Budgeting
DPDP Act Compliance Cost in India: What to Budget and When to Spend It
For most Indian companies a DPDP programme runs from under ₹50,000 a year for a small startup to ₹1.5 lakh to ₹8 lakh for an SME, with large groups quoted by phase — guide ranges published on our pricing page, not quotes. Read any figure on this subject, ours included, knowing that no independent benchmark for DPDP cost exists: the most specific numbers in circulation come from the vendors selling the work, one of them contradicts its own two pages, and the bands everyone publishes are keyed to headcount, which is not what drives the work. This page keys it to what does, and splits the one-time project from the annual run-rate.
Indicative bands
What DPDP compliance costs, and what each band assumes
These are guide ranges rather than published bands in the way our ISO 27001 and SOC 2 figures are, and our pricing page says so itself. The price is fixed in writing after scoping. There is no third-party audit fee in any tier, because no certifying body exists under the Act.
| Who you are | Guide range | Timeline | What that assumes |
|---|---|---|---|
| Startup under ten thousand users | Under ₹50,000 a year | 13 to 23 weeks for the full programme, shorter for a gap assessment alone | One or two systems holding personal data, few processors, no cross-border transfer, and a product team that can make its own changes. |
| SME or mid-size company | ₹1.5 lakh to ₹8 lakh | 13 to 23 weeks | A handful of systems, a vendor list that needs working through, and safeguards implemented rather than only specified. |
| Large enterprise with subsidiaries and complex flows | ₹15 lakh to ₹60 lakh | Quoted by phase rather than against one clock | Group structure, many processors, cross-border flows, and a programme that runs as phases with their own approvals. |
What moves the number
What actually drives the cost, and why headcount does not
Every band published on this subject is keyed to how many people you employ. Headcount is easy to look up and it is not what the work scales with. A forty-person fintech with nine systems holding personal data, cross-border processing and no way to serve an erasure request is a bigger job than a three-hundred-person firm with one CRM and a data inventory it already keeps current. Five things move the number.
1. How many systems hold personal data
Each one has to be found, mapped, assessed and then kept in the inventory. This is the single biggest driver and it tracks product complexity, not staff numbers.
2. How many processors and vendors touch it
Every processor needs terms that meet the Act and a diligence record. Twenty vendors is twenty contract reviews, whoever signs them.
3. Whether personal data crosses a border
Transfers bring their own assessment and contractual work, and they are the item most often missing from a quote that looked complete.
4. How many consent surfaces you run
An app, a website, a partner journey and an offline form are four places notice and consent have to be designed, built and later kept in step with a registered Consent Manager.
5. Whether a rights pipeline already exists
If access, correction and erasure requests can already be served end to end, a large part of the build is done. If they cannot, that is engineering work rather than advice.
Bring those five answers to a scoping call and the quote stops being a band. If you do not know them yet, finding out is what a gap analysis is for, and it is the smallest sensible first purchase.
Two budget lines
One-time cost against annual run-rate
A single figure cannot be turned into a budget line, because part of it is a project that finishes and part of it recurs whether or not anything changes. Finance will ask which is which, so here it is.
The project
Data discovery and the flow map
Once, then maintained
The inventory is built once and updated as systems change. Rebuilding it from scratch every year means it was never maintained.
Gap assessment against the Act and the 2025 Rules
Once per programme
Repeated only if the business changes shape, or ahead of a Board enquiry.
Consent and notice design, and the build behind it
Once per surface
Design is advisory; the build is engineering, and whether it is in our fee or your sprint is a scoping decision.
Rights workflows, retention schedule, breach procedure
Once, then exercised
Writing them is the project. Testing them is the run-rate.
The run-rate
Consent-manager platform or tooling licence
Annual, vendor-invoiced
Not our revenue and not in our fee. The vendor quotes you by headcount tier and connectors.
The person who answers data-principal questions
Annual
A duty for every data fiduciary. A Significant Data Fiduciary must appoint a Data Protection Officer based in India who reports to the board.
