What to ask when a vendor says it is DPDP compliant

‘We are DPDP compliant’ can mean several very different things. A vendor may have updated its contract, added a deletion function, completed a security assessment or simply copied a phrase into its sales material. Before relying on the claim, ask what it covers and what evidence would let your team assess it.

The aim is not to demand a perfect answer to every possible privacy question. It is to establish whether this service, in your intended configuration, can support the responsibilities you will still hold.

Check the date behind the claim

On 22 October 2026, the notified framework has phased commencement. The Consent Manager registration phase is scheduled for 13 November 2026, while most substantive business duties and rights are scheduled for 13 May 2027 under the commencement notification. A vendor should distinguish present controls, readiness work and future statutory requirements.

A statement that every DPDP obligation is already operative would be a reason to question the vendor’s legal mapping. So would a claim that final Rules do not yet exist. Ask for the date and source behind the assessment, and who will revisit it when a relevant phase or notification changes.

Ask five questions that produce useful evidence

First, what exactly is covered? Request the service name, deployment model, version or release boundary, enabled features and excluded components. A control in a hosted enterprise edition may be absent from a different plan or configuration. A statement about the supplier’s internal HR records tells you little about the customer-data service you intend to buy.

Second, which legal responsibilities does the vendor expect to perform? Map the actual purpose and processing instructions. Under the future section 8(1) framework, a fiduciary will remain accountable for processing carried out on its behalf despite contrary contractual arrangements. The vendor’s assurance cannot transfer that responsibility away from your organisation.

Third, what can you observe? Ask for a demonstration using synthetic records: a restricted user account, a consent change if relevant, a failed operation, an export and an exit process. An observed workflow is stronger evidence of that workflow than a slide stating that it is supported. It still does not establish that every deployment will behave identically.

Fourth, what do the documents commit to? Compare the demonstration with the contract, support responsibilities, downstream-provider terms and incident escalation route. Rule 6 identifies several categories of safeguards in the future framework. One encryption statement or security test does not answer every category or prove legal sufficiency.

Fifth, what remains your task? Find out who configures purposes, writes notices, decides retention, approves access and handles exceptions. A product may enforce a decision well while leaving the substance of that decision entirely to you.

A hypothetical product demonstration

Imagine a vendor demonstrates a customer erasure button. Your team asks what happens to an associated search index, a queued export and a legally retained record. The vendor shows the main database deletion but cannot explain the other locations.

That result does not automatically mean the product is unusable. It means the demonstrated capability has a narrower scope than the original claim. Record the limitation, ask whether another control covers it and decide whether the remaining work fits your process. Do not convert a successful button click into an organisation-wide compliance conclusion.

Ask for the same clarity when a vendor presents a certificate. Check the entity, scope, dates and assessment criteria. A certificate can support a defined assurance, but it cannot answer unrelated questions about your purposes, notices or particular deployment.

Treat statutory titles carefully

A registered Consent Manager is a particular legal role. Registration under section 6(9) and rule 4 with the First Schedule is different from providing consent-related software. A company should not be treated as registered merely because its product stores preferences or uses that phrase in marketing.

Where registration is claimed, request verifiable official evidence appropriate to the date. Where it is not claimed, assess the software on its actual capabilities without inventing a status it does not have. The same discipline applies to assertions of government approval or guaranteed compliance.

Make a bounded procurement decision

Keep a short claim-and-evidence record. For each important promise, note the proof reviewed, the limitation, the person responsible for the remaining work and the condition for acceptance. A transparent gap can sometimes be managed. An answer that repeatedly changes the claim’s meaning is harder to rely on.

Choose a service because the evidence supports your intended use and the remaining responsibilities are manageable. Keep the decision open to review when the product, your data flow or the legal framework changes.