# DPDP consultant in India: what they do and how to choose one

Source: https://dpdp.miravlabs.com/dpdp-consultant/ · Updated 2026-11-13 · DPDP Ready by Mirav Labs

**Short answer:** A DPDP consultant maps the personal data you hold, closes the gaps against the DPDP Act 2023 and the DPDP Rules 2025, and aims to leave you with evidence that the controls work before the core obligations apply on 13 May 2027. Choose one who can build those controls in your product and systems, not only write policies, and who works alongside your legal counsel. DPDP Ready, led by Deepak Mittal at Mirav Labs in New Delhi, is an implementation-led practice of this kind.

## In plain words

Much of what the DPDP Act asks for is done inside your systems, not in a policy document. Consent records, deleting data on time, keeping logs and handling a data leak all need working software and clear processes. A good consultant finds where your customers' data sits, fixes the gaps, and leaves you with proof that it works.

- **3 to 4 weeks** for a typical readiness assessment
- **10 to 16 weeks** typical build time for a single-product company
- **13 May 2027** when the main duties apply

### What it means for you

- You may not need outside help. A small business with one simple website can often work from a checklist.

- You usually do need help if you run an app or software product, hold data on lakhs of people, handle children's, health or financial data, or handle data for business customers.

- Good help builds things in your systems: consent records, deletion, logs, a breach plan. It does not stop at documents.

- Your lawyers still give the legal opinions. The consultant turns them into working controls. DPDP Ready works this way and does not give legal opinions.

- There is no government DPDP certificate for ordinary businesses. Be wary of anyone who promises one, or who says the deadline will move.

**Example:** A payroll software company in Pune starts getting DPDP questions from its large clients. A consultant maps where employee data sits, finds old exports in shared drives, and sets up deletion and logging. The company ends with records it can show those clients.

### What to do

- Check where you stand with the readiness check and the checklist.

- Ask any consultant who will actually make the changes in your systems.

- Ask what proof you will hold at the end, such as a data map, consent records and a breach drill report.

- Ask for a fixed fee against a written scope.

- Keep your lawyers involved for every legal question.

The law: the DPDP Act, 2023 and the DPDP Rules, 2025. Core duties apply from 13 May 2027.

## The detailed guide

## Key takeaways

- Many DPDP obligations are met by systems (consent records, erasure, logging, breach response), so pick a consultant who can build, not only advise.
- A good engagement starts with a data map and a fiduciary or processor role map, then fixes gaps in order of penalty exposure.
- Ask for evidence: what will you be able to show the Board, an auditor or an enterprise customer at the end?
- There is no government DPDP certification for ordinary businesses; treat “DPDP certified” badges with caution.
- Legal opinions stay with your counsel; the implementation partner turns them into working controls.

With the core obligations of the DPDP Rules applying from 13 May 2027, many Indian companies are deciding who should help them get there: their lawyers, a compliance software vendor, a large advisory firm or a specialist implementation partner. This guide explains what a DPDP consultant should actually deliver, how to tell a good one from a policy-writing exercise, and how we run engagements at DPDP Ready.

## What does a DPDP consultant do?

The work follows the obligations in the Act and the Rules. A complete engagement covers each of these, with something you can show at the end.

| Area | What gets done | What you can show afterwards |
|---|---|---|
| Data map | Find every system holding personal data, including logs, analytics, support tools and spreadsheets | Record of processing |
| Roles | Decide fiduciary or processor for each data flow (section 2) | Role map per purpose |
| Lawful ground | Consent or a section 7 legitimate use for each purpose | Purpose register |
| Notice and consent | Itemised notices under Rule 3; consent records you can prove (s.6(10)) | Notice versions, consent ledger |
| Security | Rule 6 safeguards, including one-year log retention | Control matrix with test results |
| Breach response | Rule 7 runbook, notice templates, a tabletop drill | Runbook and drill report |
| Rights and grievances | Request workflow, published contact, grievance period of 90 days at most | Request and grievance log |
| Retention | Retention schedule and erasure that reaches every system | Schedule and erasure logs |
| Vendors | Processor contracts and a vendor register (s.8(2)) | Signed contracts, register |

## When do you need one?

- **You run an app, platform or SaaS product.** The obligations live in your code, data stores and vendors.

- **Enterprise customers are asking.** DPDP questions are starting to appear in security questionnaires and contract addenda.

- **You are a processor for business customers.** They are likely to push breach timelines, deletion and audit rights to you by contract. See [DPDP for SaaS](https://dpdp.miravlabs.com/guides/dpdp-for-saas/).

- **You handle sensitive volumes.** Financial, health or children's data, or data on lakhs of people, raises the risk, and the type of data is one of the factors the Board weighs when setting a penalty (up to ₹250 crore per breach for security failures).

- **Time is short.** A typical single-product programme needs around three to five months from first assessment to evidence, longer with several products or legacy systems, and May 2027 is close.

