How much does DPDPA compliance cost a mid-size Indian company?

Every CFO we speak to asks the same question in the same order: what will DPDPA cost us, and what happens if we do nothing? The honest answer is that there is no official price list. The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 set obligations, not budgets. What exists is a growing set of published estimates from Indian vendors, consultancies and law-firm commentary. We have pulled them together, explained why they disagree, and laid out the cost lines a mid-size company should actually plan for before the 13 May 2027 deadline.

Why do published DPDPA cost estimates differ by 100x?

Because they describe different companies and different approaches. A consent-platform vendor pricing a single-domain SaaS startup will arrive at a very different figure from a consultancy scoping an in-house build for a 2,000-person conglomerate. All four sources below sell compliance products or services, so read each as a directional benchmark rather than a quote. What matters is the size band and the assumptions behind each figure.

Published source (2026)	Size band described	Year-one estimate	Ongoing
Consently cost breakdown (Apr 2026)	SME: 10,000–5,00,000 users, 2–5 domains	₹3–8 lakh	About a third of year one
Kraver.ai SME vs enterprise analysis (Mar 2026)	Mid-market: 200–1,000 employees, ₹50–500 crore revenue	₹25–75 lakh	₹15–40 lakh a year
Kraver.ai, citing a DSCI benchmark	Mid-market average	₹42 lakh (technology and people about 70%)	Not stated
Privy by IDfy CFO guide (Jun 2026)	500–2,000 employees, built in-house	₹5.3–8.75 crore	2–5% of annual IT budget
eCorpIT, citing TCSA consulting rates (Jul 2026)	Mid-market, end-to-end consulting only	₹2–3 lakh (advice, excluding tooling and people)	Not stated

The gap is not a contradiction. The ₹3–8 lakh figures assume an existing team absorbs the work and a low-cost platform handles consent. The ₹5 crore-plus figures assume a dedicated privacy engineering team of three or four people, a mid-senior DPO at ₹40–80 lakh a year and 12–18 months of build. A mid-size company with a few lakh customer records, two or three digital properties and no children's data usually lands between those poles, which is why the ₹25–75 lakh band is the most useful starting point for a board paper.

What are the seven cost lines in a mid-size DPDPA budget?

Strip away vendor labels and every published estimate is built from the same seven lines. The ranges below are for a 200–1,000-employee company and draw on the Kraver.ai and Consently breakdowns; treat them as planning bands.

1. Consent and notice infrastructure (₹3–8 lakh a year). Purpose-level consent capture, versioned notices, withdrawal that is as easy as giving consent (Section 6(4)), and consent records you can produce on demand. Notices must be available in English or any of the 22 Eighth Schedule languages (Section 5(3)); translation alone is quoted at ₹2–4 lakh a year with most vendors.
2. Data discovery and mapping (₹2–5 lakh). Finding personal data across CRM, HRMS, ERP, support desks and spreadsheets, then classifying it by purpose. This is the step most teams underestimate and the one every later control depends on.
3. Privacy lead or DPO (₹8–18 lakh a year). A full-time hire is quoted at ₹12–18 lakh, a senior fractional DPO at ₹8–12 lakh. Only Significant Data Fiduciaries must appoint an India-based DPO under Section 10(2)(a), but someone has to own the programme either way.
4. Legal and policy work (₹3–8 lakh one-time plus retainer). Gap assessment, privacy policy and notice suite, processor contracts under Section 8(2), and an annual advisory retainer.
5. Data Principal rights and grievance workflows (₹3–10 lakh). Access, correction, erasure and nomination requests under Sections 11–14, with the Rules' outer limit of 90 days to respond. Engineering these into existing systems is often the single most expensive build item.
6. Breach detection, logging and 72-hour notification (₹3–8 lakh a year). Log retention, alerting and a tested runbook for reporting to the Data Protection Board and affected individuals under Section 8(6) and Rule 7.
7. Training and awareness (₹1–3 lakh a year). Role-based training for sales, HR, support and engineering, refreshed annually and evidenced for audit.

Add two more lines only if the Central Government notifies you as a Significant Data Fiduciary under Section 10: an independent data auditor and periodic Data Protection Impact Assessments, quoted at ₹50,000–1.5 lakh per DPIA and ₹1.5–3 lakh for an external audit.

