This is not a ranked list of vendors. It is the set of questions we would ask any consent management platform, including ours, each tied to the section of the Act or the Rule that makes it matter. Use it to run a shortlist, a demo or a renewal.
Last reviewed · Sources: G.S.R. 843(E), G.S.R. 846(E), Lok Sabha Q.3960 (12 Aug 2026)
At minimum, it should give a Rule 3 notice in English or any Eighth Schedule language, record purpose-level consent with the notice version shown, make withdrawal as easy as consent and pass it to your Data Processors, and export a record that proves notice and consent under section 6(10).
If consent is questioned, you must prove both the notice and the consent. A dashboard count is not proof.
Show me the export for one Data Principal: which notice version, language, purposes, method and timestamp. Can it be shown not to have been altered since?
Consent is only as good as the notice it followed. Changing the notice without versioning breaks the link.
When we edit a notice, what happens to consents given on the old version? Can we see both texts?
The Data Principal can choose English or any of 22 languages for the notice and the consent request.
Which of the 22 do you support today, who reviews the translations, and is each language priced separately?
Consent must be specific and limited to the data necessary for each purpose. One checkbox for everything fails.
Can a person accept one purpose and refuse another in the same flow, and is each recorded separately?
Withdrawal must be as easy as consent, and you must make your Data Processors stop within a reasonable time.
When someone withdraws, how do downstream systems and vendors find out, and how is that logged?
If the consent check fails or times out, processing that needs consent should not go ahead by default.
What does your SDK or API return when the service is unreachable? Do our systems process or hold?
Scripts that load before the choice process personal data without consent.
Do you block tags before consent, or only record the choice? How often do you re-scan?
Under-18s need verifiable parental consent, and must not be tracked or targeted.
How do you record a parent's or guardian's verification, and switch off tracking for a child?
Requests and grievances need a published channel and a response within the period you publish, at most 90 days.
Does the platform track each request against our published period and record the outcome?
Tools designed around legitimate interests and Article 30 bend awkwardly to consent-or-legitimate-use.
Where in the product are the section 7 legitimate uses, Consent Managers and Data Principal nominations modelled?
It can be configured, but check the gaps. The DPDP Act has no legitimate-interest ground, requires notices in Eighth Schedule languages on request, puts the burden of proving consent on the Data Fiduciary, and has its own breach, children's-data and Consent Manager rules. Many GDPR tools assume otherwise.
The DPDP Act vs GDPR comparison sets out each difference with its section. Run criteria 3, 5 and 10 hardest against a tool built for Europe first.
TruPriv is a consent management platform, currently onboarding early access partners. Hold us to the same ten questions.
At minimum, it should give a Rule 3 notice in English or any Eighth Schedule language, record purpose-level consent with the notice version shown, make withdrawal as easy as consent and pass it to your Data Processors, and export a record that proves notice and consent under section 6(10).
It can be configured, but check the gaps. The DPDP Act has no legitimate-interest ground, requires notices in Eighth Schedule languages on request, puts the burden of proving consent on the Data Fiduciary, and has its own breach, children's-data and Consent Manager rules. Many GDPR tools assume otherwise.
This guide summarises the DPDP Act, 2023 and the DPDP Rules, 2025; the Gazette texts govern. This is informational and is not legal advice. Liability under the DPDP Act, 2023 remains with the Data Fiduciary.