## How to choose a DPDP consultant: ten questions to ask

1**Will you build controls in our systems, or hand us documents?**Much of the Act is satisfied by working systems, not policies.

2**Who does the engineering, and have they run platforms at scale?**Ask about multi-tenant systems, logging, deletion and incident response they have built.

3**How will you map our data?**Interviews alone can miss stores. Look for automated discovery plus interviews.

4**How do you decide fiduciary or processor for each flow?**Everything else depends on it.

5**What evidence will we have at the end?**Expect a record of processing, consent records, a safeguards matrix, a drill report and a rights log.

6**How do you work with our lawyers?**Legal opinions should stay with counsel; the partner turns them into controls.

7**Is the fee fixed, and what is in scope?**Open-ended time and materials makes budgeting hard.

8**Which section or Rule does each recommendation come from?**Advice without a source is hard to defend.

9**How current is your reading of the Rules?**Ask about the Board's status, the consent manager framework and the 2026 changes. See the [status tracker](https://dpdp.miravlabs.com/dpdp-status/).

10**What happens after go-live?**Rights requests, grievances, new features and vendors need ongoing review.

## Red flags

Be careful if you hear these

- “We'll make you DPDP certified.” The Act and Rules create no certification for ordinary Data Fiduciaries.

- “A cookie banner and a new privacy policy will cover it.” They cover a small part of section 5 and section 6.

- “The deadline is moving, so wait.” A shorter timeline was proposed in early 2026 but no amendment has been notified; 13 May 2027 stands.

- “Our software makes you compliant.” Software helps with consent and requests; it cannot decide your purposes, retention or roles.

## How a DPDP Ready engagement works

DPDP Ready is the DPDP practice of Mirav Labs, New Delhi. Law firms, auditors and technology firms can also [partner with us](https://dpdp.miravlabs.com/partners/). It is an implementation team (engineers, security and privacy practitioners) led by [Deepak Mittal](https://dpdp.miravlabs.com/about/deepak-mittal/), who has spent 25 years building telecom, payments and SaaS platforms. We work alongside your counsel and do not give legal opinions.

**Discover**Data map, role map

**Decide**Gap report, design

**Build**Controls in production

**Prove**Evidence pack, drill

**Now:** 

| Engagement | Typical length | You get |
|---|---|---|
| Readiness assessment | 3 to 4 weeks | Data map, role map, gap report against the applicable sections and Rules, a costed roadmap |
| Implementation programme | 10 to 16 weeks | Controls running in production, plus an evidence pack |
| Managed privacy office | Monthly | Grievance desk support, rights requests, privacy reviews, breach on-call |

Engagements are usually quoted at a fixed fee, and we aim to send the quote within three working days of a free 30-minute scoping call. See a worked example in our [case study](https://dpdp.miravlabs.com/case-study/) of a commerce SaaS with 1,000+ customers.

## What to do next

- Take the [readiness check](https://dpdp.miravlabs.com/#check) to see where you stand.

- Download the [Excel checklist](https://dpdp.miravlabs.com/downloads/dpdp-compliance-checklist.xlsx) and assign owners.

- Read [consultant vs software vs law firm](https://dpdp.miravlabs.com/dpdp-consultant-vs-software-vs-law-firm/) to decide what mix you need.

- [Book a scoping call](https://dpdp.miravlabs.com/#contact) to get a fixed-fee proposal.

## Frequently asked questions

### Do I need a DPDP consultant?

Not always. A small business with one simple website may manage with the checklist. You will usually want help if you run an app or SaaS product, hold data on lakhs of people, process children's or financial data, act as a processor for business customers, or face DPDP questions in enterprise security reviews.

### Can a law firm do DPDP compliance on its own?

A law firm can tell you what the Act requires and draft notices, contracts and policies. Law firms do not usually build consent records, erasure jobs, log retention or breach tooling inside your systems. A common approach is to pair counsel for legal opinions with an implementation partner for the build.

### How long does DPDP implementation take?

A readiness assessment typically takes 3 to 4 weeks. An implementation programme typically takes 10 to 16 weeks for a single-product company, longer for several products or legacy systems. See what drives cost and time.

### Is there an official DPDP certification?

The DPDP Act and Rules do not set up a certification scheme for ordinary Data Fiduciaries. Consent managers must have their platforms independently certified to register with the Board, but that is a different thing. Evidence of working controls matters more than a badge.

### Can a DPDP consultant act as our Data Protection Officer?

A DPO is required only for Significant Data Fiduciaries, and must be based in India and responsible to the board. Any fiduciary must publish a contact who can answer questions about processing. A managed privacy office can help run that contact and the grievance desk, while responsibility stays with you.

### We already have ISO 27001 or a GDPR programme. Do we still need help?

Those give you a strong base, especially for Rule 6 security safeguards. DPDP adds specific requirements: itemised notices, one-year log retention, Rule 7 breach intimations with set contents, the 90-day grievance cap and no legitimate interests ground. A gap assessment against the Act and Rules shows what is left.