Fixed-price DPDP readiness for funded startups, bought through their investors
TL;DR Lockharbor gets venture-backed Indian startups ready for the DPDP Act on a fixed scope and a fixed price - data map, notices, vendor clauses, breach runbook and a part-time privacy lead. Investors buy it for their portfolios in bulk, which cuts the sales cost that usually kills small compliance firms.
India's data protection rules were notified on 13 November 2025, and the penalties apply from 13 May 2027[1]. The ceilings are steep, with up to ₹250 Cr for weak security safeguards and up to ₹200 Cr for mishandling children's data[1][2]. There's no exemption by revenue or headcount.
Most companies have barely started. A large consulting firm's India survey, reported in the startup press, found about 81% hadn't yet updated their privacy policies or governance, and only 48% had begun a gap assessment[2].
Early-stage startups are worse placed than most. They collect phone numbers, location and payment data from day one, nobody owns privacy and a large consulting firm's quote is way out of reach.
Lockharbor sells one product in three sizes, priced by the number of systems and vendors a startup runs. Every engagement follows the same eight-week path - a data map built from the startup's own tools, plain-language notices, a consent and withdrawal flow for the product team, processor clauses for every vendor, a breach-response runbook that meets the CERT-In six-hour reporting rule[3] and a quarterly review after that. A named privacy lead stays on call for founders' questions.
The seed pitched fully automated privacy-as-a-service, and I narrowed it. Software can collect the facts, but notices, data maps and vendor contracts need someone to make judgement calls, and startups want a person who picks up the phone. So Lockharbor uses templates and checklists to keep each engagement cheap and leaves the judgement to a human. Contract drafting and any legal opinion go to a partner law firm, because Lockharbor is not a law firm.
The distribution twist matters most. A VC fund buys 10–30 engagements at once for its portfolio, because one breach headline can hurt a portfolio company's next round.
The user is a startup's CTO or head of operations. The payer is usually the startup itself, but the cheapest route in is the investor's platform team, which already pays for perks like cloud credits and legal templates. Today's alternatives set the price range - fractional DPO services run ₹2–8 L a year, an in-house DPO costs ₹25–40 L[2], and one privacy consultancy quotes ₹1.5–4 L for a DPDP programme[4].
The deadline is fixed. Full obligations land on 13 May 2027, and consent-manager registration opens in November 2026[1]. Investors will ask about DPDP in due diligence from here on, and founders raising in 2027 need a clean answer. That same firm expects more than ₹10,000 Cr of DPDP compliance services over three years[2].
There's no figure for the startup segment alone. The adjacent figure is that consulting firm's estimate of more than ₹10,000 Cr in DPDP compliance services over three years, reported in the startup press[2]. The firmer signal is behaviour - startups already pay ₹2–8 L a year for fractional DPOs[2], and a crowd of consultancies now advertises DPDP programmes[4]. Treat that number as the whole market, not yours.
At least five Indian privacy and security consultancies sell DPDP consulting, and most quote only on request[4]. Some also offer DPO-as-a-service. The global enterprise privacy suites sell software with impact assessments built in[5], which is far too heavy for a 40-person startup.
The gap is a priced, repeatable package bought in bulk through investors, where today each firm sells one custom project at a time.
| Difficulty | Moderate (37/100) |
| Starting capital | ₹40–75 L |
| Time to launch | 3–5 months |
The build is light. Margin is the hard part. Every startup's stack is different, and a fixed price only works if your team can map a typical startup in days and not weeks. You also need privacy people who can explain trade-offs to an engineer, and that talent is scarce while every consultancy is hiring for the same deadline.
No sector licence to run the service, but the rules you sell against shape how you work.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Don't let AI give legal opinions or sign off a notice on its own. That judgement stays with a person and the partner law firm.
Want to work out the AI layer for Lockharbor? Talk to Yash →
I think this works for a founder from privacy consulting, or a startup lawyer with operating experience, who can sign two or three VC funds as channel partners. If you want to sell pure software then look elsewhere. Prove first that one fund will buy ten engagements, and that you can finish one inside 40 hours of staff time.
Plan for roughly ₹40–75 L, mostly on privacy staff, templates and a partner law firm.
No sector licence, but only enrolled advocates can give legal advice, so route contract drafting and opinions through a partner law firm.
Yes. Most countries now have a data protection law, so the same eight-week path works if you rebuild the templates around the local rules.
The free Lockharbor validation kit has the line-by-line capital breakdown, the effort scoring, the DPDP and CERT-In checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for founders and fund platform teams, and 5 assumptions to test. Download the kit →
Thinking about building Lockharbor or something close to it? The make-or-break work is pricing a fixed scope that stays profitable across very different startup stacks, and pricing is something I love to dig into with founders. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.