Toshad Sambhare- Most DPDP obligations apply from May 2027, so the question isn't who needs it but who has started.
- Hiring a DPO, rewriting a privacy policy and reviewing consent tools are the clearest signs.
- We write separately for the DPO, the CISO and the CTO, and offer a workshop instead of a demo.
Everyone needs it. Few are moving.
The DPDP Rules were notified in November 2025, with most obligations applying from May 2027. On paper that makes almost every company in India a prospect for compliance software and consulting. In practice, most haven't started, and a company that hasn't started won't take a meeting.
So our lists for compliance clients aren't built on who needs DPDP. They're built on who has started. (Check the latest timeline before you write to it. We do before every campaign.)
The six signals
- DPO and privacy hires. A company posting for a Data Protection Officer, a privacy lead or a compliance manager is about to have someone who owns the problem.
- Policy rewrites. New privacy notices and consent banners mean the work has started and a tooling decision is close.
- Deadline exposure. Big personal-data handlers in BFSI, health, e-commerce and IT, especially with no DPO visible on LinkedIn.
- Audit cycles. ISO 27001 and SOC 2 renewals. DPDP usually comes up next on the same team's list.
- Tool reviews. Teams comparing consent or privacy tools, or following rival vendors.
- Incidents and deals. A data incident in their sector, or funding, M&A and IPO plans, puts privacy on the board agenda.
Kestrel Finance is hiring a Data Protection OfficerNBFC, 1,200 peopleHot2d
Corvus Health rewrote its privacy policyNew consent banner this weekTier 14h
Tessera Labs is comparing consent toolsThree vendors on G2Tier 11d
New CISO at Ardent InsuranceJoined 30 days agoTier 23d
Who to reach, and what to say
The buying committee is big: the DPO, the CISO, the head of compliance and the CTO, and in banks often legal and risk too. Each one needs a different reason to reply, so each gets their own message. The DPO hears about consent and data requests. The CISO hears about breach reporting. The CTO hears about finding the data in the first place.
Plain language wins. Buyers have read enough compliance jargon this year.
Offer a workshop, not a demo
For a compliance product, a short DPDP workshop gets far more yeses than "book a demo". For a consultancy, a gap assessment does the same job. Webinars on putting DPDP into practice keep the slower movers close until they're ready.
For one compliance client, this approach produced 110+ qualified leads and 81 scoping calls in six months, with leads at companies like Bajaj Finance, PhonePe, Lenskart and Ambuja Cement.
