Done-for-you DPDP compliance for India.
We implement the DPDP Act 2023 end-to-end for Indian businesses. 90-day guided rollout, named DPO retainer, backed by our own 94-module platform. All 32 DPDP capabilities deployed as part of the engagement — Consent (2-D matrix + 22 Indian languages), DSR + Section 14 Nomination, DPIA, Breach, Section 8(5) Safeguards, 4th-Party Exposure, Sampling audits, AI Purpose Alignment, Code-repo PII scanner. Delivered by Decipher’s senior practice. From ₹2,99,999.
you'll meet your practice lead on the scoping call — same dayThree reasons the practice is different.
32 DPDP modules in every engagement
Not 5. Not 10. Thirty-two — every DPDP module the Act needs, from consent to Section 8(5) Safeguards, Section 14 Nomination, 4th-party exposure, sampling audits, and AI purpose alignment.
Reject-All actually works
Our Deep Scan v2 launches a real browser and verifies that “Reject All” on your cookie banner actually stops trackers. DPDP Section 6 evidence, not just checkbox theatre.
Branded DSR portal on your domain
Custom Subdomain DSR: point privacy.yourcompany.com at dcomply, keep your customers on your brand throughout the DPDP journey. Included from Pro.
10 DPDP-native upgrades. Shipped.
Every gap the specialists advertise — closed. Every one wired into the system, every one reachable from the sidebar, every one live on app.dcomply.in.
Consent & notices — richer, deeper, universal
Notices in every one of the Eighth Schedule languages — Hindi, Tamil, Bengali, Dogri, Santali, Manipuri, Kashmiri, all 22. Native scripts, not transliteration.
Every purpose classified on two axes — Use type (legitimate use vs business case) × Frequency (one-time vs recurring). Legal-review ready.
Share consent forms via WhatsApp, SMS, email, PDF footer, print QR — zero code integration. One URL, mobile-first, all 22 languages supported.
Paste one <script> tag on any page — WordPress, Shopify, custom sites, whatever. Auto-updates when we ship changes; no re-deploy on your side.
Data-principal rights — first-class Section 14 Nomination
Nominee registration + admin approve/reject + audit-trail evidence. A DPDP-only right that GDPR platforms don’t handle. Now surfaced on its own portal card, not buried under DSR types.
Data Principal Portal now shows DSR + Nomination + Withdrawal + Grievance as four equal-weight channels — one operator dashboard, four DPDP-native SLAs.
Governance & audit — regulator-ready evidence
Single evidence surface bundling access control + encryption inventory + vuln posture + log retention + breach history. Traffic-light score. Show it to the Data Protection Board on one screen.
Walks the processor chain end-to-end — who are your vendors’ vendors? Tree view, unique-countries-in-chain counter, DPDP Sec 8(2) evidence trail. What enterprise procurement asks first.
Cochran-based sample sizing with finite-population correction — random, stratified, or systematic. Big-4 auditor methodology, reproducible draws, methodology footer in the CSV.
AI-assisted intelligence — closing the last-mile loop
Maps every discovered PII field to a declared consent purpose or published notice. Surfaces orphan data (collected with no stated purpose) and stale purposes (declared but nothing maps to them). Alignment score 0–100.
Scans your source (JS/TS/PHP/Python/Java/HTML) for personal-data collection points — form fields, ORM writes, analytics identifies, request-body accesses. 14 labels × ~25 rules, deterministic, source never leaves your tenant.
Every capability above is included in all four service shapes — no tier gates, no procurement games.
Platform go-live in three weeks.
Not a sales promise — this is the concrete week-by-week timeline the practice follows inside every Implementation engagement. Platform setup + first evidence chain — consent widget deployed, DSR portal live, policies generated, Sec 8(5) Safeguards populated. Ongoing DPDP maturity (staff training, quarterly audits, RoPA depth) is continuous work after Day 21.
- Scoping call & written scope same day
- Onboarding workshop picks your industry pack
- Connect 2–3 data sources (S3 / MySQL / Salesforce…)
- PII Discovery + Code-repo scan run
- Gap Assessment report generated
- Consent widget deployed (1-line embed)
- 2-D purpose matrix + 22-language notices set up
- DSR portal configured on your subdomain
- Policy set generated (privacy, cookie, DPA)
- DPO Console + Grievance Officer register live
- Section 8(5) Safeguards dashboard populated
- AI Purpose Alignment run — orphan fields fixed
- Sampling audit run for regulator evidence
- SHA-256 EvidenceChain sealed
- You’re DPDP-compliant. Board memo generated.
Enterprise / multi-entity taking longer? Talk to us about a 60-day rollout →
The DPDP Implementation Guidebook
The same step-by-step manual the practice uses on every engagement — now public. Every module dcomply ships, section-by-section DPDP Act mapping, DPDP Rules 2025 requirements, real screenshots, and copy-paste templates in 22 Indian languages.
