Everything you need for DPDP Act compliance
DPDP Guard is a compliance platform for India's Digital Personal Data Protection Act, 2023 and Rules, 2025. It brings consent management, an AI privacy-policy generator, data-principal rights, 72-hour breach reporting, grievance redressal, cookie scanning, and an exportable consent evidence register into one place — so Data Fiduciaries can capture lawful consent, honour individual rights, and prove it to the Data Protection Board.
Every feature below is a shipped capability, mapped to the specific Digital Personal Data Protection Act, 2023 obligation it supports. Last reviewed 7 September 2026.
Feature index
- Privacy Notice Builder
- Consent Management Platform
- AI Privacy Policy Generator
- Hosted Privacy Policy Embed
- Data Principal Rights
- Breach Management
- Telecom Business-Connection Tracking
- Grievance Redressal
- Cookie & Tracker Scanning
- Domains & Cross-Domain Consent
- Compliance Command Centre
- Compliance Analytics
- Retention & Governance
- Children's Data Protection
- Age-Assurance Console
- Developer Integration & Install
- Tender Watch
- DPIA Workflow
- RoPA Builder
- Vendor Risk Register
- Outbound Webhooks
- Public Compliance Badge
- Privacy Nutrition Label
- Token Broker Console
- Compliance Knowledge Assistant
- "In Force Today" Obligation Ledger
- DPDP Compliance Cost Estimator
- Consent Register
- Transparency Report
- Cross-Border Transfer Register
- DPBI Audit Evidence Bundles
- AI Agent & MCP Access Governance
- Offline-First Capture Console
- ML Erasure Readiness
- AI Dataset Provenance Register
- DPO Designation & Marketplace
- Team & Roles
- Consent Status Lookup
- Account Center
- Digital Nomination
- Healthcare ABDM Bridge
- Consent Manager (Rule 5) Readiness
- Legacy Data Compliance Wizard
- Suppression List
- Data Discovery & Classification
- DPDP Bidder Annexure
- Banner Dark-Pattern Audit
- WhatsApp Channel Audit
- Developer SDKs
Draft, version and publish a DPDP-compliant notice — approved before it goes live
A guided notice builder lets you itemise exactly what personal data you collect and why, draft it in multiple languages with a coverage table for the Eighth Schedule, and publish through a real four-eyes approval workflow — with every past version kept, not deleted, so consent evidence never loses the notice it was given against.
A DPO drafts a notice update after the company starts collecting a new data category, itemises the new purpose, and submits it for approval — a colleague reviews and approves it, since the drafter cannot approve their own work. Before publishing, a diff dialog shows exactly what changed against the live version and confirms which of the required languages are covered. Once published, the previous version is superseded, not deleted, so every consent already given still points to the exact notice text it was given against.
See notice management applied to healthcare→- Itemise exactly what personal data you collect and the purpose for each item
- Draft in multiple languages, with a coverage table showing which are current, behind or missing before you publish
- A four-eyes approval workflow — a requester cannot approve their own draft, and the server refuses to publish while a request is outstanding
- A diff-against-live review dialog before every publish
- Past versions are superseded, never deleted — every consent stays tied to the exact notice version it was given against
- Served directly inside the consent banner, resolved per domain and domain group
- A non-dismissible banner tells the reader when a translated notice hasn't been human-checked yet, naming English as the authoritative version
- Record how a live notice actually reached principals — a 'Record dissemination' action logs the channel to an append-only evidence trail, the same pattern the DSR, breach and grievance consoles use
- The pre-publish coverage table renders the full 23-locale Eighth Schedule grid in the notice wizard's review step, not just a flat list of the languages you've filled in
- Pin your own organisation's name as a do-not-translate glossary term, so a machine-translated notice never mangles your brand name into another language
- The anonymous, pre-login consent banner shows the same non-dismissible machine-translation disclosure as the signed-in dashboard, and renders right-to-left for Perso-Arabic locales (Kashmiri, Sindhi, Urdu)
Capture provable, granular consent before a single tracker fires
A drop-in consent banner presents your published notice and records each visitor's per-purpose choices with an immutable audit trail — the lawful basis the DPDP Act requires before processing personal data.
An Indian e-commerce store embeds the banner; a shopper accepts analytics but declines marketing. The choice, timestamp, and notice version are stored, so if the Data Protection Board audits, the company can produce per-user consent evidence.
See consent capture applied to e-commerce→- Drop-in banner script, deployed and themed per domain group
- Per-purpose consent (e.g. analytics vs. marketing) with an immutable audit trail
- Google Consent Mode v2 signalling — consent choices update ad_storage, analytics_storage, ad_user_data and ad_personalization automatically
- Auto-blocks tagged scripts until the matching consent category is granted
- Switch legislation modes — DPDP, GDPR or CCPA — from a live-preview designer
- Legislation-aware validation blocks and audit-logs banner settings that wouldn't count as valid consent under the selected regime (e.g. implied opt-out, pre-checked purposes)
- Configurable layout, position, branding and language
- The live draft score you see while editing checks whether your privacy policy discloses a retention period, enumerates third-party processors and states its processing purposes — the same three checks your published banner is scored against — with a one-click link into the Policy Generator step that fixes a gap it finds
Generate a DPDP-ready privacy policy in minutes, not weeks
A guided wizard collects how your organisation handles data, then an AI agent drafts a Digital Personal Data Protection Act–aligned privacy policy you can version, publish, and host at a public URL.
A seed-stage startup with no in-house counsel completes the wizard, generates a first-draft policy, edits it, and publishes it to a shareable page — instead of waiting weeks for an external law firm.
See policy generation applied to SaaS→- Seven-step wizard captures company, data-handling and third-party-sharing details
- An AI agent drafts the policy and streams its progress live
- Save drafts, keep versions, and publish when ready
- Serve the active policy at a public, always-current URL (/policy/your-org)
Publish your policy once and let it update itself everywhere it's embedded
Once a policy is published, host it as an embeddable iframe your own website can drop in once — the embed always re-renders whichever policy version is currently active, keeps an immutable, point-in-time version history on every publish, and can show exactly what changed between any two versions.
