DPDPA compliance help compared: software tools, consultant audits and law firms

There are three kinds of outside help for DPDPA compliance, and they do different jobs. Software (a consent management platform or privacy suite) runs part of the work for you, mostly consent and rights requests. A consultancy’s gap assessment checks what you have against the Act and the Rules and gives you a plan. A law firm interprets the law, drafts the legal documents and represents you if the Board opens an inquiry. None of them takes the duty off you: the Act keeps the Data Fiduciary responsible “irrespective of any agreement to the contrary” (S.8(1)). For most companies of 5 to 200 people the answer is a mix, bought in a sensible order.

Part of the DPDPA checklist for small companies. We are one of the consultancies on this page, so we have kept to what each provider’s own public pages say, linked each one, and said where we are not the right choice.

What does each kind of DPDPA help actually do?

Software tools are products you subscribe to or install. Most DPDPA compliance tools sold in India are consent management platforms: a banner or in-app flow that shows the notice and captures consent per purpose, a record of every consent and withdrawal, and a preference centre where people can change their mind. Many add rights-request workflows, and some add data discovery, records of processing and incident workflows.

Consultancies sell a project. The usual first step is a gap assessment: they map what personal data you hold and where it goes, compare your notices, consent, security, contracts and processes against the Act and the Rules, and hand you a prioritised list. Some then help implement the fixes, or stay on as a part-time privacy office.

Law firms sell advice. They tell you how the law applies to your facts, draft or review privacy notices, policies and data processing agreements, and defend you in a proceeding before the Board or an appeal to the Appellate Tribunal (S.28, S.29).

One point causes confusion. A consent management platform is software you deploy for your own consent records. A Consent Manager under the Act is a company registered with the Board that lets people manage consent across many Data Fiduciaries (S.2(g), S.6(9)). Registration requires, among other conditions, a company incorporated in India with a net worth of at least ₹2 crore (First Schedule, Part A, items 1 and 4). The registration rule comes into force on 13 November 2026 (Rule 1(3)), and the Board publishes the particulars of each Consent Manager it registers on its website (Rule 4(2)(a)). Using a Consent Manager is optional: a Data Principal “may” use one (S.6(7)).

DPDPA compliance tools: consent management platforms and privacy suites

Here is what each provider’s own page said when we read it on 25 October 2026 and re-checked it on 5 November 2026.

OneTrust. Its India DPDPA page describes automated consent collection and withdrawal across digital channels; access, correction, erasure and grievance requests through its DSAR automation; control frameworks mapped to the DPDPA for finding gaps; data discovery and mapping; vendor risk management; and automated detection, assessment and reporting of personal data breaches. Does well: breadth, with many privacy jobs on one platform. Suits, in our view: companies with a privacy or security team to run it, especially those that also handle other countries’ privacy laws. Price: not published on the page; it offers a demo and a sales contact.

CoTrust by Digio. Digio describes timestamped, purpose-linked, tamper-evident consent records, withdrawal that updates connected systems in real time, a consent and rights-request dashboard, a privacy preference centre, data discovery and records of processing, and SDKs and APIs. Its FAQ says it supports age-gating and verifiable parental consent flows. Digio also publishes a clear explanation of the difference between a consent management platform and a registered Consent Manager. Does well: consent at the engineering level, with downstream propagation. Suits: product companies with engineers to integrate it; the page names SaaS, fintech and B2B platforms. Price: not published; the page describes a flat recurring fee for SaaS and on-premise pricing by profiles and connectors.

Digital Anumati (AbyM Technology Pvt. Ltd., Noida). Its page describes purpose-level consent with versioned receipts, notices in 22+ Indian languages, access, correction, erasure and nomination requests with SLA tracking, built-in grievance workflows, cookie scanning, an audit ledger, and an incident and breach management module; its education offering includes student and parent consent. Does well: it puts consent, rights, grievances and cookies in one product, and it publishes its prices. Suits: SMEs and regulated sectors it names (BFSI, healthcare, education, manufacturing). Price: published: a Free plan at ₹0 a month (one website or app, 3,000 consent collections a month), a Growth plan at ₹9,999 a month, and Enterprise on quote; taxes are billed separately.

