The delivery sequence
How to deliver a DPDP engagement, start to finish
By Suryansh Sagar, founder of Gevox. Last updated 6 October 2026.
A DPDP engagement runs in six stages: intake, examination, gap assessment, documents, operation and evidence. Done by hand it usually takes eight to twelve weeks; below is what each stage produces, the law behind it, and which parts a platform can collapse.
From the Gevox Readiness Index: Across twenty DPDP advisor websites, the notice and the privacy contact were present on three in five. The visible obligations get done; the technical ones, consent before tracking and named processors, mostly do not.
Before you start
Agree the scope in writing. Say whether the engagement covers the website only, or the whole business: internal systems, staff practice, vendor contracts and paper records. The most common dispute in this work is a client who expected the findings to be fixed for them. State that implementation is the client’s, and that the engagement ends in advice and documents.
Then check the deadline against the calendar. The substantive obligations commence on 13 May 2027 under Rule 1, 29 weeks from today.
Common mistakes
Four that recur across engagements.
- Treating the privacy policy as the notice. Rule 3 wants a notice that stands on its own and itemises the data and the purposes.
- Checking the banner, not the behaviour. A banner that appears after the advertising cookies are already set does not meet Section 6.
- Forgetting processors. Under Section 8 the client is responsible for processing done on its behalf, so every form provider, analytics vendor and support tool needs a contract.
- Ending at the documents. A rights request under Rule 14 or a breach under Rule 7 will arrive after you have handed over the file. Decide in the engagement letter who is watching for it.
The six stages
What each stage produces, the provision behind it, how long it usually takes by hand, and what changes on a platform.
- 01
Intake
A fact base: what personal data the client collects, from whom, for what purpose, which processors receive it, whether any of it leaves India, whether children use the service.
Sections 5 and 7, Rule 3
- By hand
- One to two weeks of questionnaires, calls and chasing documents.
- On Gevox
- A structured intake by link with a document request list. The client answers once.
- 02
Examination
What the client does in public: cookies and tracking before consent, the notice, security headers, named processors, the privacy contact.
Section 6, Section 8(5), Rule 6
- By hand
- A few days of manual review, which cannot see what scripts do at runtime.
- On Gevox
- Twenty-two checks in a real browser, each cited, in about a minute.
- 03
Gap assessment
Each applicable obligation against the facts: met, open or needing confirmation, with severity and the penalty band.
The Schedule
- By hand
- About two weeks to assess and write up.
- On Gevox
- An obligation register built from the intake and the scan, and a client-ready report.
- 04
Documents
The notice, the consent request, processor agreements, a retention schedule, the grievance route and a breach response plan.
Sections 5, 6, 8(2), 8(7), Rule 8
- By hand
- Two to four weeks of drafting from templates, with every client fact retyped into each.
- On Gevox
- Drafts generated from the intake, for review, with facts entered once.
- 05
Operation
A working way to answer rights requests, withdraw consent, erase data and report breaches.
Section 6(4), Rule 14, Rule 7
- By hand
- A register template and calendar reminders.
- On Gevox
- Rights and breach registers with the clocks computed live, and one list across every client.
- 06
Evidence
A file the client can show an auditor or the Board, and a way to keep it current.
Section 8(1), Rule 6(1)(e)
- By hand
- A folder of documents, reviewed again when somebody remembers.
- On Gevox
- Scheduled re-examination with a monthly report, and a compliance file export on Suite.
Questions practitioners ask
- How long does a DPDP compliance engagement take?
- Done by hand, usually eight to twelve weeks from intake to handover, with the readiness assessment alone around two weeks. Most of the time goes on gathering facts and retyping them into documents.
- What does a DPDP compliance engagement cost in India?
- Indian consultancies publish fixed fees of Rs 1.5 to 4 lakh for a DPDP engagement, depending on the size of the business and whether the scope is the website or the whole organisation. Retainers for the recurring work are priced separately.
- What does a DPDP gap assessment contain?
- Each obligation that applies to the client, marked met, open or needing confirmation, the provision behind it, its severity, the penalty band, and the order in which to close the gaps.
- Should the engagement include fixing the website?
- Usually not. Most engagements end in advice and documents, with implementation done by the client’s own developers. Say so in the engagement letter, since it is the most common source of disputes.
- What happens after the engagement ends?
- Rights requests, breaches and website changes keep arriving. That operational work is what a monthly retainer is for.
Read next
Start with three clients
Run a real engagement on Gevox for thirty days, then decide.
The Starter Pass is Rs 999 once, for 3 client workspaces with every module unlocked. After that, Suite is Rs 375 per client each month.
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.