- Setup guide for each of the 32 DPDP modules
- DPDP Rules 2025 + 10 new Sep-2026 modules covered
- Sample DPIA, DPA, and breach-notification templates
- 22-language consent notice templates
- Section 8(5) Safeguards evidence checklist
“Why not just build this in-house?”
Fair question. Here’s what “building it in-house” actually costs when you add up engineering hours, legal review, and the ongoing update burden as DPDP Rules keep evolving.
Build it in-house
- 2 senior engineers × 6 months₹ 24–36L
- Legal review by a privacy law firm₹ 4–8L
- Cloud infra + storage + sending domains₹ 1–2L/yr
- Ongoing updates as DPDP Rules evolve1 FTE/qtr
- You still don’t have RBI / SEBI / CERT-In / POSHMissing
Engage dcomply
- DPDP module suiteIncluded
- Policies generated + legally reviewedIncluded
- India infra + sending + storageIncluded
- Rules updates auto-shipped to youIncluded
- RBI, SEBI, CERT-In, POSH, ISO, SOC 2Same engagement
DPDP Rules 2025 dropped in Nov 2025. Section 8(5) sub-rules are still being clarified. Every clarification means your in-house code needs a re-review. The practitioner absorbs those updates and ships them inside your retainer — you never pay again to keep up with the law.
Four service shapes. Every DPDP module as delivery capability.
Readiness is the entry wedge. Implementation is the flagship. Managed is the retainer. Audit Response is reactive. “From ₹X” means the floor — final price confirmed in your scope reply within 1 business day. All prices exclude 18% GST · Razorpay payment link for up to ₹5L, bank transfer accepted above.
DPDP Readiness
- Current-state DPDP gap assessment
- Risk register with penalty exposure estimate
- 30-day prioritised roadmap
- Platform configured with your org data
- 1 workshop with your team
- Readiness report deliverable
- Rolls into Implementation if you continue
DPDP Implementation
- Full ROPA built in 3 workshops
- Consent framework deployed in 22 Indian languages
- DSR workflow end-to-end (public portal + admin backend)
- DPIAs for up to 3 high-risk flows
- Breach SOP + 72-hour drill
- Section 14 Nomination + Section 8(5) Safeguards + Cross-border register
- Trust Badge live on your site
- Staff training (1 session, up to 50 people)
- Platform fully configured and handed over
- Named founder as point of contact throughout
DPDP Managed
- Named DPO (founder) on your retainer
- Monthly compliance review on the platform
- DSR response delivered within SLA
- Breach response within SLA
- Regulatory update monitoring (DPB, MeitY, CERT-In)
- Quarterly board-ready report
- Annual DPDP audit preparation
- Platform access throughout engagement
DPDP Audit Response
- Triggered within 48 hours of your call
- Evidence pack preparation
- Response drafting against the specific notice
- Platform configured to show full audit trail
- Hearing preparation if required
- Multi-regulator coverage if DPDP + CERT-In cross-reference
Need a Data Protection Officer too?
Bolt on a Managed DPO retainer from ₹29,999/mo (12-month minimum). Named founder-DPO, monthly review, DSR + breach SLA.
vDPO Basic
AI-only DPO
vDPO Standard
AI + monthly human consult
vDPO Premium
Named advocate as your DPO
vDPO Enterprise
Multi-entity, cross-border
dcomply DPDP vs typical DPDP-only competitor.
Based on publicly listed features for DPDP-only compliance software in India as of Jul 2026.
| Capability | dcomply | Typical DPDP-only competitor |
|---|---|---|
| DPDP modules included | 32 | 3–5 |
| Deep Website Scan (browser + CMP verification) | ✓ | — |
| Consent notices in all 22 Eighth Schedule languages | ✓ | 10–15 |
| 2-D Consent Matrix (use × frequency) | ✓ | — |
| No-code Hosted Consent Link (WhatsApp / SMS / print) | ✓ | — |
1-line <script> embed (any CMS / plain HTML) | ✓ | Copy-paste embed only |
| Section 14 Nomination as first-class right | ✓ | — |
| Section 8(5) Safeguards single-page dashboard | ✓ | — |
| 4th-party (sub-processor) chain view | ✓ | — |
| Sampling audit engine (Cochran / stratified / systematic) | ✓ | — |
| AI Purpose Alignment (orphan-field detection) | ✓ | — |
| Code-repo PII scanner (source-level discovery) | ✓ | — |
| Custom Subdomain DSR (branded portal) | ✓ | Enterprise-only |
| DPO Console + Access Control Reviews | ✓ | — |
| Grievance Officer public API | ✓ | — |
| Delivery model | Founder-delivered, named practitioner | Self-serve SaaS |