Updated July 2026 · DPDP Act 2023 Section 10
How much does a DPO cost in India? ₹2,499/mo to ₹40 lakh/year.
The DPDP Act 2023 makes a Data Protection Officer mandatory for Significant Data Fiduciaries under Section 10. This page is the complete price transparency you need before deciding between an in-house DPO (₹8L–₹40L/year), an outsourced retainer (₹2L–₹8L/year), or a virtual DPO subscription (₹2,499–₹19,999/month). All three routes are legal under Section 10(2)(a). Which one you pick depends on your SDF status, data volume and audit posture.
Named DPO on record
Advocate-DPO Premium tier
Cancel anytime
The three routes to a DPDP DPO
In-house vs Outsourced vs Virtual
Section 10(2)(a) requires the DPO to be based in India and responsible to the Board. It does not require the DPO to be an employee. So you have three legal routes.
In-house DPO
₹8L – ₹40L / year (salary)
Full-time employee. Reporting line to Board or CXO.
- Full attention to your business
- Deep internal knowledge
- Expensive at ₹12L–₹60L loaded
- Recruiting is 3–6 months
- Tools not included
Right for: large SDFs, banks, insurance
Outsourced DPO retainer
₹2L – ₹8L / year (retainer)
Law firm / consultancy on annual retainer.
- Cheaper than in-house
- Regulatory expertise built-in
- Consultant model, not always named DPO
- Software separate purchase
- Turnaround is business-day, not real-time
Right for: mid-market, sector-specific needs
Best value
Virtual DPO (vDPO)
₹2,499 – ₹19,999 / month
Subscription. Named DPO + platform bundled.
- Software + DPO in one
- Advocate-DPO on retainer (Premium)
- Named on record. Section 10 compliant
- Live 24-hour breach response
- Cancel anytime
dcomply vDPO tiers
Virtual DPO pricing, three tiers
Every tier includes the full dcomply platform (all 80+ compliance modules). Difference is the human layer above the AI.
AI Tier
₹2,499 / month
AI-first DPO workspace. No human DPO.
- AI Q&A on any DPDP question
- Auto-DPIA triggers
- DSR auto-drafted responses
- Monthly board-ready PDF
- Full dcomply platform included
Right for: non-SDF SMEs, startups
Most popular
Standard Tier
₹9,999 / month
Monthly human review by a qualified DPO.
- Everything in AI Tier
- Human DPO monthly checkpoint
- DPO name published for DPB contact
- Grievance escalation handled
- Board report signed by DPO
Right for: mid-market fiduciaries, borderline SDFs
Premium Tier
₹19,999 / month
Dedicated advocate-DPO on retainer.
- Everything in Standard
- Named advocate as DPO
- Weekly compliance review call
- 4-hour breach response SLA
- DPB liaison + quarterly board
- Annual staff training
Right for: SDFs, banks, insurers, large healthcare
All prices exclusive of GST. Annual billing available with two months free.
Full comparison
What each route buys you
| Capability | In-house | Outsourced retainer | vDPO Premium |
|---|---|---|---|
| Section 10 named DPO | Yes | Yes | Yes |
| Advocate-qualified DPO | No (usually) | Yes | Yes |
| Compliance software included | No, bought separately | No, bought separately | Yes, full platform |
| Cost per year (loaded) | ₹12L – ₹60L | ₹3L – ₹12L | ₹2.4L |
| Setup time | 3–6 months (hire) | 2–4 weeks | < 24 hours |
| Breach response SLA | Business day | Business day | 4 hours |
| DPB liaison | Yes | Yes | Yes |
| Cancel / change plan | Not easily | Annual retainer | Anytime |
DPDP Section 10
Do you actually need a DPO?
SDF classification is the trigger. Here is how to know.
DPO is mandatory if
- You are notified as a Significant Data Fiduciary by the Central Government (Section 10(1))
- You are a bank, NBFC, insurance company, large fintech
- You are a hospital chain, diagnostic lab or health-tech at scale
- You are a large e-commerce, marketplace or social platform
- You process high volumes of children’s data
- You process politically sensitive data (electoral, biometric ID)
DPO is optional but useful if
- You are an SME / mid-market fiduciary
- You want documented compliance for enterprise sales
- You process EU or UK personal data (GDPR Art 37 may still apply)
- You want a Section 33(2)(f) mitigation credit if a breach happens
- Your investors or auditors want a named accountable person
The AI Tier at ₹2,499/mo covers most of this need without hiring anyone.
DPO India cost FAQs
What buyers ask before signing a vDPO.
Not every organisation. A DPO is mandatory for entities classified as Significant Data Fiduciaries (SDFs) under Section 10. SDFs are notified by the Central Government based on volume of personal data, sensitivity, risk to data-principal rights, potential impact on the sovereignty and integrity of India, and risk to electoral democracy. Most banks, NBFCs, insurance, large healthcare providers, large e-commerce platforms and social-media companies are expected to be classified. Non-SDFs still benefit from having a DPO as good governance and to reduce Section 33(2) mitigation risk.
A full-time in-house DPO in India commands ₹8 lakh to ₹40 lakh per year depending on seniority, industry and city. Loaded cost (salary + benefits + overhead + tools) typically runs ₹12 lakh to ₹60 lakh. This makes in-house DPOs viable only for SDFs or large enterprises.
A virtual DPO is an outsourced DPO service delivered on a subscription basis. dcomply's vDPO combines an AI-first workspace (auto DPIA triggers, DSR auto-drafts, monthly board reports) with human review by a qualified DPO. Premium tier adds a named advocate-DPO on retainer.
Yes. Section 10(2)(a) requires the DPO to be based in India and responsible to the Board or governing body. The DPDP Act does not require the DPO to be an employee. A vDPO service where the named DPO signs off in that capacity satisfies the requirement, this is the same pattern GDPR has permitted for years.
For non-SDFs: run a compliance workspace (dcomply Business from ₹12,999/month) with the AI vDPO tier (₹2,499/month) for signature-quality DPO output on record. Total under ₹20k/month. For SDFs: budget for the vDPO Premium tier (advocate-DPO on retainer) at ₹19,999/month plus platform.
A CA or consultant does periodic reviews and reports. A DPO is a named individual with statutory responsibilities under Section 10, monitoring compliance, advising on DPIAs, being the point of contact for the DPB, and the grievance escalation. dcomply's vDPO service names a specific DPO (not just "our team") for that statutory role.
Depends on your DPO obligation. Business tier gives you the platform. vDPO adds a named DPO who signs off on the outputs. If you're a non-SDF you can technically operate without a named DPO but the audit-defensibility jumps sharply with one.
Yes. Tier changes are on next billing cycle. Most customers start on Standard and upgrade to Premium either when a breach happens or when SDF classification is confirmed.
Named advocate DPO on retainer, weekly compliance review call, breach response within 4 hours, DPB liaison, quarterly board report, annual staff training session, and everything in the AI and Standard tiers.
Yes. Standard and Premium tiers include grievance escalation. Data principals who cannot resolve a request via the DSR portal reach the vDPO team directly. This satisfies Section 13 grievance-mechanism requirements.
Start with the AI Tier. Upgrade when you need a human.
₹2,499/month gets you the full dcomply platform plus AI-first DPO output. Section 10 named DPO from ₹9,999/month.