Keeping the inventory and the vendor records current
Annual
New system, new processor, new transfer. This is where programmes quietly decay.
Training, breach rehearsal and periodic review
Annual
A breach procedure nobody has walked through is a document, not a control.
When you have to spend it
What has to be done by 13 November 2026, and what waits for 13 May 2027
Quoting only the 2027 date makes the whole programme look like one bill arriving at once. There are three dates, each forcing different spend. Read them from the Act and the Rules themselves, not from a consultant’s summary, ours included.
On publication: 13 November 2025
Rules 1, 2 and 17 to 21 came into force on the date of publication in the Official Gazette, which was 13 November 2025.
Nothing is deferrable in principle: the Act has been in force since 2023 and obligations without a later commencement date do not wait. In practice this is the date the planning stopped being optional.
One year after publication: 13 November 2026
Rule 4, the registration and obligations of a Consent Manager, comes into force one year after publication. The gazette states the interval, not the date.
Non-deferrable if your consent flows will have to accept signals from a registered Consent Manager. The design and build sit here, not at the end, and this is the milestone most single-figure quotes quietly ignore.
Eighteen months after publication: 13 May 2027
Rules 3 and 5 to 16, and 22 and 23, come into force eighteen months after publication. Again the gazette states the interval; the date follows from it.
Notice, consent, data-principal rights, children's data, breach intimation to the Board and processor terms. Working backwards through a 13-to-23-week programme and a board approval cycle puts a sensible start in 2026.
The Consent Manager deadline guide covers the middle date in detail, and the compliance checklist sets the obligations out in the order a programme meets them.
Why no two figures agree
The published numbers, side by side
These are not our figures and we are not endorsing any of them. They are here because there is no independent benchmark for DPDP cost in India — one of the publishers below says so about its own sources — and the quickest way to show a buyer what that means is to put the numbers next to each other. Each row names its publisher and the date it was published; the third-party figures were read on 22 October 2026.
| Source | Published | What it says |
|---|---|---|
| TCSA, resources guide | 15 January 2026 | ₹3 lakh to ₹15 lakh, banded by headcount: ₹3–5 lakh at 10–50 staff, ₹5–8 lakh at 50–200, ₹8–15 lakh above 200, plus 20–30% starting from no documentation |
| TCSA, its own service page | read 22 October 2026 | ₹1.5 lakh to ₹4 lakh for the same work |
| ecorpit.com, budgeting guide | 16 July 2026 | Vendor quotes of ₹15 lakh to ₹2 crore against in-house delivery under ₹50,000 for sub-10,000-user firms, and ₹3 lakh to ₹8 lakh in-house for an SME |
| Inc42, feature | 17 July 2026 | Line items rather than a total: consent platform ₹0–15 lakh a year, data mapping ₹1–10 lakh, legal ₹50,000–5 lakh, in-house DPO ₹25–40 lakh a year, fractional DPO ₹2–8 lakh a year |
One vendor publishes ₹3–15 lakh on its guide and ₹1.5–4 lakh on its own service page for the same engagement. Both were live on 22 October 2026.
Two of the most-cited sources give different breach-reporting windows, one 72 hours and one 48 hours. The Rules settle it, so here it is rather than a shrug. Rule 7(2) requires a description of the breach to go to the Board without delay, and the remaining particulars within seventy-two hours of becoming aware of it — or within such longer period as the Board may allow on a written request. Rule 7(1) separately requires intimation to each affected data principal without delay. So 72 hours is real, it is not a hard ceiling because the extension exists, and 48 hours is not what the Rules say.
The useful conclusion is not that any of them is dishonest. It is that a band with no scope attached cannot be compared to another band with no scope attached, which is why the five drivers above matter more than any of these numbers.
Not in the fee
What our fee does not cover
No page on this subject publishes an exclusions list, which is how a quote that looked complete turns into three invoices. Ours is short and it is here.
- Consent-manager or privacy-tooling licences. Quoted and invoiced by that vendor, annually, and not through us.
- Legal opinions and sign-off. SecureRoot is not a law firm and does not give legal opinions on the DPDP Act; your counsel does that and we brief them on the technical facts.