A fiduciary's marketing team doesn't want to hand-copy privacy-policy text onto the company website every time legal revises it. They paste the hosted embed's iframe snippet into the site footer once; when the DPO later publishes a revised policy, the embed on the live site updates itself with no code change. When an enterprise customer's own counsel later asks what changed since last quarter, the DPO opens the version-history panel and pulls up the exact diff between the two versions instead of manually redlining two exports.
- A one-time iframe snippet that always renders whichever policy version is currently active — no re-embedding needed when the policy changes
- Activate or deactivate the embed, and rotate its access token, independently of unpublishing the underlying policy
- An immutable, point-in-time version history: every publish and republish is snapshotted, and a past version can still be served pinned by its version number
- A per-version 'what changed' diff on the version-history panel, so a reviewer sees exactly what changed between two versions instead of re-reading the whole document
Give people a self-service portal for their data-principal rights
Individuals get their own dashboard to view and withdraw active consents, raise rights requests, and nominate a representative, while your DPO fulfils every request from an SLA-driven queue and records how it was discharged as evidence.
A customer withdraws marketing consent, files an erasure request for old orders, and nominates a family member to act on their behalf if they are incapacitated — all without emailing support. The DPO sees the request land in an overdue/awaiting-action queue, marks it fulfilled with the channel and acknowledgement recorded, or — for a request the Act allows the fiduciary to lawfully refuse — rejects it with a recorded statute and citation.
See data-principal rights applied to BFSI & fintech→- View and withdraw any active consent
- Raise access/summary, correction and erasure requests
- Nominate a representative to exercise rights on your behalf — and revoke that nomination at any time
- Track the live status of every request you have raised
- A DPO fulfilment console triages every request in an overdue/awaiting-action queue and records the fulfilment as evidence — the channel used and the acknowledgement — before closing it, with auto-generated summary responses for access requests
- Reject an erasure request with a recorded statutory basis and citation when the Act allows a lawful denial
Hit the DPDP 72-hour breach report — every time
Log a data breach and the platform immediately queues intimation to the affected principals and the Data Protection Board, then walks your team through a searchable incident queue and a guided three-step workflow that records each notification as evidence — not just a status tick — and flags anything overdue past the 72-hour deadline.
A SaaS company discovers a breach and records it. The platform immediately queues intimation to the affected users and the Board. The DPO works the incident from a searchable queue sorted by the statutory clock, records each notification step — who was told, through which channel, and with what acknowledgement — and the register flags the incident red the moment the 72-hour deadline passes unfiled.
See breach reporting applied to healthcare→- Searchable, sortable incident queue — ordered by the 72-hour clock by default — with a per-incident workspace at its own address
- On report, automatically queues intimation to affected principals and the Board
- A guided three-step workflow records each notification — to principals, to the Board, and the detailed report — as evidence: the channel used, an acknowledgement reference, and how many people were reached, not just a tick
- An automatic overdue alert once the 72-hour detailed-report deadline passes, measured from when you became aware of the breach — not from when you got around to logging it
- Also tracks the separate CERT-In 6-hour reporting clock under the IT Act, 2000 / CERT-In Directions, 2022
- A persisted, audited CERT-In overdue flag mirrors the DPDP overdue alert: once the 6-hour CERT-In clock lapses unfiled, a daily sweep records it, logs it to the audit trail, and surfaces it as a 'CERT-In overdue' KPI tile on the Breach Register
- Fintech-sector organisations also get the RBI DAKSH 6-hour incident-report clock — a countdown panel that appears automatically once the platform confirms your organisation is RBI-regulated, and a one-click 'mark filed' action that records the submission
- The same pattern covers the SEBI Cybersecurity and Cyber Resilience Framework's 6-hour email-reporting clock for fintech organisations, alongside CERT-In and RBI DAKSH — its own countdown panel and one-click 'mark filed' action
- Record a DPO's dual classification of every breach — is it a reportable cyber incident under your sector's regime, is it a personal data breach under DPDP Act Section 2(u) — each with its own reasoning, viewable alongside the incident
- Aligned to the DPDP Rules, 2025 (Rule 7 — intimation of personal data breach)
- Preview your own server-to-server integration in-dashboard — enablement status, a live count of what the authenticated breach-register API would return, and a copy-pasteable curl example with your key prefix
Track the two Rule 6(4) clocks when a pooled corporate SIM changes hands
Rule 6(4) of the Telecommunications (User Identification) Rules, 2026 gives an enterprise running pooled corporate SIMs two clocks the moment a connection's end user changes: intimate the operator within 3 working days, and get the new user's biometric identification done within 7 working days. Log the change once and a dedicated console tracks both working-day clocks to done, pending or overdue.
An enterprise IT admin reassigns a pooled corporate SIM from one employee to another. They log the change on the Telecom Business-Connection console the same day; the platform starts both statutory clocks from that timestamp, counting only working days, and the admin marks each one done — intimated to the operator, then the new user's biometric verification completed — before either lapses into overdue.
- Log an end-user reassignment on a business connection (corporate/pooled SIM) with the change timestamp
- Two independent working-day clocks per change — 3 working days to intimate the operator, 7 working days for the new end user's biometric identification — both skipping Saturdays and Sundays rather than counting a flat 3/7 calendar days
- Mark each clock done independently — intimation and verification are separate acknowledgements, not one combined status
- A per-organisation list of every logged reassignment with each clock's live status: pending, done or overdue
- Aligned to Rule 6(4) of the Telecommunications (User Identification) Rules, 2026
Give data principals a readily-available way to raise a grievance
Signed-in data principals file a privacy grievance against your organisation straight from their dashboard, and your DPO triages every grievance in an SLA-driven queue and records how it was resolved as evidence — the readily-available grievance mechanism Section 13 of the DPDP Act requires every Data Fiduciary to provide.
A customer who is unhappy with how their data was handled opens their dashboard, files a grievance with a subject and description, and follows its status. The DPO sees it land in an overdue/due-soon queue, acknowledges it, posts an interim update without closing it, and on resolving it records the channel and what the customer was told — giving the organisation a defensible, time-stamped record instead of a complaint lost in a support inbox.
