Much of what the DPDP Act asks for is done inside your systems, not in a policy document. Consent records, deleting data on time, keeping logs and handling a data leak all need working software and clear processes. A good consultant finds where your customers' data sits, fixes the gaps, and leaves you with proof that it works.
What it means for you
- You may not need outside help. A small business with one simple website can often work from a checklist.
- You usually do need help if you run an app or software product, hold data on lakhs of people, handle children's, health or financial data, or handle data for business customers.
- Good help builds things in your systems: consent records, deletion, logs, a breach plan. It does not stop at documents.
- Your lawyers still give the legal opinions. The consultant turns them into working controls. DPDP Ready works this way and does not give legal opinions.
- There is no government DPDP certificate for ordinary businesses. Be wary of anyone who promises one, or who says the deadline will move.
The Data Protection Board is established and Rules 1, 2 and 17 to 21 apply. Its members are yet to be appointed.
Rule 4 applies: consent managers can register with the Board and start carrying people's consents to businesses.
Notice, consent, security safeguards, breach intimation, retention, rights, grievances, children and cross-border rules.
What to do
- Check where you stand with the readiness check and the checklist.
- Ask any consultant who will actually make the changes in your systems.
- Ask what proof you will hold at the end, such as a data map, consent records and a breach drill report.
- Ask for a fixed fee against a written scope.
- Keep your lawyers involved for every legal question.
The law: the DPDP Act, 2023 and the DPDP Rules, 2025. Core duties apply from 13 May 2027.
A DPDP consultant maps the personal data you hold, closes the gaps against the DPDP Act 2023 and the DPDP Rules 2025, and aims to leave you with evidence that the controls work before the core obligations apply on 13 May 2027. Choose one who can build those controls in your product and systems, not only write policies, and who works alongside your legal counsel. DPDP Ready, led by Deepak Mittal at Mirav Labs in New Delhi, is an implementation-led practice of this kind.
Key takeaways
- Many DPDP obligations are met by systems (consent records, erasure, logging, breach response), so pick a consultant who can build, not only advise.
- A good engagement starts with a data map and a fiduciary or processor role map, then fixes gaps in order of penalty exposure.
- Ask for evidence: what will you be able to show the Board, an auditor or an enterprise customer at the end?
- There is no government DPDP certification for ordinary businesses; treat “DPDP certified” badges with caution.
- Legal opinions stay with your counsel; the implementation partner turns them into working controls.
With the core obligations of the DPDP Rules applying from 13 May 2027, many Indian companies are deciding who should help them get there: their lawyers, a compliance software vendor, a large advisory firm or a specialist implementation partner. This guide explains what a DPDP consultant should actually deliver, how to tell a good one from a policy-writing exercise, and how we run engagements at DPDP Ready.
What does a DPDP consultant do?
The work follows the obligations in the Act and the Rules. A complete engagement covers each of these, with something you can show at the end.
| Area | What gets done | What you can show afterwards |
|---|---|---|
| Data map | Find every system holding personal data, including logs, analytics, support tools and spreadsheets | Record of processing |
| Roles | Decide fiduciary or processor for each data flow (section 2) | Role map per purpose |
| Lawful ground | Consent or a section 7 legitimate use for each purpose | Purpose register |
| Notice and consent | Itemised notices under Rule 3; consent records you can prove (s.6(10)) | Notice versions, consent ledger |
| Security | Rule 6 safeguards, including one-year log retention | Control matrix with test results |
| Breach response | Rule 7 runbook, notice templates, a tabletop drill | Runbook and drill report |
| Rights and grievances | Request workflow, published contact, grievance period of 90 days at most | Request and grievance log |
| Retention | Retention schedule and erasure that reaches every system | Schedule and erasure logs |
| Vendors | Processor contracts and a vendor register (s.8(2)) | Signed contracts, register |
When do you need one?
- You run an app, platform or SaaS product. The obligations live in your code, data stores and vendors.
- Enterprise customers are asking. DPDP questions are starting to appear in security questionnaires and contract addenda.
- You are a processor for business customers. They are likely to push breach timelines, deletion and audit rights to you by contract. See DPDP for SaaS.
- You handle sensitive volumes. Financial, health or children's data, or data on lakhs of people, raises the risk, and the type of data is one of the factors the Board weighs when setting a penalty (up to ₹250 crore per breach for security failures).