DPDPA Compliance India (WordPress plugin). A free, open-source plugin with a consent banner, a privacy notice generator, a form for access, correction and erasure requests, and logging of consent decisions; data mapping is listed as coming soon. Its FAQ tells users to consult legal counsel on whether their overall processes meet the Act. Does well: costs nothing and keeps data in your own WordPress database. Suits: a small marketing site on WordPress. Price: free download.

Consultancies offering a DPDPA gap assessment

KPMG in India. Its DPDP advisory page lists a readiness assessment against the Act and the Rules, controls to secure the personal data lifecycle, design of consent mechanisms, notices, grievance redressal and rights fulfilment, privacy by design in technology stacks, and privacy managed services to run the privacy office. Does well: a multidisciplinary team covering strategy, operating model and technology from one supplier. Suits: organisations that want the whole programme, including an ongoing managed service. Price: not published.

Tranquility Cybersecurity (TCSA). Its page offers a free DPDP assessment, then data mapping and gap analysis, privacy notices, a consent framework, a privacy centre, vendor DPA templates, training and a breach response playbook, with DPIA work, vendor risk assessments and, at its enterprise tier, independent data auditor services. TCSA also lists VAPT and CERT-In audits among its wider services. Does well: it publishes tiers, timelines and fees. Suits: it names startups and small companies under 50 employees, MSMEs and mid-market firms of 50 to 500, and enterprises and SDFs of 500 or more. Price: published as indicative fees of ₹1.5–2 lakh (under 50 employees, 8–10 weeks), ₹2–4 lakh (50–500, 12–14 weeks) and ₹5–7 lakh (500 or more, 16 weeks or longer), with final pricing confirmed after a free scoping assessment.

CyberCure. Its page describes a readiness assessment against the Act’s consent framework, fiduciary and processor obligations and SDF requirements where applicable, plus consent artefact design, grievance mechanism design, a breach notification process aligned to Board reporting, cross-border transfer review, DPIAs for SDFs, and DPDP readiness run alongside ISO 27001. Does well: pairing DPDPA with ISO 27001 so evidence is gathered once. Suits: companies already working toward ISO 27001, GDPR or CCPA. Price: not published; it says it scopes engagements within 24 hours.

StateCheck Security (us). We are a small consultancy that does VAPT, source code review and threat modelling, and DPDPA gap checks and audits. Where we differ is that our DPDPA work tests the technical side: whether the safeguards Rule 6 lists (encryption or masking, access control, logs and monitoring, backups) are actually in place in your systems, not only written into a policy. Our free DPDP Gap Identifier points to the three obligation areas worth your attention first. A paid DPDPA readiness assessment gives you a gap matrix mapped to the applicable sections of the Act, a populated record of processing, a breach response playbook for both Rule 7 clocks and a six-month implementation roadmap. It takes 8–16 weeks for most mid-sized organisations, and we price it after a free 30-minute scoping call. We are not a law firm and do not give legal advice.

Law firms offering DPDPA advisory

Khaitan & Co. Its data privacy and protection page lists regulatory compliance and transaction advice, drafting and review of policies and data processing agreements, cross-border transfers and government access requests, data security, breach notification and data retention, and defence in investigations and proceedings about privacy violations or security failures. Does well: a full-service firm that can handle the legal side of a breach and any proceeding that follows. Suits: the page describes multinational and domestic companies across many sectors. Fees: not published.

Ikigai Law. Its data practice describes gap assessments, advice on the front-end and back-end changes needed to comply with data protection laws, policies for data classification, access control and incident response, and contracts such as privacy policies and data processing agreements, alongside public policy and government relations work. Does well: pairing legal advice with practical product changes. Suits: technology companies; its site presents fintech, e-commerce and other technology case studies. Fees: not published.