See grievance redressal applied to telemarketing→- Self-service grievance filing for signed-in data principals
- Every grievance logged against your organisation with an SLA due date set on submission (configurable per organisation)
- Principals track the live status of each grievance they raise
- A DPO/Fiduciary console triages every grievance in an overdue/due-soon queue, acknowledges it, and records the resolution as evidence — the channel used and what was said — before closing it
- Log an interim update or an internal note to a grievance's thread at any point, without having to resolve it
- Backs the Section 13 DPDP Act right to readily-available grievance redressal
Find every cookie and tracker running on your sites
Scan any domain on demand with a dedicated scanning worker and follow the scan live, then see how the trackers that were discovered break down by category — so the consent categories you offer match what your site really does.
A marketing team runs a scan on their domain from the Domains console and watches it move through queued → worker started → completed in the activity timeline. The compliance dashboard then shows the tracker breakdown by category, surfacing analytics and marketing tags a vendor had added months earlier — which the team can then require consent for.
See tracker scanning applied to media & ad-tech→- Scan any domain on demand — dispatched to a dedicated Rust scanning worker
- Follow every scan live per domain: queued → worker started → completed
- Discovered trackers auto-categorised as Essential, Analytics, Marketing or Preferences
- A dedicated Tracker Inventory console lists every discovered tracker for your organisation with its category and whether consent is required, one click from configuring that category in the Consent Manager
- Category breakdown charted on your compliance analytics dashboard
Run one consent setup across every brand and domain
Group your primary and alias domains under a single configuration and share consent across them — so multi-site and multi-brand organisations manage every property from one place.
A media company links brand.com and brand.in as aliases in one domain group, so a consent decision captured on one site is honoured on the other.
See multi-brand consent applied to media→- Group primary and alias domains together
- Share consent across aliased domains
- Per-group banner settings for distinct brands
Open one dashboard and see exactly what to fix next
When a Data Fiduciary signs in, the overview turns your live compliance state into a single screen: an organisation compliance score with its breakdown, the operational counts that matter, and a prioritised action list that surfaces overdue breach reports, data-principal requests past their SLA, and unresolved grievances before they become violations.
A DPO logs in on Monday morning and, instead of opening five tools, reads one action list: two data-principal requests are past their response SLA and one breach still needs its detailed report. They clear the red items first, then work the amber ones — turning compliance from a quarterly scramble into a daily routine.
See the compliance command centre applied to BFSI→- A single organisation compliance score with a plain-language breakdown (DPO appointed, notices published, grievance resolution, SLA adherence)
- A prioritised action list built from real state — overdue breach detailed reports, DSRs past their SLA, SLA-breached grievances and missing active policies surface first
- Live operational counts for open and overdue data-principal requests, breaches, grievances and published policies
- Consent-acceptance trend and tracker-category charts, plus a recent-activity feed of the latest compliance events
Turn consent and tracker data into board-ready metrics
A dedicated analytics dashboard tracks consent-acceptance trends over time, shows how your discovered trackers break down by category, and surfaces the headline numbers leadership asks for — so you can report progress with charts instead of guesswork.
Before a board meeting, a DPO opens the analytics dashboard, reviews the month's consent-acceptance trend, and reports the consent-confidence rate and transparency index alongside the tracker breakdown behind them.
See compliance analytics applied to BFSI→- Consent-acceptance trends over time
- Tracker-category distribution across your sites
- Headline metrics — total trackers, 30-day audit volume, a consent-confidence rate and a transparency index
Define retention rules, schedule erasures, and prove it with audit logs
Define how long each data category is kept — a fixed period or an inactivity window — schedule an individual data principal's erasure with an automatic 48-hour pre-erasure notice, and review immutable processing logs and the consent audit trail alongside them — the evidence you need to demonstrate storage limitation and lawful processing.
A compliance officer sets a rule to delete inactive accounts after three years, schedules an erasure for a specific customer who withdrew consent, and then during an internal audit pulls the processing-activity log to show exactly what was done, when, and on what basis.
See retention & audit trails applied to BFSI→- Define a retention rule as a fixed period (days) or an inactivity window (years), covering multiple data categories at once
- Delete a retention rule you no longer need
- Schedule a data principal's erasure with an automatic 48-hour pre-erasure notice, cancellable any time before it runs
- Immutable processing logs and consent audit trail for reviews
- Preview your own server-to-server integration in-dashboard for due (elapsed, uncancelled) scheduled erasures — enablement status and a copy-pasteable curl example for the authenticated GET /api/v1/retention/due API
- A Workforce Retention Gaps card matches an HR processing activity's purpose against known Indian labour-law statutes (e.g. the Payment of Wages Act, Income-tax Act, POSH Act), flags any activity under a statutory retention duty with no linked retention policy, and lets a DPO apply the correct statutory floor to it in one click
Protect children's data with age confirmation and child-account flagging
Prompt signed-in data principals to confirm whether they are 18 or older, and automatically flag any account that self-identifies as a child — so you can apply the heightened protection the DPDP Act requires before processing a child's personal data.
A logged-in user is asked to confirm their age. They select 'under 18', and the app records the account as a child — flagging it so the fiduciary applies the DPDP Act's heightened safeguards for children's data instead of treating it like an adult account.
See children's-data protection applied to EdTech→- Age-confirmation prompt shown to data principals (18-or-older or under-18)
- Automatic child-account flagging when a user self-identifies as a minor
- Groundwork for the DPDP Act's children's-data safeguards (Section 9 verifiable parental consent)
Gate a purpose by a principal's asserted age, and log every allow/deny decision
A Fiduciary/DPO console records a data principal's self-declared age band, then runs an enforcement gate that checks a proposed purpose against it before your systems act — denying targeted advertising, behavioural tracking and behavioural monitoring outright for anyone not confirmed as an adult, and logging every decision with its reason.