- Time is short. A typical single-product programme needs around three to five months from first assessment to evidence, longer with several products or legacy systems, and May 2027 is close.
How to choose a DPDP consultant: ten questions to ask
Much of the Act is satisfied by working systems, not policies.
Ask about multi-tenant systems, logging, deletion and incident response they have built.
Interviews alone can miss stores. Look for automated discovery plus interviews.
Everything else depends on it.
Expect a record of processing, consent records, a safeguards matrix, a drill report and a rights log.
Legal opinions should stay with counsel; the partner turns them into controls.
Open-ended time and materials makes budgeting hard.
Advice without a source is hard to defend.
Ask about the Board's status, the consent manager framework and the 2026 changes. See the status tracker.
Rights requests, grievances, new features and vendors need ongoing review.
Red flags
Be careful if you hear these
- “We'll make you DPDP certified.” The Act and Rules create no certification for ordinary Data Fiduciaries.
- “A cookie banner and a new privacy policy will cover it.” They cover a small part of section 5 and section 6.
- “The deadline is moving, so wait.” A shorter timeline was proposed in early 2026 but no amendment has been notified; 13 May 2027 stands.
- “Our software makes you compliant.” Software helps with consent and requests; it cannot decide your purposes, retention or roles.
How a DPDP Ready engagement works
DPDP Ready is the DPDP practice of Mirav Labs, New Delhi. Law firms, auditors and technology firms can also partner with us. It is an implementation team (engineers, security and privacy practitioners) led by Deepak Mittal, who has spent 25 years building telecom, payments and SaaS platforms. We work alongside your counsel and do not give legal opinions.
Data map, role map
Gap report, design
Controls in production
Evidence pack, drill
| Engagement | Typical length | You get |
|---|---|---|
| Readiness assessment | 3 to 4 weeks | Data map, role map, gap report against the applicable sections and Rules, a costed roadmap |
| Implementation programme | 10 to 16 weeks | Controls running in production, plus an evidence pack |
| Managed privacy office | Monthly | Grievance desk support, rights requests, privacy reviews, breach on-call |
Engagements are usually quoted at a fixed fee, and we aim to send the quote within three working days of a free 30-minute scoping call. See a worked example in our case study of a commerce SaaS with 1,000+ customers.
What to do next
- Take the readiness check to see where you stand.
- Download the Excel checklist and assign owners.
- Read consultant vs software vs law firm to decide what mix you need.
- Book a scoping call to get a fixed-fee proposal.
Frequently asked questions
Do I need a DPDP consultant?
Not always. A small business with one simple website may manage with the checklist. You will usually want help if you run an app or SaaS product, hold data on lakhs of people, process children's or financial data, act as a processor for business customers, or face DPDP questions in enterprise security reviews.
Can a law firm do DPDP compliance on its own?
A law firm can tell you what the Act requires and draft notices, contracts and policies. Law firms do not usually build consent records, erasure jobs, log retention or breach tooling inside your systems. A common approach is to pair counsel for legal opinions with an implementation partner for the build.
How long does DPDP implementation take?
A readiness assessment typically takes 3 to 4 weeks. An implementation programme typically takes 10 to 16 weeks for a single-product company, longer for several products or legacy systems. See what drives cost and time.
Is there an official DPDP certification?
The DPDP Act and Rules do not set up a certification scheme for ordinary Data Fiduciaries. Consent managers must have their platforms independently certified to register with the Board, but that is a different thing. Evidence of working controls matters more than a badge.
Can a DPDP consultant act as our Data Protection Officer?
A DPO is required only for Significant Data Fiduciaries, and must be based in India and responsible to the board. Any fiduciary must publish a contact who can answer questions about processing. A managed privacy office can help run that contact and the grievance desk, while responsibility stays with you.
We already have ISO 27001 or a GDPR programme. Do we still need help?
Those give you a strong base, especially for Rule 6 security safeguards. DPDP adds specific requirements: itemised notices, one-year log retention, Rule 7 breach intimations with set contents, the 90-day grievance cap and no legitimate interests ground. A gap assessment against the Act and Rules shows what is left.
Turn this guide into a working programme
A 30-minute scoping call maps your gaps against the Rules and the order to close them. We aim to send a proposal, usually at a fixed fee, within three working days.
Related guides
This guide explains the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 as notified on 13 November 2025. It is general information, not legal advice. Check the official text, and your counsel, before relying on it.