- Engineering build inside your product. Sometimes ours, often your sprint. Which it is gets decided at scoping and written down, rather than discovered later.
- Penetration testing and security assessment, which evidence the Act's safeguards but are a separate scope.
- Your own team's time. The line most quotes leave out, and usually the largest one.
On the testing line specifically: SecureRoot is not a CERT-In empanelled auditing organisation. Empanelment matters where a regulator or a tender requires an empanelled auditor’s signature on a formal report, which is a different thing from DPDP readiness — DPDP Act security testing sets out what that scope covers, and who can sign your security report explains which signature a buyer is usually asking for.
What you get
What the money buys, document by document
Working documents rather than a certificate, because There is no DPDP certificate and no accredited DPDP certification body. Compliance is self-accountable and assessed by the Data Protection Board. Nobody can sell you one.
A record of processing activities. One row per processing activity, each carrying the purpose, the categories of personal data and of data principals, the lawful basis, the systems involved, every processor and sub-processor, any cross-border transfer, the retention period and the owner.
A gap register. One row per obligation in the Act and the Rules, marked as met, partially met or absent, with the evidence that supports the marking and the work needed to close it.
A breach-notification runbook. Who decides a personal data breach has occurred, the clock that starts when they do, what goes to the Data Protection Board and what goes to affected data principals, who signs each communication, and the rehearsal record.
Those are the fields, not a sample. We have not published a redacted excerpt from a real engagement and are not going to invent one for a web page. On a scoping call we will walk you through the structure of each document, which is the honest version of the same thing.
Questions
Budget questions buyers ask
- Is there a DPDP certificate we can buy, and who signs off on compliance?
- There is no DPDP certificate in Indian law, no accredited DPDP certification body, and nobody who can sell you one. This matters for your budget because a figure quoted for getting you certified is quoting for something that does not exist. DPDP compliance is self-accountable: you are responsible for meeting the Act, and the Data Protection Board assesses that if it has cause to. What you can hold is demonstrable readiness, which is evidence that your notices, consent, rights workflows, safeguards, retention and breach process meet the Act and the 2025 Rules, in a form an enterprise buyer's diligence or the Board would accept. If a proposal offers certification, accreditation or registration under the Act, that is the moment to ask which body issues it, and the answer will not survive the question.
- Should we do this in-house or hire a consultant?
- In-house is genuinely cheaper if you already have the people, and the honest version of the comparison counts their hours rather than pretending they are free. The work that transfers well internally is data discovery, vendor record-keeping and keeping the inventory current, because your own teams know the systems. What usually does not is the first gap assessment against the Act and the Rules, where knowing what a regulator reads for is most of the value, and consent design across several surfaces. One of the published guides puts in-house delivery under ₹50,000 for a sub-10,000-user firm against vendor quotes an order of magnitude higher, and for a simple product that is credible. The honest split for most companies is a consultant for the assessment and the design, and your own team for the run-rate.
- What does a Data Protection Officer cost, and do we need one?
- Only a Significant Data Fiduciary must appoint one, and it must be a person based in India who reports to the board or its equivalent. Everyone else must publish the contact details of someone who answers data-principal questions, which is a smaller duty and is often filled internally by a named existing employee. On cost, the figures in circulation come from the trade press rather than from us: Inc42 reported in July 2026 an in-house DPO at ₹25–40 lakh a year against a fractional arrangement at ₹2–8 lakh. We have no published rate card for a fractional DPO, so we are not going to quote one here; it is scoped with you. If your volumes make the Significant Data Fiduciary notification plausible, design the programme so that appointment can be switched on without rebuilding it.
SecureRoot is not an accredited ISO certification body; certificates come from the certification body. SecureRoot is not a law firm and does not give legal opinions on the DPDP Act. If you are shortlisting firms rather than sizing a budget, our criteria-first comparison of DPDP compliance companies scores the national field on evidence rather than assertion, the Delhi NCR comparison covers that region, and the DPDP Act service page describes the phases the fee covers.