What is a DPDP compliance platform?

The distinction that matters is between documents and operations. A great deal of what is sold as DPDP compliance is a set of written artefacts — a privacy notice, a retention schedule, a breach response plan — which are necessary and are not what the Act is enforced against. Enforcement follows what your systems did: whether consent was valid when it was taken, whether processing stopped when it was withdrawn, whether a rights request was answered, whether a breach was reported. A platform exists to make those things happen reliably and to leave a record that they happened.

That is why obligation coverage is the right way to evaluate one rather than feature count. The Act and the Rules impose a specific and finite set of duties, and the useful question about any product is which of them it operationalises end to end, which it partially supports, and which it leaves to you.

There is a second question worth asking early, because it changes the shortlist: whether the product was built against the DPDP Act or adapted from a GDPR product. Several obligations have no direct GDPR counterpart — notice in any of the twenty-two Eighth Schedule languages under §5(3), the right to nominate under §14, the specific role of a registered Consent Manager. An adapted product tends to have none of them, and they are the ones an Indian regulator will ask about.

• Consent — capture per purpose, prove it later, and honour withdrawal as easily as it was given (§6).
• Notice — publish it, version it, and be able to serve it in the language the person asks for (§5).
• Data principal rights — publish how to make a request, verify identity, route it, answer on a clock, and give reasons when you refuse (§11, §12, §14 and Rule 14).
• Grievances — publish a route, acknowledge, resolve within the statutory window, and keep a register (§13).
• Breach — run the clock to the Data Protection Board, notify affected principals individually, and close on a root cause (§8).
• Records — maintain a record of processing that reflects the systems you actually run, not the ones you described in a workshop.
• Evidence — every one of the above producing an artefact without anyone being asked to file one.

General information about the DPDP Act, not legal advice. Obligations depend on your circumstances.