AMLEGALS. Its DPDPA page describes advice on the obligations of Data Fiduciaries and Data Processors, drafting data processing agreements and data protection policies, grievance redressal mechanisms, DPIAs, cross-border transfer compliance and arbitration of data privacy disputes. Does well: a DPDPA-specific practice page with contract and dispute work. Suits: the page addresses businesses operating in India or handling Indian citizens’ data. Fees: not published.

Which DPDPA obligations does each approach cover?

This is the comparison by obligation, for a typical provider of each type. Individual providers differ, so check the scope you are offered against these rows.

Obligation	Software tool	Consultant gap assessment	Law firm advisory
Notice (S.5, Rule 3)	Serves and versions the notice; some generate a draft	Checks your notice against Rule 3’s items; may draft it	Drafts or signs off the wording
Consent and withdrawal (S.6)	Strongest area: captures consent per purpose, records it, honours withdrawal	Checks your consent flows and records	Advises on the lawful ground (consent or a S.7 legitimate use)
Security safeguards (S.8(5), Rule 6)	Secures its own platform; does not secure your systems	Assesses the Rule 6(1)(a)–(g) items; a technical consultant tests them	Drafts the processor contract clauses Rule 6(1)(f) asks for
Personal data breach intimation (S.8(6))	Some offer an incident workflow and templates	Runbook, templates, a rehearsal against both clocks	Drafts intimations; represents you if the Board inquires (S.27(1)(a), S.28)
Erasure and log retention (S.8(7), Rule 8(3))	Automates deletion of the data it holds and records requests	Checks retention across your systems and processors	Advises which other laws require you to keep data longer
Grievance and contact person (S.8(9), S.8(10), Rule 9, Rule 14(3))	Grievance and rights-request workflows	Checks you publish a contact and answer within the period you set	Drafts the policy and response wording
Children’s data (S.9, Rule 10)	Some offer age gates and parental consent flows	Checks whether you process children’s data and how you verify parents	Advises on the Rule 12 exemptions and the Fourth Schedule
SDF duties (S.10, Rule 13)	Some offer DPIA templates	DPIA support; may act as the independent data auditor	Advises on SDF notification and the DPO role

What do providers’ own pages say they cover?

We marked, for each of the ten provider pages linked above, which of the eight obligation areas the page names as part of that provider’s own product or service.

Provider	Type	Notice	Consent	Safeguards	Breach intimation	Erasure	Grievance	Children	SDF duties	Areas
OneTrust	Tool		✓		✓	✓	✓			4
CoTrust (Digio)	Tool		✓					✓		2
Digital Anumati	Tool	✓	✓		✓	✓	✓	✓	✓	7
DPDPA Compliance India	Tool	✓	✓			✓				3
KPMG in India	Consultancy	✓	✓	✓			✓			4
TCSA	Consultancy	✓	✓		✓				✓	4
CyberCure	Consultancy		✓		✓		✓		✓	4
Khaitan & Co	Law firm			✓	✓					2
Ikigai Law	Law firm			✓	✓			✓		3
AMLEGALS	Law firm						✓		✓	2
Pages naming it		4	7	3	6	3	5	3	4

Method: we read the visible text of each provider page linked above on 25 October 2026, re-checked it on 5 November 2026, and ticked an area only where the page describes it as part of that provider’s own product or service, not where the page summarises the law. “SDF duties” counts DPIA, DPO or data audit work. A blank means the page does not say; it does not mean the provider cannot do it. StateCheck is excluded.

Two things stand out. No page names all eight areas, so whichever provider you pick, ask about the rows its page leaves blank. And security safeguards, the obligation with the highest maximum penalty in the Schedule (up to ₹250 crore, item 1), is named on 3 of the 10 pages and on none of the four tool pages.

What does each approach leave to you?

After buying DPDPA compliance tools, you still own the notice wording, the decision on which purposes need consent and which rest on a legitimate use, the security of every system outside the tool, the breach runbook, your processor contracts, and erasure in systems the tool is not connected to. The tool vendor is usually also your Data Processor, so it needs a valid contract with you (S.8(2)) and the security clauses Rule 6(1)(f) asks for.

