The recurring engagement
What a DPDP retainer contains, month by month
By Suryansh Sagar, founder of Gevox. Last updated 6 October 2026.
A DPDP retainer pays for the operational half of compliance: answering rights requests within the ninety-day ceiling, being ready to report a breach within seventy-two hours, and keeping the notice and the website in step as the business changes. Month one sets the baseline, each month after is a watch-and-respond cycle, and every month should end with a report the client can read.
From the Gevox Readiness Index: Gevox scanned the websites of twenty Indian firms that sell DPDP advice. Nineteen set cookies or loaded tracking before anyone had consented, and the average score was 71 out of 100.
Month one: the baseline
Everything the rest of the retainer is measured against.
- The full examination of the website, recorded as the baseline, so later months report movement rather than a fresh list.
- The registers opened: rights requests with the ninety-day clock from Rule 14, breaches with the duties from Rule 7.
- The processor list confirmed against contracts, since under Section 8 the client stays responsible for them.
- A named contact inside the client for requests and incidents, and an agreed route to reach you.
Months two and three: watch and respond
The work becomes a cycle. Re-examine the website on a schedule, because websites change every time a marketing tag is added, and the commonest way a closed finding reopens is a new tag added before the consent gate. Answer requests as they arrive. Review whether the notice still describes what the business does.
What the monthly report should say
A monthly report that only restates the position is last month’s report with a new date, and a client stops opening it by the third month. The report should lead with what moved: the score, what closed, what is newly open, what is still outstanding, and any request or breach clock that is running. A quiet month is a result too, and the report should say so plainly.
Pricing the retainer
Virtual DPO retainers in India are advertised from around Rs 35,000 a month. Whatever the fee, the client is paying for continuity: somebody watching, somebody answering, and a record that proves both. On Suite the tooling costs Rs 375 per client each month.
Questions practitioners ask
- What is the difference between a DPDP engagement and a retainer?
- An engagement sets compliance up: intake, examination, gap assessment and documents. A retainer keeps it working: requests answered, breaches reported, and the website and notice kept current.
- How often should a client’s website be re-examined?
- At least monthly, and weekly for a site that changes often. The commonest regression is a marketing tag added outside the consent gate.
- What should happen if nothing changed this month?
- The report should say so, and restate what is still outstanding. A quiet month is a result, not a reason to skip the report.
- How much does a DPDP retainer cost in India?
- Virtual DPO retainers are advertised from around Rs 35,000 a month. The fee should reflect the number of live obligations and how often the client’s systems change.
Read next
Start with three clients
Run a real engagement on Gevox for thirty days, then decide.
The Starter Pass is Rs 999 once, for 3 client workspaces with every module unlocked. After that, Suite is Rs 375 per client each month.
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.