Buyer's checklist
Comparing DPDP privacy platforms? Ask every vendor these 26 questions.
The questions an Indian auditor, a bank's risk team or the Data Protection Board will ask. Next to each, FOCTTA's answer and the page that shows it.
FOCTTA's own answers, checked on 10 October 2026. Where the product pages say Pilot, so does this list.
23languages, English and all 22 scheduled
181industry packs across 60 industries
118Consent connector templates
4ways to host, in India or on your server
Built for India's law
Does the product follow the DPDP Act and Rules 2025, or was it adapted from a European tool?
- 01 Does it follow the DPDP Act and Rules section by section? Yes. Screens, clocks and citations follow the Act and the Rules, from notice (S.5) to the Board (S.27) and the rights portal (Rule 14). BuiltSee it on Regulations →
- 02 Can a notice go live without the complaint route to the Board? No. A DPDP notice cannot publish without the fiduciary name and the route to complain to the Data Protection Board. BuiltSee it on Consent →
- 03 Can you prove a "no" as well as a "yes"? Yes. A declined purpose gets its own record and its own receipt, and each purpose a person agrees to is recorded separately. BuiltSee it on Consent →
- 04 Are rights requests run on the statutory clock? Access, correction, erasure, nomination and grievances (Sections 11 to 14) each run on their clock, next to GDPR and CCPA request clocks. BuiltSee it on Consent →
- 05 What happens with children's data? A child-directed mode blocks tracking for children, even after Accept All. FOCTTA Discovery (DSPM) adds a report of where children's data sits and a guardian-consent register (Section 9). BuiltSee it on Consent →
- 06 Are breach clocks for the Board and the sector regulators tracked together? Yes. DPDP Rule 7 (without delay, then a full report in 72 hours) sits next to the 6-hour clocks for CERT-In, RBI, SEBI and IRDAI. BuiltSee it on Regulations →
- 07 Does it speak your customers' languages? Banners and preference centres in English and all 22 scheduled Indian languages: 23 in all, detected from the page. BuiltSee it on Consent →
Data security, not only paperwork
Can it find the data, see who reads it, and stop a query, or does it stop at forms?
- 08 Can it find personal data across the whole estate, including legacy systems? FOCTTA Discovery (DSPM) has 25+ native scanners for databases, warehouses, cloud storage, SaaS, file servers and laptops, and reads IBM i (AS/400) Db2 and COBOL copybook mainframe extracts. PilotSee it on Discovery (DSPM) →
- 09 Are Indian identifiers validated, or only pattern-matched? Validated with their checksums and context: Aadhaar, PAN, GSTIN, UPI, ABHA and more, inside PDF, Word and Excel files too. BuiltSee it on Discovery (DSPM) →
- 10 Do you have to hand over database passwords? No. Upload a schema and FOCTTA classifies from its structure, or run scanners that keep credentials on your own host. Only masked metadata leaves your network. BuiltSee it on Discovery (DSPM) →
- 11 Can you see who touched sensitive data, and whether that was normal? FOCTTA Activity (DAM) reads 7 sources, from PostgreSQL to AWS CloudTrail, with no agent on the database, and learns a baseline for each person and application. BuiltSee it on Activity (DAM) →
- 12 Can consent be enforced at the database, not just recorded? FOCTTA Detection (DDR) checks each query to sensitive data on PostgreSQL before it runs: no consent for the purpose, no raw data. It masks inside the query and fails closed. BuiltSee it on Detection (DDR) →
Evidence an auditor accepts
When the auditor or the Board asks "show me", what can you hand over?
- 13 Is the audit trail tamper-evident? Each change writes a hash-chained event and a receipt, and any consent can be proved in one click. BuiltSee it on Deployment →
- 14 Are there signed evidence packs for audits? Signed packs for DPDP, SEBI CSCRF, GDPR and CCPA audits, each a ZIP with a signed manifest. PilotSee it on Discovery (DSPM) →
- 15 Does every vendor score explain itself? FOCTTA TPRM shows the rule and clause behind each score, and the same inputs always give the same band. BuiltSee it on TPRM →
- 16 Can anyone check a training certificate is real? Yes. Certificates are signed by your DPO, carry Open Badges 3.0 data, and have a public verification page. BuiltSee it on Training →
- 17 Are risky actions under separation of duties? Destructive response steps need two different approvers, enforced on the server, and emergency access needs a written reason and a time limit. BuiltSee it on Detection (DDR) →
Where your data lives
Your regulator decides where the data may sit. The product should fit that, not the other way round.