An EdTech platform's DPO needs to confirm, before enabling a personalised-ads pilot, that no under-18 account is enrolled. They look up a flagged account in the Age-Assurance Console, record the principal's self-declared age band, then evaluate the 'targeted_advertising' purpose against it — the gate denies every non-adult band outright, citing the Section 9 prohibition, and the decision log gives the DPO a defensible record of exactly who was excluded and why.
See age-assurance gating applied to EdTech→- Look up a data principal's standing age-assurance state, or record a new self-declared age band through a 3-step wizard
- Evaluate any purpose against a principal's held assurance level before your systems act on it
- Denies targeted advertising, behavioural tracking and behavioural monitoring outright for any principal not confirmed as an adult — the DPDP Act Section 9 prohibition, not a softer warning
- Escalating assurance requirements by age band — a 16-18 band only needs a self-declaration, while younger bands require a stronger, document- or guardian-linked level before any non-prohibited processing can proceed
- Every allow/deny decision is appended to an immutable log, reviewable with KPI tiles and an allow/deny filter
- A self-declared age band expires automatically after 180 days and demotes to unassured, appending a 'level expired' entry to the same decision log — a stale birthday claim from years ago no longer stays trusted forever
- A jurisdictional age-threshold matrix shows how 'child' is defined in each jurisdiction — the Union DPDP Act's enacted 18 alongside proposed (not yet enacted) state thresholds, each clearly badged so a proposal is never mistaken for binding law
- A Rule 10 conformance report grades your held population per age band as conformant (a checked guardian relationship) or insufficient (a self-declared date of birth alone, or nothing at all), naming the largest shortfall so a DPO knows exactly where verifiable parental consent is missing
- A persisted daily snapshot of that Rule 10 shortfall count, shown as a short history list under the live report — so a DPO can show a regulator the population's conformance improving over time, not only today's live count
- For a principal verified through the guardian-link flow, see exactly how — the verification method, the relationship claim (parent, court-appointed or other guardian) and the date — with a direct link into the Parental Attestation Ledger, instead of only a generic 'verified' badge
- Log a periodic accuracy-benchmark audit sample per age band — defaulting to the published Meta child-safety settlement figures (no more than 3% misidentification for 13-15, 10% for 16-17) or your own target — and see whether your measured rate holds
Go live with copy-paste snippets — no SDK wiring required
A guided implementation guide gives your engineers the exact code to paste in: the consent banner script for the right domain group, an always-current cookie-declaration embed, and a Google Consent Mode v2 initialiser — each scoped to the domain group you pick, with a pre-launch readiness checklist.
A developer at a fast-moving startup opens the Implementation guide, selects the correct domain group, copies the consent banner snippet into the site's <head>, and pastes the cookie-declaration embed onto the privacy page. The banner goes live and its declaration table stays current automatically as new trackers are found — no follow-up code changes.
See developer integration applied to SaaS→- Copy-paste consent banner install script, generated per domain group
- Always-current cookie/privacy declaration embed — the table updates itself as new trackers are discovered
- Google Consent Mode v2 initialisation snippet, ready to paste before your gtag/GTM container
- A pre-launch widget-readiness checklist so you can confirm the banner is wired correctly before go-live
- A guided Setup Wizard walks you through picking a domain group, installing the script, and verifying it works — end to end, in one flow
Never miss a DPDP-relevant government or PSU tender deadline
A curated feed of open procurement tenders, RFPs and empanelments from PSU banks, insurers, central and state government departments and enterprises — filtered by issuer and deployment mode, ranked by how well DPDP Guard fits the opportunity, with a per-tender checklist to track how ready your response is.
A compliance vendor's sales team needs to catch every DPDP-relevant RFP before its submission deadline, but GeM and CPPP's own listings are search-hostile and easy to miss. They check Tender Watch each morning, sort by bid fit to surface the tenders that best match their deployment model and the most urgent deadlines first, and start a response checklist on the ones worth pursuing — attaching an existing evidence bundle as proof of an already-covered requirement instead of assembling it from scratch.
- A curated feed of open tenders, RFPs and empanelments, soonest deadline first
- Filter by issuer type (PSU bank, private bank, insurer, central or state government, PSU, enterprise) and by deployment mode (SaaS, on-premises, either, or unstated)
- Sort by bid-fit score — a ranking that weighs deployment-mode match, RFP kind and deadline urgency, boosted further for a tender your organization already has response-checklist coverage for
- Start a response-readiness checklist per tender, mark each requirement's coverage, and attach an existing evidence bundle as proof
- Record your organisation's bid profile once — turnover, years in operation, net worth, incorporation and the deployment modes you support — and every tender shows an eligibility verdict against its published hard gates: can prime, subcontract only, ineligible, or unknown, with the specific failed gates named
- Paste RFP text into a tender's response workspace and an LLM proposes discrete, bid-relevant requirement rows — deduped against your existing checklist and appended to it in one step, instead of re-typing a lengthy tender's requirements by hand
- An hourly sweep automatically closes tenders once their submission deadline has passed, so the feed never shows an expired opportunity as still open
- Cross-aggregator re-listings of the same tender — the same issuer and reference number re-posted under a different category or state index — collapse into a single feed row instead of appearing as duplicates
- A daily digest email alerts your organisation's super admins when an open tender is inside its 14-day closing-soon window, so a deadline can't be missed just because nobody happened to open the console that day
- A closing-soon banner on the console itself flags any curated tender inside that same window, sharing the identical cutoff with the digest email so the two can never disagree
Run a Data Protection Impact Assessment with real DPO sign-off
A structured DPIA moves through a fixed lifecycle — draft, in review, then DPO-approved — for every high-risk processing activity. Draft the necessity and proportionality justification yourself, or let an AI assistant draft it from a linked RoPA entry, then export the finished assessment as a PDF for your files or the Data Protection Board.
A Significant Data Fiduciary is about to launch a new facial-recognition attendance system. Before go-live, the DPO opens the DPIA Workflow, links the assessment to the relevant RoPA processing activity, uses the AI pre-fill to draft a first-pass necessity and proportionality justification from that activity's purpose and data categories, edits it into final form, and submits it for review. A second DPO reviews and approves it, locking in a dated, exportable record the organisation can produce if the Data Protection Board ever asks for it.
