There is no fixed price for DPDP compliance. The cost depends less on how many people you employ and more on how many places your customers' data sits. A 40-person software company with 30 data stores can have more work than a 400-person retailer with one billing system and a website.
What it means for you
- The biggest cost is the number of systems holding personal data. Each one needs mapping, deletion and logs.
- Every product and every purpose adds work: a reason for using the data, a line in the notice, and a time limit for keeping it.
- Handling data for business customers, or holding children's, health or financial data, adds more.
- Existing ISO 27001, SOC 2 or GDPR work can cut the effort noticeably.
- After the build, smaller running costs remain: customer requests, complaints, and reviews of new features and vendors.
What to do
- Use the scope estimator further down this page to see the likely size of your programme.
- Collect less. Every field you drop is one less to protect, keep track of and delete.
- Fix your logs first. The rules require logs to be kept for at least a year, and setting that up takes time.
- Buy software for routine parts like consent capture, and build what is specific to your own systems.
- Ask for a fixed fee against a written scope, after a scoping call.
The law: the DPDP Act, 2023 (penalties in its Schedule) and the DPDP Rules, 2025. Core duties apply from 13 May 2027.
DPDP compliance cost depends mainly on how many systems hold personal data, how many products and purposes you run, whether you are also a processor for business customers, and whether you handle children's or financial data. As a guide to effort, a readiness assessment typically takes 3 to 4 weeks and an implementation programme 10 to 16 weeks for a single-product company. The Act caps the penalty for each breach, at up to ₹250 crore for security failures, and the Board decides the amount.
Key takeaways
- Typically, the biggest cost driver is the number of systems that hold personal data, not company headcount.
- One-time work (data map, notices, consent, safeguards, erasure, breach readiness) is followed by smaller ongoing costs (rights requests, grievances, reviews).
- Software can lower the cost of consent capture and request handling, but someone still has to decide purposes, roles and retention.
- Starting early is cheaper: the data map and log retention take calendar time you cannot buy back in April 2027.
- Ask for a fixed fee against a written scope, after a scoping call.
“How much will DPDP cost us?” is usually the first question a CFO asks, and the honest answer is that it depends less on company size than on the shape of your data. A 40-person SaaS company with 30 data stores and enterprise customers has more work than a 400-person retailer with one ERP and a website. This guide explains the drivers, separates one-time from ongoing costs, and gives you a free estimator for the size of your programme.
Estimate the size of your DPDP programme
Answer six questions. The estimator gives a programme size, a typical timeline and the engagement that usually fits. It runs in your browser and nothing is sent.
- Assessment
- 3 to 4 weeks
- Implementation
- 10 to 16 weeks
- Workstreams
- 8
- Usually fits
- Implementation programme
What drives DPDP compliance cost?
| Driver | Why it matters | Effect on effort |
|---|---|---|
| Systems holding personal data | Each one needs mapping, retention, erasure and logging | The largest single driver |
| Products and purposes | Each purpose needs a lawful ground, a notice entry and a retention period | Grows with every product and use |
| Processor role for customers | Adds processing terms, tenant-level controls and customer breach notice | Adds a full workstream |
| Children's, health or financial data | Verifiable parental consent, sector rules alongside DPDP, a higher penalty ceiling for children's obligations | Adds design and review time |
| Legacy and spreadsheets | Hard to map and harder to erase from | Often the slowest part |
| Existing security baseline | ISO 27001, SOC 2 or GDPR work covers much of Rule 6 and the data map | Can cut effort noticeably |
| Number of vendors | Each processor needs a contract and a place on the register | Mostly calendar time |
One-time costs vs ongoing costs
One-time (assessment and build)
- Data map and role map
- Itemised notices and consent records
- Rule 6 safeguards, including one-year logs
- Retention schedule and erasure across systems
- Rights request workflow
- Breach runbook and a tabletop drill
- Processor contracts and vendor register
- Training and the evidence pack
Ongoing (operate)
- Rights requests, and grievances within your published period (90 days at most)
- Privacy review of new features and vendors
- Notice updates when purposes change
- Control testing and log review
- Breach on-call and drills
- Annual DPIA and data audit if notified as an SDF
- Watching for new notifications and orders
How long does DPDP compliance take?
