What should a DPDP compliance software RFP include?

A good RFP lists your business requirements, the systems the software must connect to, the proof vendors must show in a live demonstration, who does what during setup, security needs, costs and exit terms. Add a comparison method and a pilot plan. Where a requirement comes from the law, name the provision, such as Section 5 for notice or Rule 7 for breach intimation, so vendors answer precisely and your team can check each reply.

How should an enterprise compare DPDP compliance software?

Choose the product that proves its claims on your own data and systems. Put the same questions to each vendor, ask for live demonstrations of consent withdrawal across connected systems, rights request handling and record exports, then run a pilot on your most important workflows. Consider speaking to customers in your industry. Software supports the work, and legal responsibility stays with the Data Fiduciary (the business that decides why and how personal data is used) under Section 8(1).

Is a consent management platform enough for DPDP compliance?

A consent management platform covers notices, consent capture, withdrawal and consent records, which is one part of the Act. The Act sets further duties on rights requests, complaints, retention and erasure, security and breach reporting. Your business needs policies, owners and training around the software. A registered Consent Manager under Rule 4 is a separate regulated entity, so keep that term separate from the software category in contracts and RFPs.

How much does DPDP compliance software cost, and how long does implementation take?

Cost depends on the pricing model and your customer volume. Vendors commonly charge per consent, per customer, in tiers or as a flat annual fee, and some add charges for setup, connectors and support, so ask each vendor to price the same three year scenario at your full volume. Implementation time depends on the systems you connect, the scope of data discovery and the deployment option. Issue the RFP well before 13 May 2027, when Rules 3 and 5 to 16 apply, and ask each vendor for a milestone plan that ends before that date.

Which security and hosting details should a DPDP software vendor confirm?

Ask the vendor to confirm where data is hosted, the deployment options, current certifications such as ISO 27001 and SOC 2 Type II with supporting reports, encryption and access controls, the sub-processor list, one year of security log retention under Rule 6 and incident response commitments. Section 16 allows transfers outside India except to countries the Central Government restricts by notification, and stricter Indian laws still apply, so the vendor should explain its transfer controls and where its sub-processors operate.

DPDP Compliance Software RFP: 25 Questions to Ask Before You Buy

Compare DPDP compliance software vendors on capabilities, integrations, audit evidence, implementation effort and long-term costs before you make a commitment.

Buying DPDP compliance software determines how your organisation handles consent, customer requests and data breaches for years after signing. Vendor pages list similar features, so the buying team needs to see how each product works with existing systems and how much effort it leaves with internal teams. A DPDP compliance software RFP gives that view. This guide sets out 25 questions to include in it, based on the Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, 2025.

What an RFP Does for Your Business

An RFP, or request for proposal, is a written document that describes what a business needs to buy and invites vendors to propose how they would deliver it. Each vendor answers the same questions, so the business compares replies instead of sales presentations.

The format gives all vendors a common basis for comparison and a written record of what each one promised on scope, timelines and price. An RFP suits purchases where the cost is high, the product connects to several systems and a later change of vendor is expensive. DPDP compliance software meets all three conditions.

Decide Which Type of Product Your Organisation Needs

Products differ in scope, and the type you choose affects the budget. A consent management platform handles notices, consent capture, withdrawal and records. Privacy operations software adds data discovery, customer rights requests, risk assessments and breach response. Under Rule 4, a registered Consent Manager is a separate regulated entity: a company registered with the Data Protection Board of India (the Board) that helps individuals manage consent. It differs from consent management software.

Prepare Your Organisation Before Sending the RFP

Before inviting vendors, appoint one owner for the purchase and for the work after launch. Involve legal, IT, marketing, operations and procurement, since each sees different needs. List the processes and systems the software must support.

Two dates matter for the plan: Rule 4 takes effect on 13 November 2026, and Rules 3 and 5 to 16 on 13 May 2027. Selection, a pilot and system connections take time, so starting early protects the timeline.