- A fixed draft → in review → approved lifecycle, with approval restricted to the DPO role so sign-off carries real meaning
- AI-assisted first-draft necessity and proportionality justification, generated from a linked RoPA processing activity
- Archive an assessment you no longer need without losing its history
- Export any assessment — draft, in review, approved or archived — as a PDF
Keep a Register of Processing Activities the DPO can actually defend
Document every processing activity — purpose, data categories, legal basis, cross-border transfer — and link each one to the retention rule, processor, DPIA and consent artefact that back it up. Every edit is versioned, so you can show the register's history, not just its current state.
A DPO preparing for an audit needs to show that every processing activity has a defensible lawful basis and that its retention period, processor relationship and any DPIA are all linked, not just asserted separately. They open the RoPA Builder, review each activity's linked evidence, fill in the gaps the Consent Traceability check surfaces, and export the register as a PDF to hand to the auditor.
- Register every processing activity with its purpose, data categories, legal basis and cross-border-transfer status
- Link each activity to a retention policy, a processor, a DPIA and a consent artefact — not just free-text notes
- Full version history per activity, so a changed legal basis or purpose is a dated fact, not a silent overwrite
- Export the register as a PDF for an auditor or the Data Protection Board
Track every data processor's risk level and DPA renewal date in one place
Under the DPDP Act you stay accountable for personal data you share with a processor. Assess each vendor, get a derived risk level and audit cadence, generate a DPA from a template, and get an alert before that DPA expires or an audit falls overdue.
A fast-growing fintech shares personal data with a dozen third-party processors — a payment gateway, an SMS provider, a cloud host — and its DPO needs to know which ones are overdue for an audit before a regulator asks. They open the Vendor Risk Register, see the 'audits overdue' and 'DPAs expiring soon' counts on the summary cards, generate a DPA template for a vendor that doesn't have one yet, and record the outcome of an audit that just finished.
- Assess a vendor and get a derived risk level (low/medium/high) and audit cadence, not a manually-guessed rating
- Record an audit outcome per vendor, with a running history
- Track each vendor's Data Processing Agreement status, with an alert before it expires or lapses overdue
- Generate a DPA from a built-in template for a vendor that doesn't have one on file
Get a signed webhook the moment consent or a rights request changes
Register your own endpoint and DPDP Guard delivers a signed HTTP callback the moment a data principal gives consent or a data-subject rights request reaches a terminal state — so your CRM or backend can react without polling. Every delivery carries an HMAC-SHA256 signature you verify against your own signing secret.
A CRM integration needs to suppress marketing outreach the instant a lead withdraws or a rights request completes, without polling DPDP Guard's API on a timer. The engineering team registers a webhook endpoint from the Integrations page, subscribes it to consent.given, consent.withdrawn and dsr.completed, and verifies each delivery's X-DPDP-Signature header using the copy-paste Node.js snippet before trusting the payload.
See outbound webhooks applied to SaaS integrations→- Register your own webhook endpoint from the Integrations page — no request to us required
- Receive a signed delivery the moment a data principal gives consent (consent.given), withdraws consent (consent.withdrawn), a rights request reaches a completed state (dsr.completed), or a breach is recorded (breach.recorded)
- Every delivery is HMAC-SHA256 signed over the raw body (X-DPDP-Signature header), with a copy-paste Node.js verification snippet
- An org-level self-serve toggle to turn delivery on or off for your organisation at any time
- A full per-endpoint delivery history — filter by status, export to CSV, and manually retry a failed delivery without waiting for the next event
Prove your compliance posture to customers with a public, shareable badge
Opt in from the Compliance Score page and DPDP Guard publishes a no-login trust badge at a public URL — a coarse compliance tier plus, where your consent banner passes the same symmetry checks your DPO sees privately, a 'Consent Symmetry Verified' signal. Never the exact score or a finding breakdown, so the badge is a trust signal, not a liability.
A B2B SaaS company is asked by an enterprise prospect's procurement team for proof of DPDP compliance during a vendor security review. Instead of drafting a one-off attestation, the DPO turns on the public compliance badge, shares the link, and the prospect sees a live, always-current tier and a symmetry-verified signal without either side sharing a login.
See the public compliance badge applied to SaaS→- A one-switch, org-level opt-in — off by default, since exposing a low score is the org's own call to make
- A public, no-auth page at a stable URL (/badge/your-org) showing a coarse compliance tier: strong, developing or early-stage
- A 'Consent Symmetry Verified' signal, computed live from the same checks the private consent-symmetry auditor runs — only pass/advisory severities ever earn it, so a banner with a fail-severity finding never gets a public verified claim
- That underlying check set now includes whether your privacy policy discloses a retention period, enumerates your third-party data processors, and states its processing purposes — not just banner-UX symmetry — so an org can no longer read as 'verified' while silent on any of the three disclosures
- Never exposes the exact score or a finding-by-finding breakdown — a visitor cannot reverse-engineer what almost failed
Give visitors a plain-language, at-a-glance summary of your data practices
A public, always-current summary of what personal data you collect, why, who you share it with, how long you keep it and how you handle breaches — the kind of quick-scan label a visitor can read in seconds instead of a full privacy policy. It is generated from the same policy and retention data you already maintain, so there is nothing extra to configure.
An e-commerce store wants to show privacy-conscious shoppers more than a wall of legal text at checkout. The DPO opens the Privacy Policies page, previews the auto-generated Nutrition Label inline to confirm it reads correctly, copies its public link, and adds it next to the checkout privacy-policy link — updating automatically whenever the underlying policy or retention rules change, with nothing to republish by hand.
See the Privacy Nutrition Label applied to e-commerce→- A public, no-auth label page at a stable URL (/nutrition-label/your-org) covering data types collected, purposes, third-party sharing, retention periods and a breach-notification commitment
- Updates automatically whenever the underlying privacy policy or retention rules change — nothing to republish by hand
- A live inline preview on the Privacy Policies page, so a DPO can see exactly what a visitor sees without leaving the app
- A one-click copyable public link, ready to drop next to a checkout or footer privacy-policy link
See exactly which external identities and sessions your backend has brokered
When your own backend exchanges a service API key and one of your external user ids for a short-lived Data Principal access token — the golden-path auth mode behind the server SDKs — the Token Broker Console gives you a read-only window into it: which external identities are linked, and which sessions are active or expired, without querying the database yourself.