For a single-product company, a readiness assessment typically takes 3 to 4 weeks and an implementation programme 10 to 16 weeks. Several products, a processor role or legacy systems push implementation toward 16 to 24 weeks. Some things take calendar time you cannot compress: log pipelines that keep a year of data take time to build and prove, and vendor contracts move at your vendors' pace. The implementation roadmap shows how to sequence the work in the time left.
The Data Protection Board is established and Rules 1, 2 and 17 to 21 apply. Its members are yet to be appointed.
Rule 4 applies: consent managers can register with the Board and start carrying people's consents to businesses.
Notice, consent, security safeguards, breach intimation, retention, rights, grievances, children and cross-border rules.
How to keep the cost down
- Collect less. Every field you stop collecting is a field you never have to notice, protect, retain or erase.
- Use legitimate uses where they genuinely apply. Section 7 grounds, such as employment or data provided voluntarily for a specified purpose, avoid unnecessary consent flows.
- Reuse what you have. ISO 27001, SOC 2 and GDPR work maps onto much of Rule 6 and the record of processing.
- Fix logs first. One-year retention and masking identifiers in logs are cheap now and expensive later.
- Buy where it is commodity, build where it is yours. Consent capture and request portals can be bought; purposes, retention and erasure in your own systems cannot.
- Insist on a fixed fee. A written scope and a fixed price keep the programme from drifting.
What non-compliance can cost
The Schedule to the Act sets the maximum penalty for each breach. The Board weighs the factors in section 33(2), including gravity, duration, repetition and mitigation, when it sets the amount.
A breach report, a complaint, or a reference from the government or a court
If there are not enough grounds, the Board closes it
Run on natural justice. You are heard before any penalty
Seven factors, up to the ceiling for that breach
To the Appellate Tribunal within 60 days of the order
What to do next
- Run the estimator above and note your programme size.
- Take the readiness check to see which gaps are open.
- Book a 30-minute scoping call for a fixed-fee proposal, usually within three working days.
Frequently asked questions
How much does DPDP compliance cost for a startup?
For a startup with one product and a modern stack, the work is mostly a data map, notices and consent, a rights workflow, retention and a breach runbook, and it is usually at the small end of the range. Use the scope estimator on this page for a size band, then get a fixed quote after a scoping call.
How much does a DPDP gap assessment cost?
The price depends on how many systems and purposes need assessing. As a guide to effort, a readiness assessment typically takes 3 to 4 weeks and ends with a data map, a role map, a gap report and a costed roadmap. DPDP Ready usually quotes a fixed fee within three working days of a scoping call.
How long does it take to become DPDP compliant?
Typically 10 to 16 weeks of implementation for a single-product company after a 3 to 4 week assessment, and longer for several products or legacy systems. The core obligations apply from 13 May 2027.
Is DPDP compliance software cheaper than a consultant?
For consent capture and rights requests at volume, software can be cheaper than building your own. It does not map your data, decide your lawful grounds, set retention or fix logging and erasure in your systems. Many companies end up with some of both. See consultant vs software vs law firm.
What are the ongoing costs after implementation?
Handling rights requests and grievances, privacy review of new features and vendors, refreshing notices when purposes change, control testing, and an annual DPIA and data audit if you are notified as a Significant Data Fiduciary.
What does non-compliance cost?
The Schedule to the Act sets maximum penalties per breach: up to ₹250 crore for failing to take reasonable security safeguards, ₹200 crore for failing to notify a breach or for children's obligations, ₹150 crore for SDF obligations and ₹50 crore for anything else. See DPDP penalties.
Turn this guide into a working programme
A 30-minute scoping call maps your gaps against the Rules and the order to close them. We aim to send a proposal, usually at a fixed fee, within three working days.
Related guides
This guide explains the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 as notified on 13 November 2025. It is general information, not legal advice. Check the official text, and your counsel, before relying on it.