Which four factors move your number the most?

• Digital footprint. Consent licensing scales with domains, apps and monthly consent volume. One published figure puts consent management alone at ₹30–40 lakh a year for a group with 30–50 digital properties.
• Children's data. If you process data of anyone under 18, Section 9 requires verifiable parental consent and bans tracking, behavioural monitoring and targeted advertising. That adds age-assurance and consent flows most B2B companies never need.
• Significant Data Fiduciary status. SDF notification adds the India-based DPO, the data auditor, DPIAs and tighter reporting. Budget for it if you hold large volumes of sensitive or financial data.
• Build versus buy. Vendor analyses claim automation cuts programme cost by 40–60% against a build-and-staff approach. The claim is self-interested, but the direction matches what we see: the expensive part of DPDPA is engineering consent, rights and evidence into systems that were never designed for them.

What does non-compliance cost by comparison?

The Schedule to the Act sets fixed caps per contravention, and penalties for multiple contraventions stack. The Data Protection Board decides the actual amount after considering the nature, gravity and duration of the breach, so the caps are ceilings, not tariffs. Even so, the arithmetic a CFO needs is simple: the top of the mid-size budget band is under 0.3% of the largest single cap.

Contravention	Maximum penalty
Failure to take reasonable security safeguards (Section 8(5))	₹250 crore
Failure to notify a personal data breach to the Board or affected individuals (Section 8(6))	₹200 crore
Non-compliance with children's data obligations (Section 9)	₹200 crore
Non-compliance with Significant Data Fiduciary obligations (Section 10)	₹150 crore
Any other contravention of the Act or Rules	₹50 crore

Penalties are only part of the exposure. One vendor analysis cites IBM's 2025 breach study putting the average cost of a data breach in India at about ₹19.5 crore before any regulatory penalty. We covered the full penalty logic in DPDPA penalties up to ₹250 crore: the real cost of waiting.

How should a CFO phase the spend before 13 May 2027?

The Rules took effect in phases: the Data Protection Board provisions on 13 November 2025, the Consent Manager framework on 13 November 2026, and the substantive obligations on data fiduciaries on 13 May 2027 (see our DPDPA compliance timeline). That leaves roughly two quarters of real work. A phased budget spreads cost across financial years and front-loads the items everything else depends on.

1. November–December 2026 (about 25% of year-one spend): gap assessment, data discovery and mapping, processing register, decision on SDF exposure and whether a Consent Manager integration is relevant (most companies will not need to register as one; see Consent Managers vs consent management platforms).
2. January–March 2027 (about 50%): consent and notice infrastructure in all customer-facing properties, rights and grievance workflows, processor contract amendments, CRM and marketing clean-up (our 8-point CRM checklist is a practical starting list).
3. April–May 2027 (about 25%): breach runbook and tabletop exercise, role-based training, evidence collection, and a readiness review by counsel or an auditor.

For the split within that budget, one published analysis of Asia-Pacific privacy programmes puts personnel at 45–55% of spend, technology at 25–30%, legal at 10–15% and training and audit at 5–10%. Indian mid-size companies we work with skew more towards technology in year one, because the people cost is often absorbed by an existing security or compliance lead.

How does a compliance platform change the maths?

The expensive parts of a DPDPA programme are consent capture, rights handling and evidence, rebuilt separately in every system that holds personal data. A platform that sits across those systems collapses most of lines 1, 5 and 6 above into a subscription. DAPro (Data Adhikaar), Qodequay's DPDPA compliance platform, provides notices in 22 languages, a tamper-evident Evidence Vault and 25+ connectors to the CRM, HRMS and support tools a mid-size company already runs, so the year-one build becomes a configuration project rather than an engineering programme. Qodequay is ISO 9001:2015 and ISO 27001:2022 certified.

If you are preparing a board paper on DPDPA, we will walk through your data footprint and give you a scoped estimate rather than a range. Book a 30-minute DPDPA budgeting call.

This article is for general information and is not legal advice. Cost figures are published third-party estimates and will vary by organisation. Confirm obligations against the official texts of the DPDP Act, 2023 and the DPDP Rules, 2025, and consult qualified counsel for your situation.