An engineer wires up server-side token brokering for a new mobile release and wants to confirm it's working for a specific test account before rolling it out. They open the Token Broker Console, find the external identity by id, open its session-history drawer, and see the brokered session it just minted with its expiry — instead of adding logging or querying Convex directly.
- KPI tiles summarising linked external identities and recent brokered sessions
- A linked-identity list with a per-identity session-history drawer
- A recent-sessions table with clear Active / Expired badges
- An onboarding hint pointing to Integrations and the SDK & API docs for teams setting up brokering for the first time
- A guided empty state for organisations that haven't brokered a session yet
Ask a plain-language DPDP question, get cited excerpts back
Your team's own semantic search over the same DPDP Act and regulatory corpus the AI Policy Generator already draws from — ask a plain-language compliance question and get back the closest-matching excerpts with citations, not a generated answer that could be wrong with confidence.
A DPO isn't sure whether a new data category triggers a fresh notice obligation. Instead of re-reading the Act, they open the Knowledge Assistant, ask the question in plain language, and get back the specific Section and Rule excerpts that answer it, each with a similarity indicator — with the option to reopen a past question from their own recent-questions history.
- A plain-language question box with guided example questions for teams unsure where to start
- Answers are the closest-matching excerpts from the curated corpus, with citations — not an AI-generated summary
- A similarity indicator on every result, so you can judge how closely an excerpt actually matches your question
- A recent-questions history you can reopen
- Guided empty states for no-matches, disabled and rate-limited outcomes, so a refusal always explains itself
- Rate-limited per organisation to prevent runaway use, distinct from the super-admin-only corpus curation console
Know which DPDP obligations are actually in force — not proposed, not speculated
A public, no-login reference page that grades each DPDP-related obligation as in force, notified-but-not-commenced, proposed, speculated or refuted — with a rule reference, a plain-language explanation and a source link for each — so you don't have to trust an uncited search-engine infobox or a vendor blog's word for what's actually binding law today.
A compliance buyer researching DPDP requirements keeps finding conflicting claims online — one source names a Data Protection Board of India Chairperson who doesn't exist, another asserts an accelerated compliance deadline that was never gazetted. They check the same claim against the Obligation Ledger, which shows the correct status, a citation to the actual rule, and a source link, instead of an uncited claim.
See the Obligation Ledger applied to SaaS procurement research→- A public, unauthenticated page at /obligation-ledger — no login, no account needed
- Every entry graded in force, notified-but-not-commenced, proposed, speculated, or refuted, never presented as a single undifferentiated status
- A rule reference and a plain-language explanation for each obligation
- A source link back to the underlying regulatory material
- Curated by DPDP Guard's own team from public regulatory sources, kept current as the Act's rules are notified and commence
- Also available inside the dashboard for signed-in fiduciaries — the same ledger, with a link straight to your org's own Compliance Score instead of a sign-up prompt
- An info tip next to each status badge on the fiduciary view explains what that status means and what action to take, in plain English
Get a defensible compliance cost band in minutes — then sanity-check a vendor's quote against it
Answer a few questions about your scale, sector and cross-border footprint for an instant, defensible annual compliance-cost range — no sales call required. Paste a vendor's quoted price in and see it placed against that same band as below, within or above, with the percentage over or under, countering the market's routine ₹15-lakh-to-₹2-crore quote spread with a number you can actually defend.
A startup's finance lead gets a DPDP compliance vendor quote that feels high. Instead of taking it on faith or starting a lengthy comparison-shopping process, they run their own numbers through the Cost Estimator, paste the vendor's quoted annual price into the sanity check, and get an immediate below/within/above-band verdict with the percentage gap — a concrete, defensible number to bring back to the negotiation.
See the Cost Estimator applied to SaaS vendor evaluation→- An instant annual compliance-cost band from four self-reported inputs: data-principal scale, sectors, children's-data handling and cross-border transfers
- A guided five-step wizard with statutory tooltips explaining why each input matters
- Vendor-Quote Sanity Check: paste a vendor's quoted annual price and get a below / within / above-band verdict, with the percentage below or above the band
- No account or sales call required to see an estimate
- Optional opt-in lead capture only if you want a follow-up — never required to see your number
Present provable consent evidence to the Board — grouped by person, graded, exportable
A read-only register groups every consent your organisation has ever captured by the data principal it belongs to, grades each one's supporting evidence as full, partial or none from its own audit trail, and lets you export a whole evidence pack — with an on-page SHA-256 digest and a per-record permalink — instead of screenshotting a dialog one consent at a time.
Ahead of a Data Protection Board inquiry, a DPO needs to show every consent one specific data principal ever gave, whether each is backed by real evidence (the banner controls in effect and the notice language shown) or not, and to hand that proof over without screenshotting anything. They open the Consent Register, filter to that principal's records by status and capture source, and export a CSV evidence pack whose on-page SHA-256 digest they can quote to demonstrate the file was not altered after export.
See the Consent Register applied to a Board inquiry in BFSI→- Groups every consent by the principal it belongs to, instead of scattering their purposes across separate, unlinked rows
- Grades each consent's evidence as full, partial or none from its own audit trail — a consent with no supporting trail is flagged on the row, not hidden inside a modal
- Filter by status (active, withdrawn, unverifiable) and by capture source (banner, offline, API, source not recorded)
- A per-record permalink and a CSV evidence-pack export with an on-page SHA-256 digest, so the exported file's integrity can be verified after the fact
- Read-only by design — the register never edits a consent, because the burden of proof is on the fiduciary
- A withdrawals-by-purpose breakdown surfaces which purposes principals most often withdraw
- An Offline/QR Consent Link Manager panel lists every offline or QR consent link the organisation has created — from the dashboard generator or minted server-to-server via the API — so a DPO can filter and revoke a link long after the tab that generated it closed
Compile a point-in-time transparency report and export the consent audit trail as CSV
A two-step report totals the trackers discovered, the consents given, withdrawn and currently active, and the audit-trail volume for your organisation, breaks trackers down by category, then lets you export the consent audit trail as a CSV to hand to a regulator or keep for an internal file — instead of exporting screen by screen.
