a phased implementation over an eighteen-month transition period, so we found no change to that schedule. Check the MeitY website for any later amendment before you finalise contracts.
For a company that plans a purchase in 2027, this means procurement and configuration work should finish in the first half of the year, not the end of it. A realistic project (inventory, notice rewrite, consent configuration, rights workflow, breach runbook) takes several months, and vendors will be busiest in the months before the date.
A Consent Manager is not a consent-management tool
This is the most common mistake in vendor conversations. Under section 2(g) of the Act, a "Consent Manager" is a person registered with the Board who acts as a single point of contact enabling a Data Principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. Rule 4 and the First Schedule set the conditions for registration: an Indian-incorporated company with sound financial condition, net worth of not less than two crore rupees, and independent certification of its platform. Businesses are not obliged to use one; section 6(7) says a Data Principal may manage consent through a Consent Manager.
A consent management platform that you install on your own site is different: it helps you, the Data Fiduciary, collect and prove consent. Treat any vendor that describes its software as a "consent manager" with care, and ask whether it is, or plans to be, registered with the Board after Rule 4 starts on 13 November 2026.
What to expect from the software options
All the vendors below say on their own pages that they support DPDP. Their pages describe the following, and in each case pricing is quoted by the vendor unless stated.
- PrivacyEngine. Its India page describes a unified privacy operations platform for the DPDPA and DPDP Rules, "from consent notices to breach reporting, children's data, and data principal rights". It mentions multilingual notices, a consent ledger tracking every opt-in and withdrawal, request workflows with SLAs and audit history, and guided incident playbooks that trigger breach notifications.
- Ardent Privacy. Lists products for privacy automation, data discovery, data subject access requests, consent management, data minimisation, breach management and cookie consent, plus a DPDPA solution page that was last reviewed in September 2026. Its site says pricing is aligned to business needs rather than listing prices.
- OneTrust. Its DPDPA page says it covers protecting personal data, automating consent and Data Principal rights requests, strengthening governance and streamlining breach response.
- TrustArc. Its page lists a Cookie Consent Manager, a Consent and Preference Manager and an Individual Rights Manager, and says users can track DPDP Act and Rules compliance against pre-defined controls.
- Securiti. Its page lists data discovery and classification, consent management for first and third parties, mobile app consent management, and breach impact analysis with automated notifications to affected individuals.
- iubenda. A cookie and policy generator with published prices. Per its pricing page's USD figures for yearly billing, the Essentials plan is $5.99 per site per month (up to 25K pageviews), Advanced is $24.99 and Ultimate is $99.99, with charges of €0.05 per 1,000 pageviews beyond a plan's quota. The pricing page names EU GDPR, UK GDPR and Brazil's LGPD and does not mention DPDP, so use it for the cookie layer only and write DPDP notices separately.
For stopping data from leaving the company, data loss prevention (DLP) tools sit in the security stack. Forcepoint describes its DLP as unified data security across AI, cloud, web, email and endpoint with pre-defined policy templates by region, and Netskope publishes a Data Loss Prevention product page. Neither is a DPDP tool by itself, but they help satisfy the "reasonable security safeguards" duty of section 8(5) and Rule 6. For GDPR automation across regions, ask the privacy platforms above for their multi-law templates rather than buying separate products. Our guide to SOC 2 and ISO 27001 automation covers the audit-readiness layer, and CERT-In rules for Indian SaaS firms covers incident reporting to CERT-In, which is separate from reporting to the Board.
Three scenarios, three different answers
A 40-person Pune D2C brand collects names, phone numbers and addresses through its online store and runs WhatsApp campaigns. Its biggest gaps are the consent notice, a deletion process and a rights channel. It probably needs a lightweight consent and request workflow plus a clear retention rule (for example, delete abandoned-cart data after a defined period), not an enterprise platform. Our guide to email marketing software pricing is relevant to the tools holding the mailing list.
A Hyderabad edtech serving school students processes children's data. Section 9 requires verifiable parental consent and bars tracking, behavioural monitoring and targeted advertising directed at children, and Rule 10 requires due diligence that the person claiming to be the parent is an identifiable adult, by reference to reliable details already held or details issued by an authorised entity, including through a Digital Locker service provider. PIB notes limited exemptions for essential purposes such as healthcare, education and real-time safety; they sit in the Fourth Schedule with conditions, so get legal advice before relying on one. Software with a verifiable-consent flow matters more here than a cookie banner.