After a gap assessment, you own the fixes. A report is a list of work: someone in your company, or the consultant on a follow-on engagement, has to change the notice, wire up withdrawal, add logging and sign the contracts. If the consultant does not give legal advice, legal questions in the report still need a lawyer.

After law firm advice, you own implementation. The firm can tell you what a notice must contain and draft it; it does not change your sign-up flow, configure access control or turn on logs. Rule 6 is largely engineering work.

What does a typical engagement look like?

	Software tool	Consultant gap assessment	Law firm advisory
What you buy	A subscription or licence	A fixed-scope project, sometimes a retainer after it	Advice on a matter, or a retainer
Who does the work	Your team configures and integrates it	The consultant assesses; you or they implement	Lawyers advise and draft; you implement
What you get	A running consent system and its records	A gap report and a prioritised plan	Opinions, notices, policies, contracts; representation
Time to first result	Digio says most teams integrate core consent capture within days	TCSA quotes 8–10 weeks to readiness for a company under 50 people	Depends on the matter; not published on these pages
Published prices	Digital Anumati: ₹0 and ₹9,999 a month plans; others not published	TCSA: indicative ₹1.5–2 lakh (under 50 people) to ₹5–7 lakh (500 or more); others not published	Not published by any of the three

When is each the right choice?

Choose DPDPA compliance tools when your main exposure is consent at scale: a consumer app or website where many people sign up, you rely on consent for marketing or analytics, and you need proof of each consent and withdrawal (S.6(10) puts the burden of proof on you). If you run a small WordPress site, a free plugin or a free tier may be enough to start.

Choose a consultant’s gap assessment when you don’t yet know what is missing. Most companies of 5 to 200 people are here: data in a CRM, a payroll provider, a cloud database and a few spreadsheets, and no one has mapped it. A gap assessment turns the eleven obligations on the DPDPA checklist into an ordered list for your company. Choose a consultant who can test technical controls if your product handles customer data, because Rule 6 and breach intimation depend on logs, access control and backups that only show up when someone looks at the systems.

Choose a law firm when the question is legal: whether a processing purpose can rest on a legitimate use instead of consent (S.7), whether a children’s data exemption applies to you (Rule 12, Fourth Schedule), how to word a notice or contract you will rely on, or how to respond after a personal data breach is intimated and the Board inquires (S.27(1)(a)). If you are notified as a Significant Data Fiduciary, you will want legal advice on the DPO role and on Rule 13.

When StateCheck is not the right choice. We are a security consultancy, not a law firm. Go elsewhere if:

• you need a legal opinion, contract drafting or representation before the Board: hire a law firm;
• all you need is a consent banner and preference centre on your website: a tool, perhaps on a free tier, is cheaper than a consultant;
• you want one supplier to run privacy across several countries’ laws on one platform: a larger consultancy or privacy suite fits better;
• you have been notified as a Significant Data Fiduciary and need an independent data auditor under S.10(2)(b);
• you are a very small company with a contact form and no product data: the free Gap Identifier and the checklist may be all you need for now.

Decision table

Your situation	Start with	Then
You don’t know what personal data you hold or what is missing	Free self-check, then a consultant gap assessment	Tool or law firm for the gaps it finds
Consumer app or site, many sign-ups, consent-based marketing	Consent management platform	Gap assessment of everything the tool does not touch
Product handles customer data; no security review in the last year	Consultant who tests technical controls (Rule 6)	Breach runbook and processor contracts
A specific legal question (legitimate use, children’s exemption, contract terms)	Law firm	Implement the advice in your systems
A personal data breach has happened	Your breach runbook, then a law firm for the Board intimation	Consultant for investigation and Rule 7(2)(b) report facts
Notified as a Significant Data Fiduciary	Law firm, plus an independent data auditor	DPIA and audit each year (Rule 13(1))
Under 10 people, website contact form only	Free Gap Identifier and the checklist	Revisit when you launch a product

How do you choose DPDPA help for a 5–200 person company?

