- Home
- DPDP compliance software
DPDP compliance software: what each type covers
Consent platforms, registered Consent Managers, privacy management tools, security operations tools and compliance operations platforms each cover a different part of the DPDP Act and the CERT-In Directions. Here's what each type does, so you can tell which ones you need.
Page updated · a guide by VinfraSec
In short
No single type of tool covers everything. A consent management platform collects consent; a registered Consent Manager lets people manage their consents across companies; a privacy management tool holds your records and assessments; security operations tools detect incidents; and a compliance operations platform such as VinfraSec Ephor runs the deadlines, drafts and evidence. Most organisations end up using two or three.
- Consent platform
- Collects consent
- Consent Manager
- Registered; acts for people
- Privacy platform
- Records, DPIAs, vendors
- Security tools
- Detect incidents
- Compliance operations
- Deadlines, drafts, evidence
Five types of tool, and what each leaves out
Consent management platform
Covers: Collects consent on websites and apps through banners, forms and preference centres, shows the notice, and records consents and withdrawals. Many now offer DPDP notices in several Indian languages.
Leaves out: Breach clocks, CERT-In reporting and cloud checks. It isn't a Consent Manager unless it is registered with the Data Protection Board.
Registered Consent Manager
Covers: Registered with the Data Protection Board and accountable to the Data Principal, it gives people one interoperable place to give, manage, review and withdraw consent across companies (DPDP Act Sections 2(g) and 6(7) to 6(9)). Under Rule 4 it must be a company incorporated in India with a net worth of at least ₹2 crore. Registration opens on 13 November 2026.
Leaves out: Your internal compliance work: notices, records, breach reporting and evidence stay with you as the Data Fiduciary.
Privacy management platform
Covers: Data discovery and mapping, records of processing, DPIAs, vendor assessments and policies, often across several privacy laws at once. Depth of DPDP coverage varies.
Leaves out: The CERT-In 6-hour incident clock, usually. Check where it hosts your data and runs any AI.
Security operations tools
Covers: SIEM, SOC, managed detection and incident response: they detect and investigate attacks and keep the logs CERT-In asks for. Some help prepare the CERT-In report.
Leaves out: Privacy notices, consent, rights requests and the DPDP records a Data Fiduciary keeps.
Compliance operations platform (VinfraSec Ephor)
Covers: Runs the CERT-In and DPDP deadlines together, drafts regulator reports and DPDP documents for human approval, keeps a signed consent ledger and write-once evidence, and checks AWS configuration. Hosted and processed in India.
Leaves out: Collecting consent from people, acting as a Consent Manager, detecting threats or discovering data across your systems. It works alongside tools that do.
Who covers what
Scroll sideways to see every column, including VinfraSec Ephor.
| Capability | Consent management platform | Registered Consent Manager | Privacy management platform | Security operations tools | VinfraSec Ephor |
|---|---|---|---|---|---|
| Collect consent from people (banners, forms, apps) | Core | Core | Sometimes | Not usually | Not offered; works with yours |
| Act for Data Principals as a registered Consent Manager | Only if registered | Core | Not usually | Not usually | Not offered |
| Prove the notice behind each consent (Section 6(10)) | Often | Varies | Sometimes | Not usually | Available now: signed ledger |
| Stop-processing clock after a withdrawal, with sign-off | Varies | Not usually | Sometimes | Not usually | Available now |
| Privacy notices in the 22 scheduled languages | Often | Varies | Sometimes | Not usually | Available now: linguist-reviewed drafts |
| Records of processing, retention schedule and DPIAs | Sometimes | Not usually | Core | Not usually | Available now: agent drafts |
| Data discovery across your systems | Sometimes | Not usually | Often | Sometimes | Not offered |
| Data Processor contract reviews | Not usually | Not usually | Often | Not usually | Available now |
| Rights requests within the 90-day window | Often | Sometimes | Often | Not usually | Available now |
| CERT-In 6-hour incident clock and report draft | Not usually | Not usually | Sometimes | Sometimes | Available now |
| DPDP breach clocks: Board intimation, 72-hour report, Data Principal notice | Sometimes | Not usually | Often | Sometimes | Available now |
| Threat detection and 24/7 monitoring | Not usually | Not usually | Not usually | Core | Not offered |
| Cloud configuration checks against CERT-In and DPDP | Not usually | Not usually | Sometimes | Often | Available now: AWS; Azure on the roadmap |
| Write-once evidence and a tamper-evident audit trail | Varies | Varies | Sometimes | Often | Available now |
| RBI, NCIIPC/CII and defence-supplier packs | Not usually | Not usually | Sometimes | Sometimes | On the roadmap; VinfraSec consulting today |
Category columns describe what products of that type typically do; individual products differ, so check each vendor's current documentation. The Ephor column describes release 0.2.5.
Questions to ask any DPDP vendor
- Where are your data and any AI processing hosted? Do they ever leave India?
- Does any AI model see Aadhaar, PAN, phone or card numbers unmasked?
- Who submits to CERT-In and the Data Protection Board: the tool, or a named person at our organisation?
- Can evidence be edited or deleted, and how would we find out?
- Do the CERT-In and DPDP clocks run together from one incident?
- Who checks translations of our notices into Indian languages?
- Are you a registered Consent Manager? If not, how do you work with one?
- Are you ISO 27001 certified, and what does the certificate cover?
- Can you name customers or share a case study?
Questions buyers ask
See how VinfraSec Ephor works, how it is secured, or VinfraSec's DPDP consulting.
What is DPDP compliance software?
Software that helps a Data Fiduciary meet the Digital Personal Data Protection Act 2023 and the DPDP Rules 2025. It comes in several types: consent management platforms, registered Consent Managers, privacy management platforms, security operations tools and compliance operations platforms such as VinfraSec Ephor. Each covers a different part of the law, and most organisations use more than one.
Is a consent management platform the same as a Consent Manager?
No. A consent management platform is software a company uses to collect and record consent. A Consent Manager is registered with the Data Protection Board under Rule 4, is accountable to the Data Principal, and lets people give, manage, review and withdraw consent across companies. Registration opens on 13 November 2026.
Does VinfraSec Ephor replace a consent management platform?
No. Ephor doesn't collect consent from people. It receives signed consent events from your consent platform or Consent Manager, proves each consent against its published notice, and runs the stop-processing clock when consent is withdrawn. It also runs the CERT-In and DPDP incident clocks and drafts DPDP documents for your approver.
Which tool should file our CERT-In and DPDP breach reports?
In Ephor, none: agents draft, a named approver at your organisation approves, and a person files and records the reference. Whatever tools you use, check whether they submit anything automatically and who is accountable for it.
Which DPDP tools do we need?
It depends on how you collect consent, how many systems and vendors handle personal data, and whether CERT-In reporting also applies to you. A common pattern is a consent platform for collection, security operations for detection, and a compliance operations platform for deadlines, drafts and evidence. VinfraSec's free readiness scan and gap review can help you decide.
Not sure which tools you need?
Start with a free readiness scan and gap review against CERT-In and DPDP. We'll tell you which gaps a tool closes and which need people or process.