Ahead of an internal review or a Board audit, a DPO opens the Transparency Report, reviews the headline metrics — how many consents are active versus withdrawn, how each tracker category breaks down — then moves to the export step and downloads a CSV of the underlying consent audit trail to hand to the reviewer, rather than screenshotting individual screens.
- Live counts — total discovered trackers, consents given/withdrawn/active, and audit-trail volume — computed directly from the organisation's own data, not a cached snapshot
- A tracker-category breakdown (Essential, Analytics, Marketing, Preferences) rendered as a proportional bar chart
- A two-step flow — review metrics, then export — with a CSV download of the consent audit trail (masked IP prefix, timestamp, URL and record id)
- An explanatory tooltip on every metric, so the numbers are legible to a reviewer who isn't in the product daily
Check every transfer destination against a curated restricted-country list before you rely on a vendor
Declare the countries your personal data actually flows to — a cloud host, a support vendor, a backup region — and check them in one pass against a super-admin-curated permitted/restricted/unknown registry, plus a watchlist that alerts you the moment a country you rely on changes status.
A SaaS company backs its product with an overseas cloud region and a support vendor based abroad. Before renewing either contract, its DPO checks both countries against the Cross-Border Transfer Register in one pass, adds the higher-risk one to a watchlist, and gets an alert the day its status is updated — instead of relying on a vendor's own assurances or a stale legal memo.
See cross-border transfer tracking applied to SaaS→- Check a list of transfer-destination countries in one call against a permitted/restricted/unknown registry, each entry carrying a legal-basis note and an official notification link where one exists
- Add a specific country to a personal watchlist and get alerted when its status changes
- A super-admin-curated registry, kept current as MeitY's Rules 2025 negative list for restricted destinations emerges — not a static list baked into the product at launch
- Preview your own server-to-server integration in-dashboard — enablement status, a live sample of your flagged RoPA entries, and a copy-pasteable curl example for the authenticated cross-border transfers API
Generate a single timestamped evidence package for a Data Protection Board inquiry, on demand
One click aggregates consents, notices and DSR requests — plus breach, vendor-DPA, DPIA and processor-withdrawal evidence where those modules apply — into a single timestamped bundle scoped to any date window, instead of exporting each register separately when a regulator asks.
A Data Protection Board inquiry asks a fintech to account for a specific quarter. Instead of pulling consent, notice and DSR records from four different consoles by hand, the DPO generates one evidence bundle scoped to that quarter's date window and hands over a single package with everything the inquiry is likely to ask for already assembled.
See audit-ready evidence bundles applied to BFSI→- Aggregate consents, notices, DSR requests, and (once each module's own data exists) breach, vendor-DPA, DPIA and processor-withdrawal-notification evidence into one bundle
- Scope a bundle to a specific date window for a defined inquiry period, or leave it open-ended for the org's full history
- List every previously generated bundle, so past evidence packages stay retrievable rather than being a one-off export you have to keep track of yourself
- Every statutory denial in the bundle's window listed individually — the statute and citation relied on, and the retention/review record behind it — not just an aggregate count, with a DPO sign-off that hashes and locks the register once attested
Let an AI agent touch your compliance data, without giving up an auditable, revocable control layer
DPDP Guard exposes a Model Context Protocol (MCP) server so AI agents and copilots can act on your compliance data — but every OAuth client has to register and be granted delegated access first, every proposed action can be routed through an approval queue, and every tool call it actually makes is logged to a monitor you can review or revoke access from at any time.
A SaaS company wants its internal AI copilot to check DSR request status and draft grievance responses without a human relaying every query by hand. Its admin registers the copilot as an OAuth client, grants it delegated access scoped to that org, and routes its proposed actions through an approval queue. When the integration is later retired, the admin revokes the grant from the same console and confirms in the tool-call monitor that no further calls come through.
See AI agent access governance applied to SaaS→- Register an AI agent as an OAuth client and grant (or revoke) delegated access scoped to your organisation, with unauthorised client registrations garbage-collected automatically
- Route an agent's proposed actions through an approval queue — approve, reject or let a pending proposal expire, each recorded as an outcome
- A tool-call monitor lists every call an authorised agent actually made against your data, so a grant is reviewable after the fact, not just at grant time
Capture consent with the radio off, then verify every batch cryptographically once it syncs
An enrolled device — a branch counter, a kiosk, a field agent's tablet — captures a full consent event locally, signs it on-device, and queues it; when connectivity returns, a batch sync verifies each capture's device signature and countersignature before materialising it into the same consent record a live web visitor would produce. An operations console lets a DPO monitor sync health, browse every capture session, and quarantine or reject anything that fails verification.
A bank's branch network captures consent from walk-in customers on tablets with unreliable connectivity. Each capture is signed on the device the moment it happens; once the tablet reconnects at end of day, the batch sync verifies every signature before it's accepted. The DPO reviews the capture monitor the next morning, sees a session flagged for a clock-skew mismatch, and rejects it from the quarantine queue rather than letting an unverifiable capture stand as evidence.
See offline-first consent capture applied to bank branches→- On-device signature plus a server-side countersignature verified at sync time, with clock-skew tolerance checked explicitly rather than assumed
- A capture monitor showing sync health at a glance, and a cursor-paginated browser across every capture session by status
- A quarantine queue for any capture that fails verification, with an explicit reject action and a per-capture signature re-verification tool
Document, per AI system, whether you can actually honour an erasure request against it
Section 12 requires erasing personal data on consent withdrawal — but for a model trained or fine-tuned on that data, 'erasure' may mean full retraining. This module records, per AI system, the erasure approach available, whether a response plan exists, and derives a risk level server-side from those facts, so the gap is documented evidence rather than an assumption nobody checked.