25 Questions to Ask Before Choosing a Vendor

Add these questions to the RFP and ask shortlisted vendors to demonstrate their answers live. The law sets requirements, and the checks that follow are recommended practice.

A. Regulatory Coverage and Product Updates (Questions 1 to 4)

Vendors often describe features as DPDP ready. Look for a clear split between what the product does today and what needs setup or manual effort, because that split determines the implementation plan and cost.

The law. Under Section 8(1), your business remains responsible as the Data Fiduciary, the party that decides how personal data is used, and software supports that duty. The check. Specific answers support planning better than a general assurance of compliance.

State which of the listed requirements the product meets today and where it needs setup or manual work, citing the section or rule for each duty.
Share which workflows the vendor built for the DPDP Act and which it adapted from other laws.
Name who owns regulatory change and describe how new Rules and Board guidance reach customers.
Confirm how the product will work with registered Consent Managers once Rule 4 applies.

B. Notice, Consent and Withdrawal (Questions 5 to 9)

Consent handling affects your customers' experience as much as your compliance position. Each withdrawal should reach every system that uses the customer's data. A product that relies on staff for follow up action adds operating effort that grows with the customer base.

The law. Section 5(3) requires the business to offer the notice in English or any Eighth Schedule language. Section 6(4) requires withdrawal to be about as easy as giving consent. Parental consent for children follows Section 9 and Rule 10. The check. Ask the vendor to show one consent from capture to withdrawal across the connected systems, then read the record for the notice version, timestamps and change history.

Show notice creation live in English and the Eighth Schedule languages the customers use.
Describe how the product captures purpose specific consent on web, mobile app, store tablet, call centre and WhatsApp.
List the details saved with each consent record and confirm if an administrator can edit them.
Follow one withdrawal through the CRM (the system that holds customer records), the marketing tools and each processor.
Demonstrate verifiable parental consent, including age checks.

C. Data Discovery, Retention and Erasure (Questions 10 to 13)

A discovery tool finds personal data in the systems it connects to, so its coverage determines its value. Erasure needs equal care. Deleting data under a legal hold, meaning data the business must keep for a legal reason, creates an accountability issue.

The law. Section 8(7) requires erasure, including by processors, when the purpose ends unless another law requires retention. Rule 6 requires the business to keep logs and personal data used to detect unauthorised access for one year, and Rule 8(3) sets a minimum of one year for the purposes listed in the Seventh Schedule. The check. Ask how the product handles an erasure instruction for data under a legal hold. Treat a record of processing activities, a list of what data a business holds, why and where, as recommended practice, since the DPDP Act does not name it.

Explain how the product measures discovery coverage and how the business finds systems it has not scanned.
Show how discovery results populate the record of processing activities and who approves each entry.
Describe how erasure instructions reach internal systems and processors when a purpose ends, including legal holds.
Explain how the product keeps logs and personal data for the periods in Rules 6 and 8(3), then erases them unless another law requires retention.

D. Rights Requests, Grievances and Breach Response (Questions 14 to 17)

These workflows decide how quickly your organisation responds to customers and, after a breach, to the Board. Look at who receives each task, how the product tracks deadlines and what evidence it keeps for auditors.

The law. Sections 11, 12 and 14 give people rights of access, correction, erasure and nomination. Section 13 requires a grievance process, and Rule 14(3) caps the response period at 90 days. Rule 7 requires the Data Fiduciary to inform each affected person and the Board without delay, and to give the Board detailed information within 72 hours or a longer period the Board allows. The check. Follow one sample request and one incident through the product, and confirm that the log shows the action taken.

Describe how the product handles identity checks and deadlines for access, correction, erasure and nomination requests.
Show the complaint (grievance) workflow, with escalation steps and tracking against the response period.
Explain how the breach workflow helps inform each affected Data Principal (the customer) and the Board within the Rule 7 timelines.
Provide sample exports of consent records, rights requests and breach timelines for an auditor, and state which roles can export them.

