For DPDP consultants and virtual DPOs
DPDP compliance software for consultants
By Suryansh Sagar, founder of Gevox. Last updated 6 October 2026.
Gevox is a DPDP workspace built for the consultant rather than the client: one workspace per client holding the intake, a website examination, the documents, the obligation register, the live rights and breach clocks, and an assessment you can hand over under your own name. It replaces the Word templates, the Excel register and the calendar reminders most engagements are run on today.
From the Gevox Readiness Index: Gevox scanned the websites of twenty Indian firms that sell DPDP advice. Nineteen set cookies or loaded tracking before anyone had consented, and the average score was 71 out of 100.
What a DPDP engagement actually involves
Every engagement arrives at the same six deliverables, whoever runs it. A fact base about the client: what personal data it collects, why, from whom, and who it passes the data to. An examination of what the client does in public, starting with its website. A gap assessment against the Act and the Rules. The documents: a notice that meets Rule 3, a consent request that meets Section 6, processor agreements under Section 8. Then the operational half, which is where a one-off engagement becomes a relationship: rights requests answered within the ninety days Rule 14 allows, and breaches reported within the seventy-two hours Rule 7 allows.
None of that is difficult for someone who knows the law. Most of it is slow, because the same facts about the client are typed into the notice, the register, the processor agreement and the retention schedule, and then have to be kept in step by hand.
The arithmetic that decides how many clients you can take
The substantive obligations commence on 13 May 2027, under Rule 1. That is 29 weeks from today. A manual engagement usually takes eight to twelve weeks, so one consultant working through clients one after another finishes somewhere between 2 and 3 of them before that date.
On Gevox the limit is not weeks but client workspaces: 15 on Practice and 40 on Suite. The engagements run side by side, because the parts that take the time, intake, examination, drafting and tracking, no longer wait on you.
What changes, stage by stage
The judgement stays yours. What moves into the workspace is the carrying.
- Intake by link. The client answers a structured questionnaire and uploads documents against a request list. Nobody needs an account, and the answers land in their workspace.
- A real examination of the website. Twenty-two checks run in a real browser, recording the cookies, storage and third-party scripts the page actually uses, each finding cited to its provision.
- Documents built from the intake, so a fact entered once appears everywhere it belongs and changes everywhere when it changes.
- An obligation register that says, for this client, what applies, what is evidenced and what is open.
- Rights and breach registers with the statutory clocks running live, and one list of everything due this week across every client you hold.
- Monitoring that re-examines each client site on a schedule and produces a monthly report of what moved, which is the deliverable a retainer is billed against.
- A gap assessment report the client can read, carrying your firm’s name on Suite.
What it does not do
It does not give legal advice, and nothing it produces claims a client is compliant. A finding is a position on a date. No language model decides any finding either: the same site examined twice on an unchanged day returns the same result, which is what lets you put your name to it. And it does not make changes on a client’s systems. The roadmap says what to do; the client’s own people do it.
Questions practitioners ask
- Is Gevox for the consultant or for the client?
- For the consultant. Each client has a workspace inside your account. Clients never need to sign in: they answer the intake by link, and they receive reports you choose to send.
- Can the deliverables carry my firm’s name? Is Gevox white-label?
- Yes. Suite and Firm are white-label. The gap assessment and the monthly monitoring report print your firm’s name in place of Gevox, with a small Gevox line at the foot of each page.
- Does Gevox use AI to decide whether a client is compliant?
- No. Every check is deterministic and cites the provision it tests. A check that cannot be verified is never counted as a pass. The same site examined twice on an unchanged day produces the same findings.
- How are different clients kept apart?
- Each client is a separate workspace. Documents, registers and scans belong to one workspace and are never shown in another.
- What does it cost per client?
- Suite is Rs 14,999 a month for 40 client workspaces, which is Rs 375 per client. Practice is Rs 9,999 a month for 15.
- Can I try it on real clients before paying monthly?
- Yes. The Starter Pass is Rs 999 once, for thirty days, with 3 client workspaces and every module unlocked.
Read next
Start with three clients
Run a real engagement on Gevox for thirty days, then decide.
The Starter Pass is Rs 999 once, for 3 client workspaces with every module unlocked. After that, Suite is Rs 375 per client each month.
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.