DPDP compliance mixes law, technology and day-to-day operations. A law firm, a software product and an implementation partner are each good at different parts of it. Pick the wrong one and you get gaps, such as a well-written privacy policy sitting on top of a database that never deletes anything.
What it means for you
- A law firm tells you what the law means for your business, drafts notices and contracts, and handles disputes. It does not usually change your database or deletion jobs.
- Compliance software collects consent and handles customer requests at large volume. It cannot decide your purposes, or delete data from systems it is not connected to.
- An implementation partner maps your data and builds the controls inside your systems: logs, deletion, breach drills and the proof that they work.
- Consent software you buy is not a "consent manager". That is a separate company registered with the Data Protection Board, the new regulator, and it works for the person.
What to do
- List what you need: legal advice, consent at large scale, or changes inside your systems.
- Match the mix to your size. A startup often needs a checklist and a short build sprint; a regulated enterprise usually needs all three.
- Ask each provider which parts they will cover and who will make the changes in your systems.
- Ask what proof you will hold at the end.
- Ask for a fixed fee against a written scope.
The law: the DPDP Act, 2023 and the DPDP Rules, 2025. Core duties apply from 13 May 2027.
Most companies are likely to need a mix. A law firm gives legal opinions and drafts contracts. Compliance software, such as a consent management platform, handles consent capture and rights requests at volume. An implementation partner maps your data and builds the controls the DPDP Act and Rules require inside your own systems: notices, consent records, one-year logs, erasure, breach response and vendor terms. Which mix fits depends on your size, your role and how much personal data your product touches.
Key takeaways
- It is rare for one type of provider to cover the whole Act: legal interpretation, product changes and ongoing operations are different skills.
- Software captures consent and routes requests; it cannot decide your purposes, roles or retention, or erase data from systems it does not control.
- A consent management platform you buy is not a consent manager registered with the Board under Rule 4.
- Startups can often pair a checklist with a short implementation sprint; regulated enterprises usually need all three.
- Whoever you choose, ask what evidence you will hold at the end.
DPDP compliance touches law, product and operations at once, and different providers are good at different parts. Buying the wrong one leaves gaps: a well-drafted privacy policy over a database that never deletes anything, or a consent banner with no record of what anyone agreed to. This guide splits the work by who does it best.
Who does what in a DPDP programme?
| Work | Law firm | Compliance software | Implementation partner |
|---|---|---|---|
| Interpret the Act and Rules for your business | Core strength | No | Applies counsel's reading |
| Draft notices, policies, processor contracts | Core strength | Templates | Drafts from your data map, for counsel to review |
| Map personal data across systems | Questionnaires | Some discovery tools | Core strength |
| Fiduciary or processor role map | Advises | No | Builds it with you |
| Collect and record consent | No | Core strength | Integrates or builds it |
| Rights request portal | No | Core strength | Integrates, and makes fulfilment reach every system |
| Rule 6 safeguards and one-year logs | No | No | Core strength |
| Retention and erasure in your systems | Sets the policy | Limited to its own data | Core strength |
| Breach runbook and Rule 7 notices | Reviews notices | Some workflow tools | Builds and drills it |
| Disputes, regulators, litigation | Core strength | No | Supplies the evidence |
When a law firm is the right call
- You need a view on whether a section 7 legitimate use covers a purpose.
- Sector rules (banking, insurance, health) sit alongside DPDP and you need to know which applies.
- Contracts with customers or vendors are being negotiated, or you face a complaint or dispute.
Lawyers are not usually the people who change your database schema, log pipeline or deletion jobs. Pair them with whoever will. If you are a law firm, see how we work with legal teams.
When compliance software is the right call
- You collect consent from large numbers of people on web and mobile, in several languages.
- You expect a steady flow of access and erasure requests and want a portal and a queue.
- You need cookie and tracker consent across many sites.
Software is only as good as what it is connected to. A request portal that deletes a record in one tool, while copies remain in your warehouse, support desk and backups, is unlikely to meet section 8(7). Remember too that a platform you buy is not a consent manager registered under Rule 4.
When an implementation partner is the right call
- Your product, app or platform is where the personal data lives.
- You are a processor for business customers and need tenant-level controls. See DPDP for SaaS.
- You need evidence that controls work: consent records, one-year logs, erasure logs, a drill report.
- Your engineering team is busy and May 2027 is close.
Which mix fits your company?
Typical mix
- Checklist and a short assessment
- An implementation sprint for notices, consent, logs and erasure
- Counsel reviews the notice and key contracts
Watch for
- Analytics and marketing tools collecting more than you think
- Vendors without contracts
Typical mix
- Implementation partner for role mapping, tenant controls and evidence
- Counsel for customer and sub-processor terms
- Software optional, for request routing at volume
Watch for
- Being a fiduciary for your own users and a processor for customer data
- Breach notice timelines in customer contracts
Typical mix
- Consent software for scale, in several languages
- Implementation partner to connect it to every system and fix retention and logs
- Counsel for marketing and partner-sharing purposes
Watch for
- Children among your users (section 9)
- Third Schedule erasure if you reach 2 crore users as an e-commerce entity
Typical mix
- Counsel for sector rules and regulator engagement
- Implementation partner for the build and evidence
- Software for consent and requests at volume
- A managed privacy office for ongoing operations
Watch for
- Possible designation as a Significant Data Fiduciary
- Stricter sector rules continuing to apply
Questions to ask any provider
- Which parts of the Act and Rules will you cover, and which will you leave to someone else?
- Who will make the changes in our systems?
- Which section or Rule is each recommendation based on?
- What evidence will we hold at the end?
- Is the fee fixed, against a written scope?
What to do next
Read how to choose a DPDP consultant, check what drives cost, or book a scoping call. We aim to tell you honestly which mix your company needs, including the parts we would not do ourselves.
Frequently asked questions
Do I need a lawyer for DPDP compliance?
You need legal advice for questions of interpretation: whether a legitimate use applies, how sector rules interact with DPDP, contract terms and disputes. You do not need a lawyer to build consent records, set log retention or run erasure jobs. A common approach is to use counsel for opinions and an implementation partner for the build.
Is DPDP compliance software enough?
Usually not on its own. Software helps with consent capture, preference centres and rights request portals. The Act also needs a data map, a lawful ground for each purpose, Rule 6 safeguards in your systems, a breach process meeting Rule 7, retention and erasure, and processor contracts.
Is a consent management platform the same as a consent manager under DPDP?
No. A consent manager is a company registered with the Data Protection Board under Rule 4 and the First Schedule, acting for the individual. A consent management platform is software a company buys to collect and record consent. See consent managers explained.
Can a Big Four or advisory firm do DPDP implementation?
Large advisory firms offer DPDP assessments and programmes, and some deliver the build themselves or with technology partners. Ask any provider who will make the changes in your systems and what evidence you will have at the end.
What mix suits a startup?
A startup with one product can often start with the checklist, a short assessment and an implementation sprint, with counsel reviewing the notice and contracts. Software becomes worth it once consent and request volumes grow.
What does DPDP Ready do and not do?
We are an implementation team: data mapping, role mapping, gap assessment, building controls in your systems, evidence, and a managed privacy office. We work alongside your counsel and do not give legal opinions. We aim to work with the consent or request software you already use.
Turn this guide into a working programme
A 30-minute scoping call maps your gaps against the Rules and the order to close them. We aim to send a proposal, usually at a fixed fee, within three working days.
Related guides
This guide explains the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 as notified on 13 November 2025. It is general information, not legal advice. Check the official text, and your counsel, before relying on it.