# DPDP consultant vs software vs law firm: who do you actually need? Source: https://dpdp.miravlabs.com/dpdp-consultant-vs-software-vs-law-firm/ · Updated 2026-11-13 · DPDP Ready by Mirav Labs **Short answer:** Most companies are likely to need a mix. A law firm gives legal opinions and drafts contracts. Compliance software, such as a consent management platform, handles consent capture and rights requests at volume. An implementation partner maps your data and builds the controls the DPDP Act and Rules require inside your own systems: notices, consent records, one-year logs, erasure, breach response and vendor terms. Which mix fits depends on your size, your role and how much personal data your product touches. ## In plain words DPDP compliance mixes law, technology and day-to-day operations. A law firm, a software product and an implementation partner are each good at different parts of it. Pick the wrong one and you get gaps, such as a well-written privacy policy sitting on top of a database that never deletes anything. - **2 or 3** of these working together is the usual answer - **1 year** of logs your own systems must keep - **13 May 2027** when the main duties apply ### What it means for you - A law firm tells you what the law means for your business, drafts notices and contracts, and handles disputes. It does not usually change your database or deletion jobs. - Compliance software collects consent and handles customer requests at large volume. It cannot decide your purposes, or delete data from systems it is not connected to. - An implementation partner maps your data and builds the controls inside your systems: logs, deletion, breach drills and the proof that they work. - Consent software you buy is not a "consent manager". That is a separate company registered with the Data Protection Board, the new regulator, and it works for the person. **Example:** A lending app in Bengaluru uses a law firm to check how banking regulations sit alongside DPDP. It uses consent software to collect consent from lakhs of users in Hindi and Kannada. An implementation partner connects that software to every system and fixes logs and deletion. ### What to do - List what you need: legal advice, consent at large scale, or changes inside your systems. - Match the mix to your size. A startup often needs a checklist and a short build sprint; a regulated enterprise usually needs all three. - Ask each provider which parts they will cover and who will make the changes in your systems. - Ask what proof you will hold at the end. - Ask for a fixed fee against a written scope. The law: the DPDP Act, 2023 and the DPDP Rules, 2025. Core duties apply from 13 May 2027. ## The detailed guide ## Key takeaways - It is rare for one type of provider to cover the whole Act: legal interpretation, product changes and ongoing operations are different skills. - Software captures consent and routes requests; it cannot decide your purposes, roles or retention, or erase data from systems it does not control. - A consent management platform you buy is not a consent manager registered with the Board under Rule 4. - Startups can often pair a checklist with a short implementation sprint; regulated enterprises usually need all three. - Whoever you choose, ask what evidence you will hold at the end. DPDP compliance touches law, product and operations at once, and different providers are good at different parts. Buying the wrong one leaves gaps: a well-drafted privacy policy over a database that never deletes anything, or a consent banner with no record of what anyone agreed to. This guide splits the work by who does it best. ## Who does what in a DPDP programme? ## When a law firm is the right call - You need a view on whether a [section 7 legitimate use](https://dpdp.miravlabs.com/guides/dpdp-consent/) covers a purpose. - Sector rules (banking, insurance, health) sit alongside DPDP and you need to know which applies. - Contracts with customers or vendors are being negotiated, or you face a complaint or dispute. Lawyers are not usually the people who change your database schema, log pipeline or deletion jobs. Pair them with whoever will. If you are a law firm, see [how we work with legal teams](https://dpdp.miravlabs.com/partners/). ## When compliance software is the right call - You collect consent from large numbers of people on web and mobile, in several languages. - You expect a steady flow of access and erasure requests and want a portal and a queue. - You need cookie and tracker consent across many sites. Software is only as good as what it is connected to. A request portal that deletes a record in one tool, while copies remain in your warehouse, support desk and backups, is unlikely to meet [section 8(7)](https://dpdp.miravlabs.com/guides/dpdp-data-retention/). Remember too that a platform you buy is not a [consent manager registered under Rule 4](https://dpdp.miravlabs.com/guides/dpdp-consent-manager/). ## When an implementation partner is the right call - Your product, app or platform is where the personal data lives. - You are a processor for business customers and need tenant-level controls. See [DPDP for SaaS](https://dpdp.miravlabs.com/guides/dpdp-for-saas/). - You need evidence that controls work: consent records, one-year logs, erasure logs, a drill report. - Your engineering team is busy and May 2027 is close. ## Which mix fits your company? StartupB2B SaaSConsumer app or D2CRegulated enterprise Typical mix - Checklist and a short assessment - An implementation sprint for notices, consent, logs and erasure - Counsel reviews the notice and key contractsWatch for - Analytics and marketing tools collecting more than you think - Vendors without contracts Typical mix - Implementation partner for role mapping, tenant controls and evidence - Counsel for customer and sub-processor terms - Software optional, for request routing at volumeWatch for - Being a fiduciary for your own users and a processor for customer data - Breach notice timelines in customer contracts Typical mix - Consent software for scale, in several languages - Implementation partner to connect it to every system and fix retention and logs - Counsel for marketing and partner-sharing purposesWatch for - Children among your users (section 9) - Third Schedule erasure if you reach 2 crore users as an e-commerce entity Typical mix - Counsel for sector rules and regulator engagement - Implementation partner for the build and evidence - Software for consent and requests at volume - A managed privacy office for ongoing operationsWatch for - Possible designation as a [Significant Data Fiduciary](https://dpdp.miravlabs.com/guides/significant-data-fiduciary/) - Stricter sector rules continuing to apply ## Questions to ask any provider - Which parts of the Act and Rules will you cover, and which will you leave to someone else? - Who will make the changes in our systems? - Which section or Rule is each recommendation based on? - What evidence will we hold at the end? - Is the fee fixed, against a written scope? ## What to do next Read [how to choose a DPDP consultant](https://dpdp.miravlabs.com/dpdp-consultant/), check [what drives cost](https://dpdp.miravlabs.com/dpdp-compliance-cost/), or [book a scoping call](https://dpdp.miravlabs.com/#contact). We aim to tell you honestly which mix your company needs, including the parts we would not do ourselves. ## Frequently asked questions ### Do I need a lawyer for DPDP compliance? You need legal advice for questions of interpretation: whether a legitimate use applies, how sector rules interact with DPDP, contract terms and disputes. You do not need a lawyer to build consent records, set log retention or run erasure jobs. A common approach is to use counsel for opinions and an implementation partner for the build. ### Is DPDP compliance software enough? Usually not on its own. Software helps with consent capture, preference centres and rights request portals. The Act also needs a data map, a lawful ground for each purpose, Rule 6 safeguards in your systems, a breach process meeting Rule 7, retention and erasure, and processor contracts. ### Is a consent management platform the same as a consent manager under DPDP? No. A consent manager is a company registered with the Data Protection Board under Rule 4 and the First Schedule, acting for the individual. A consent management platform is software a company buys to collect and record consent. See consent managers explained. ### Can a Big Four or advisory firm do DPDP implementation? Large advisory firms offer DPDP assessments and programmes, and some deliver the build themselves or with technology partners. Ask any provider who will make the changes in your systems and what evidence you will have at the end. ### What mix suits a startup? A startup with one product can often start with the checklist, a short assessment and an implementation sprint, with counsel reviewing the notice and contracts. Software becomes worth it once consent and request volumes grow. ### What does DPDP Ready do and not do? We are an implementation team: data mapping, role mapping, gap assessment, building controls in your systems, evidence, and a managed privacy office. We work alongside your counsel and do not give legal opinions. We aim to work with the consent or request software you already use.