E. Integrations, Processors and Assessments (Questions 18 to 21)

Connections affect the running cost. A product that connects well to the CRM, marketing tools and processors reduces manual work, and your IT team should own each connection after launch.

The law. Section 8(2) requires a valid contract before a processor handles data on your behalf. Significant Data Fiduciaries, which the Government designates, must run impact assessments under Section 10(2). The check. Customer references show how the product performs in daily operation, so consider speaking to an organisation in your industry.

Identify the processors (outside companies that handle data for the business) that receive customer data and how the product tracks each deletion instruction.
List the gap assessment and impact assessment templates the product includes.
Explain how the product connects through APIs (standard links between systems), detects failed updates and what IT effort the CRM connection needs.
Name live customers in India from the same industry, arrange a reference call and share how long their setup took.

F. Security, Hosting and Contract Terms (Questions 22 to 25)

Security evidence and hosting choices inform the risk review and the contract. If your sector regulator has expectations on deployment or data location, share them early.

The law. Section 16 allows transfers outside India except to countries the Central Government restricts by notification, and stricter Indian laws still apply. The check. Certifications such as ISO 27001 are buyer expectations, and the law does not require them, so look for reports that state their scope and period for the service you will use.

Provide the independent certificates and audit reports that cover the service in scope, and describe the encryption and login controls.
State where the vendor stores the data and which deployment options it offers (public cloud, private cloud or on premise). List the sub-processors (other companies the vendor uses) and describe how the vendor controls transfers outside India.
Propose a launch plan with milestones ahead of 13 May 2027, a named delivery team and support response times, and confirm if workflows can go live while data discovery continues.
State the pricing basis, the cost at full customer volume, renewal increases and implementation charges, and confirm that the business can export all records when the contract ends.

Compare Vendor Responses on Evidence

For each requirement, record what the vendor showed live, what the result depends on (setup, custom development or manual work) and what remains unverified. Then note what each gap means for your effort, timeline and cost.

Give greater importance to a withdrawal that reaches each connected system (Question 8) and a complete export of records (Question 17). A gap in either area can still leave a vendor on the shortlist when the fix is clear and has a committed date.

Run a Pilot Before Committing

A pilot on realistic test data can reveal issues that a demonstration may not show. Consider three tests:

Withdraw consent in the mobile app, check that the SMS tool drops that number, then simulate a failed update and confirm that the system raises an alert.
Follow a test rights request to closure and note the steps that depend on staff.
Export the related records and check that an auditor could use them.

Check the Total Cost and Contract Before Signing

Vendors commonly price per consent, per customer, in tiers or as a flat annual fee. A price that looks low at pilot volume can rise at full volume, so ask each vendor to quote at your full customer count.

Before approving the budget, ask each vendor to price the same three year scenario, including setup, data migration, custom connectors, support, renewal increases and exit costs. Before signing the contract, confirm deliverables, service levels, security responsibilities and data export.

Assess OneConsent Against Your Requirements

OneConsent offers modules for notice creation, consent and preference management, cookie consent, consent audit trail, data principal rights, breach management, data discovery, records of processing, impact assessment, gap assessment and third party risk. These modules support the processes above, and your teams still set policies, approve requests and handle exceptions.

Ask the OneConsent team to demonstrate each area, mark the manual steps and share the security certificates and audit reports for the service. The OneConsent platform overview lists each module, and Consent Management Platform in India: A Buyer's Guide covers the category.

Bring Your Requirements to a OneConsent Demo

Your next step is to schedule one working session with the OneConsent team. Bring the purchase owner, an IT lead, a legal contact and a marketing representative, and go through the 25 questions together. The team can then take your DPDP compliance software RFP through the platform module by module. Book a product demo to schedule that session, or visit the OneConsent website.