1. Write down what personal data you hold and where. Customers, employees, leads; which systems and vendors hold each. Every option below goes faster with this list.
2. Run a free self-check first. Our DPDP Gap Identifier takes up to 15 questions and points to three areas; Digital Anumati and TCSA also advertise free starting points.
3. Decide what kind of gap you have. Mostly consent at scale points to a tool; unknown or technical gaps point to a consultant; legal questions point to a law firm.
4. Ask each provider about the obligations its page leaves blank. Use the eight rows above as your checklist and get the answers in the proposal.
5. Check who is the Data Processor. If a tool or consultant will hold your users’ personal data, sign a contract with the security clauses Rule 6(1)(f) asks for and an erasure clause (S.8(7)(b)).
6. Get the scope and price in writing. Where a price is not published, ask for it. Ask what you will have at the end: a running system, a report, or signed documents.
7. Set a date before 13 May 2027. That is when the core obligations apply (Rule 1(4)). Leave time to implement what the assessment or the lawyers tell you.

Related obligations

• The full checklist: all eleven obligations on one page.
• Breach intimation: the two clocks under Rule 7, and what to prepare.
• DPDP Gap Identifier: a free self-check of where to start.

Frequently asked questions

Does buying a consent management platform make us DPDPA compliant?

No. A consent management platform handles consent and often rights requests, but the Act also requires security safeguards across your systems (S.8(5), Rule 6), personal data breach intimation (S.8(6)), erasure (S.8(7)), a published contact person (S.8(9), Rule 9) and grievance redressal (S.8(10)). You stay responsible for all of it, including what your vendors do for you (S.8(1)).

Is a consent management platform the same as a Consent Manager?

No. A Consent Manager is a company registered with the Board (S.2(g), S.6(9)) that meets conditions such as a net worth of at least ₹2 crore (First Schedule, Part A). Registration rules apply from 13 November 2026 (Rule 1(3)). A consent management platform is software you deploy for your own records, and you can use one without any registration. Using a registered Consent Manager is optional (S.6(7)).

Do we need an annual DPDPA audit?

Only if you are a Significant Data Fiduciary, which the Central Government notifies (S.10(1)). An SDF must appoint an independent data auditor (S.10(2)(b)) and carry out a DPIA and an audit every twelve months (Rule 13(1)). Other companies have no statutory audit duty, though a periodic gap assessment is a sensible way to check you still meet the obligations.

Do we need a Data Protection Officer?

Only a Significant Data Fiduciary must appoint one (S.10(2)(a)). Every other Data Fiduciary publishes the business contact details of a person who can answer questions about its processing (S.8(9), Rule 9). That person can be someone already on your team.

Can a consultant replace a lawyer?

For finding and fixing operational gaps, often yes. For legal interpretation, drafting you will rely on in a dispute, or representation before the Board (S.28) or the Appellate Tribunal (S.29), no: that is a law firm’s work. Ask any consultant whether its report includes legal advice; ours does not.

How much does DPDPA compliance help cost in India?

Few providers publish prices. On the pages we read, Digital Anumati lists a free plan and a ₹9,999-a-month Growth plan, and TCSA lists indicative consulting fees from ₹1.5–2 lakh for a company under 50 employees to ₹5–7 lakh for an enterprise. The other providers on this page do not publish prices. We price each engagement after a free scoping call.

Which should a 20-person startup do first?

Map your personal data, run a free self-check, then fix what it finds in order of risk. If your product holds customer data, have its security controls checked early, because Rule 6 and Rule 7 depend on logs, access control and backups you can’t add overnight.

---

Provider details are from each provider’s own public pages as read on 25 October 2026 and re-checked on 5 November 2026, and may have changed since. Legal points checked against the DPDP Act, 2023 and the DPDP Rules, 2025 (G.S.R. 846(E), as corrected by G.S.R. 892(E)) on 25 October 2026. This page is general information, not legal advice.

Not sure which of the eleven obligations are still open for you? The free DPDP Gap Identifier walks through them. If you’d rather talk it through with an engineer, get in touch.