- 18 Is the hosted service in India? Yes. It runs on AWS in Mumbai, with a dedicated database for each organisation by default. BuiltSee it on Deployment →
- 19 Can it run on your own server, with nothing sent to the vendor? Yes. One Linux or Windows server, or your own AWS, Azure or Google Cloud account. It sends nothing to FOCTTA unless you configure it to. BuiltSee it on Deployment →
- 20 Can it use your own PostgreSQL database? Yes. FOCTTA connects to and migrates your database, and never hosts your data. BuiltSee it on Deployment →
- 21 How do you know the software you install is genuine? Release packages are signed and verified, every image digest is checked before install, and each image ships with a CycloneDX SBOM. BuiltSee it on Deployment →
- 22 Does it fit your sign-in and roles? SAML 2.0, OIDC, SCIM 2.0 and TOTP with backup codes, with 8 roles, 144 permissions and custom roles. BuiltSee it on Deployment →
Fits the group you already run
Indian groups run many brands, many systems and many vendors. Does the product?
- 23 Can one tag serve every brand in the group? Yes. The brand is recognised from the page domain, and a withdrawal never crosses to another company unless the person asks. BuiltSee it on Home →
- 24 Does it connect to the systems you already run? 118 connector templates for CRM, email, marketing and ad platforms, 346 webhook events, and an API with a sandbox. BuiltSee it on Developers →
- 25 Does it start from your sector, or from a blank form? 181 ready-made industry packs across 60 industries, with the data elements, purposes and clauses each sector uses. BuiltSee it on Industries →
- 26 Do you have to buy everything at once? No. Consent, Discovery (DSPM), Activity (DAM), Detection (DDR) and TPRM are sold separately, and each works alone. BuiltSee it on Home →
The FOCTTA family, by market category
Each product is sold on its own. Together they cover the record, the data and the vendors.
| Product | Category | What it does |
|---|---|---|
| FOCTTA Consent | Privacy and consent governance (consent management platform) | Consent and cookie banners in 23 languages, rights requests with statutory clocks, breach timelines, DPIAs, ROPA and a hash-chained audit trail, built for the DPDP Act and Rules 2025. |
| FOCTTA Discovery (DSPM) | Data security posture management (DSPM) | Finds and classifies personal data across databases, cloud accounts, SaaS, file servers and laptops, with posture, risk and lineage mapped to the DPDP Act. |
| FOCTTA Activity (DAM) | Database activity monitoring (DAM) | Records who read or moved sensitive data, learns what is normal for each person, and warns before an export completes. |
| FOCTTA Detection (DDR) | Data detection and response (DDR) | Checks every query to sensitive data before it runs, inside the database connection, and allows, masks, challenges or blocks it, then runs the response playbook. |
| FOCTTA TPRM | Third-party risk management (TPRM) | Vendor risk from the first quick-add to an exit a regulator can follow, with every score showing the rule and clause behind it. |
| FOCTTA Training Academy | Privacy and data protection training | Six DPDP courses with graded quizzes and certificates signed by your DPO that anyone can verify on a public page. |
Questions people ask
Short answers. The glossary explains every term.
Is FOCTTA a Consent Manager?
No. A Consent Manager is a company registered with the Data Protection Board to manage people's consents on their behalf. FOCTTA is software that your organisation uses to collect, record and prove consent and to run the rest of its DPDP programme.
Which laws does FOCTTA cover?
India's DPDP Act 2023 and Rules 2025 first, then GDPR and CCPA with CPRA, with sector overlays for RBI, SEBI, IRDAI, CERT-In, PMLA and RPwD.
What does "Pilot" mean on this page?
The same as on the product pages: the capability is labelled Pilot there, and this checklist keeps that label rather than rounding it up.
How do I see it on my own data?
Book a 30-minute walkthrough on your sector's industry pack. A pilot can be hosted in India or on your own server, and every demo comes with a free DPDP gap assessment.
See the answers on your own data.A 30-minute walkthrough on your sector's pack, with a free DPDP gap assessment.