DPDP Comply vs Osano — A US Privacy Platform Meets Indian Law

Osano is a privacy platform with a good reputation: consent management, a data privacy dashboard, vendor risk monitoring, and subject rights request handling, built primarily around GDPR and the US state privacy laws.

If you are an Indian business evaluating it against DPDP Comply, the question is not whether Osano is a good product. It is whether a platform whose model of privacy law was formed by GDPR and CCPA expresses India's DPDP Act 2023 accurately, or approximately.

Overview

Osano

Osano offers a consent management platform with a large pre-classified cookie database, a subject rights request workflow, vendor and third-party risk monitoring, and compliance reporting across the regulations it supports. Its market is primarily North American and European organisations.

DPDP Comply

DPDP Comply implements the DPDP Act specifically: consent under Section 6 bound to the notice under Section 5, rights under Sections 11 to 14, grievance redressal under Section 13, verifiable parental consent under Section 9, breach records for Section 8(6), and cross-border handling under Section 16.

Where GDPR habits mislead under DPDP

This is the substance of the comparison. The two laws look similar from a distance and diverge in ways that matter operationally.

There is no legitimate interest. GDPR gives six lawful bases, and in practice a great deal of processing runs on legitimate interest. The DPDP Act does not offer it. Processing rests on consent or on specified legitimate uses, which are enumerated and narrower than the phrase suggests. A platform whose consent model assumes a legitimate-interest fallback will encourage a posture that has no basis in Indian law.

Cross-border transfer runs the other way. GDPR restricts transfer unless an adequacy decision or appropriate safeguards apply. Section 16 of the DPDP Act permits transfer except to countries the government places on a restricted list. The default is opposite. A tool that models transfers as adequacy-gated will produce warnings that do not correspond to your actual obligations. We wrote up the detail in cross-border data transfer under Section 16.

Notice is its own obligation. Section 5 sets out what the notice accompanying consent must contain, and the person is entitled to it in English or any language in the Eighth Schedule. That is a versioned document tied to each consent record, not a link in a banner. See multilingual consent.

Children are defined differently and treated more strictly. Section 9 requires verifiable parental consent for anyone under 18 — not 13, not 16 — and prohibits tracking and targeted advertising directed at children. An age gate calibrated to COPPA or GDPR-K is calibrated wrong for India. See children's data under Section 9.

Grievance redressal is a named obligation. Section 13 requires a readily available means of grievance redressal, and the Data Protection Board sits above it. A generic DSAR queue is not the same as a published grievance route with an owner.

Consent evidence

Both products log consent. The question is what the log proves.

DPDP Comply binds each consent record to the notice version in force when it was given, records every change as an append-only audit event, and issues a verifiable receipt. When someone withdraws — and withdrawal must be as easy as giving, under Section 6 — the record shows what they had agreed to and when it stopped.

That structure exists because the burden of proof in an Indian regulatory inquiry sits with the Data Fiduciary, and "our platform recorded an accept" is a weaker answer than "here is the notice they saw and the receipt they hold".

Support and time zones

A smaller point that turns out to matter: when a rights request goes wrong, or a banner misbehaves during an Indian business day, whether your vendor's support is awake is a practical concern rather than a marketing line. So is whether the people answering have read the DPDP Rules.

The cost of compliance, not the cost of the tool

We do not publish competitor pricing here — it changes and we would rather not quote a stale figure about someone else's business. Our own pricing is public, with a free tier that covers the banner and basic rights handling.

The comparison worth doing is whether one platform covers your DPDP obligations end to end, or covers consent while you assemble the rest.

Who should choose what

Choose Osano if

• GDPR and US state privacy law are your primary obligations
• Your users and regulators are mostly outside India
• Third-party and vendor risk monitoring is a core requirement
• DPDP is a secondary market you will handle approximately for now

Choose DPDP Comply if

• India is your primary market and DPDP your primary obligation
• You want Section 16 handled as a negative list, not as adequacy
• You need verifiable parental consent calibrated to under-18
• You need a grievance route, not a generic DSAR queue
• You want support in your time zone from people who follow the Rules

The bottom line

Osano is a capable platform built for a different legal system. Much of what it does transfers; the parts that do not are precisely the parts where the DPDP Act is distinctive, and those are the parts a regulator will ask about.

If you want a concrete starting point rather than a feature matrix, run the free readiness check against your own site. It records what actually loads for a visitor from India and tells you where it could not check rather than assuming the worst — which is the same standard we hold ourselves to in the public readiness index.