A Chennai IT-services firm processing overseas users' data under contracts with foreign clients may fall under section 17(1)(d), which disapplies most of Chapter II, Chapter III and section 16 where personal data of Data Principals outside India is processed under a contract with a person outside India. Sections 8(1) and 8(5) still apply, so the firm still owns security safeguards. Confirm the position with counsel before concluding that it can skip any tooling.
Also note section 17(3), which lets the Central Government notify certain Data Fiduciaries "including startups" as exempt from some provisions (section 5, section 8(3) and (7), and sections 10 and 11). The Act says exemption applies only once notified, so do not assume your company is covered.
Questions that separate real DPDP support from marketing
- Can notices be produced in English and Eighth Schedule languages, and are they stored as versions with timestamps, so you can prove which text a person saw?
- Does withdrawal propagate to processors, such as your email tool and CRM, within a reasonable time (section 6(6))?
- How are request deadlines tracked against the 90-day outer limit in Rule 14(3)?
- Can the breach module produce the Rule 7 content: nature, extent, timing, consequences, mitigation, safety measures and a business contact point?
- Are logs retained for a year (Rules 6 and 8(3)), and is that retention also required from your cloud provider? The Rules' own illustration says a company using a cloud service provider as Data Processor must ensure it retains data and associated logs for at least one year.
- Where is data stored? Rule 15 allows transfers outside India subject to requirements the Government may specify, and Rule 13(4) lets the Government restrict specified data of Significant Data Fiduciaries to India. Read our guide to data residency for SaaS in India before choosing a hosting region.
A rollout plan from now to May 2027
- Now to December 2026: map every system that holds customer or employee data (billing, CRM, HRMS, support, marketing). Section 7(i) treats processing for employment purposes as a legitimate use, so employee data is simpler than customer data, but it still needs safeguards. Review vendor contracts for processor terms (section 8(2) requires a valid contract with processors).
- January to February 2027: rewrite notices, add Eighth Schedule language versions where your customers need them, and switch on consent logging.
- March 2027: set up the rights and grievance channel, publish contact details (Rule 9) and test a mock breach with the Rule 7 template.
- April 2027: apply retention and erasure rules, check logs, and train staff. Use password managers and access controls for the basics, with backup and recovery in place for Rule 6(1)(d).
Who can wait? A business that processes no customer data digitally (a purely offline shop with paper records) is outside the Act's scope for that data, because section 3 covers digital personal data and data digitised later.
FAQs
What is DPDP Act compliance software?
It is software that helps a Data Fiduciary meet the Act and Rules: itemised notices, consent records, rights and grievance workflows, breach reporting and retention. Vendors such as PrivacyEngine, Ardent Privacy, OneTrust, TrustArc and Securiti each describe DPDP-specific modules on their own pages.
When do the DPDP Rules apply to my business?
Under Rule 1, the notice, security, breach, retention, children's data and rights duties (Rules 3, 5 to 16, 22 and 23) apply eighteen months after the 13 November 2025 publication, which we calculate as 13 May 2027. Rule 4 on Consent Managers applies one year after publication.
Is a cookie banner enough for the DPDP Act?
No. A banner covers one collection point. The Act also needs itemised notices, proof of consent, withdrawal, a rights channel, security safeguards, breach reporting and erasure. Tools like iubenda cover the cookie layer and list GDPR, UK GDPR and LGPD on their pricing page, not DPDP.
What is the penalty for not reporting a breach under the DPDP Act?
The Schedule to the Act says breach of the duty to give the Board and affected Data Principals notice of a personal data breach may attract a penalty extending to ₹200 crore. Failure to take reasonable security safeguards may extend to ₹250 crore.
Do I need a DLP tool for the DPDP Act?
The Act does not name DLP. It requires reasonable security safeguards to prevent personal data breach (section 8(5)), and Rule 6 lists minimum measures such as encryption, access control, logs and backups. DLP tools such as Forcepoint and Netskope support those measures but do not replace consent and rights workflows.
Next step: get a free matched shortlist, or compare more in cybersecurity.