An AI-powered SaaS company fine-tunes a model on customer data. When a customer withdraws consent, the DPO needs to know whether that data can actually be removed from the model or only from the source database. They open the ML Erasure Readiness register, find the AI system already assessed as 'full retraining required' with a documented response plan and lead time, and use that record as the evidence a DPBI inquiry would ask for — instead of discovering the gap during the inquiry itself.
See ML erasure readiness applied to AI-powered SaaS→- Record an erasure approach per AI system — full retraining, differential privacy, federated/no-storage, or model replacement — optionally linked to an AI Data Flow
- A risk level derived server-side from the erasure approach plus whether a response plan and lead time are on file, never trusted from the client
- A per-system register built for DPBI evidence, not a one-off spreadsheet
Put your public-data claim for AI training on record, not just in someone's head
When an AI training dataset relies on the DPDP Act's exemption for personal data 'made publicly available', this register documents that claim per AI data flow — its source, the basis relied on, and a written exemption rationale — and cross-references into the AI Training Lawful Basis Assessor so an at-risk flow shows as provenance-backed once a record exists.
An AI team argues a training dataset qualifies for the public-availability exemption because it was scraped from public profiles. Rather than that judgement living only in a Slack thread, the DPO records the claim in the AI Dataset Provenance Register against the specific AI data flow — the source, the basis relied on, and the written rationale — so the Lawful Basis Assessor marks that flow provenance-backed, and the reasoning is retrievable the next time someone asks why it was considered exempt.
- Document a public-availability claim per AI data flow — source, basis (voluntarily disclosed, public record, publicly accessible source, or other), and a written rationale
- Cross-referenced automatically into the AI Training Lawful Basis Assessor, which marks a flow provenance-backed once at least one record exists for it
- Independent of the Lawful Basis Assessor's own flag — the provenance register can be populated even where the broader assessor isn't yet in use
- Surfaced inline on the AI Consent Lineage console itself — record or review a flow's provenance claim next to its erasure-readiness assessment, without leaving the flow row for the standalone register
Record your statutory DPO appointment, or find an outsourced one if you don't have one yet
Formally record a Data Protection Officer's appointment against a legal entity for the statutory record, or — if you don't have a DPO yet — browse a marketplace of outsourced DPO service providers and log an inquiry directly from the console.
A Significant Data Fiduciary needs a documented DPO appointment on file ahead of an audit. Its compliance lead records the appointment against the correct legal entity in the DPO Designation console. A smaller organisation that hasn't appointed a DPO yet instead browses the DPO Marketplace, compares outsourced providers, and logs an inquiry with one directly from the same area of the product.
- Record (or update) a DPO appointment tied to a specific legal entity, as the documented statutory record
- Browse a directory of outsourced DPO service providers for organisations that don't have one appointed yet
- Log a provider inquiry directly from the marketplace, with a record of inquiries already sent
Add a teammate and set their role in minutes — no separate identity system to stand up
Invite an Administrator or Data Protection Officer straight from the workspace by email, reassign an existing member's role as responsibilities change, and see single sign-on status at a glance — all from one console, without leaving the app to provision an account elsewhere.
A DPO hired mid-quarter needs workspace access today, not after an IT ticket. The Administrator opens Team & Roles, invites them by email as a Data Protection Officer, and they land with the right permissions immediately — no unclaimed invitation link sitting in an inbox, and no separate account-provisioning step outside the product.
- Invite a new Administrator or DPO by email — the account is created and bound to the role immediately, not left pending on an accepted invitation link
- Reassign an existing team member between Administrator, DPO and Data Principal as responsibilities change
- Role descriptions shown inline, so it's clear an Administrator manages billing and integrations while a DPO is scoped to rights, grievances and risk
- Refuses to invite when the organisation's roles are managed by an identity provider — a clear message directs the admin to their SSO/SCIM provisioning instead of creating a second, conflicting account
- Team-member count is enforced against the organisation's plan quota, so growth beyond the plan's seat limit is a visible, explained refusal rather than a silent overage
- Enterprise SSO & SCIM status surfaced on the same console, with an upsell for orgs not yet on a plan that includes it
Answer "what may we do with this person's data?" from just an email address
A guided, three-step console that resolves a data principal's current per-purpose consent state — opted in, opted out, or withdrawn, essential vs non-essential — from nothing but their email address, using the exact same resolution logic as the public consent-status API.
A DPO fields a grievance or support ticket asking whether marketing emails are still permitted for a specific customer. Instead of minting a service API key and writing a curl command, they open Consent Status Lookup, enter the email, and see every purpose's current decision — opted-out purposes surfaced first — plus the equivalent API call if they want to automate the same check later.
- Identify a data principal by email, validated before the lookup runs
- Review every purpose's current decision — opt-in or opt-out, essential vs non-essential, with the date it was decided or withdrawn — opted-out purposes shown first
- Automate: copy the equivalent curl request for the same lookup via the public GET /api/v1/consent-status route
- Distinguishes "not yet a customer of record for this organisation" from a real customer with no purposes granted, so a DPO never confuses the two
- Listed in the API Reference panel alongside every other route a service key can call — previously the one route missing from that list
Manage your profile, security, organisation, billing and team from one place
A self-service Account Center — profile and language, a plain-language security-posture report backed by your identity provider, your organisation's identity and public URLs, plan and usage at a glance, and team management — under one consistent settings area, reachable even before your organisation finishes its legal-entity setup.
A newly onboarded DPO wants to set their display language, confirm two-factor authentication is actually protecting their account, and check how much of their plan's usage is left this month — without filing a support ticket for any of it. They open Account Center and find all three in adjoining tabs of the same settings shell.
- Profile: set your display name and preferred language; email stays read-only and hands off to your identity provider's own re-verification flow
- Security: a plain-language posture report — password, two-factor, backup codes, verified email, active session count — each flagged as covered or outstanding, plus a one-click sign-out of every session
- Organisation: view and rename your organisation's tenant record (audited), alongside the exact public URLs — policy page, embed, compliance badge — that are keyed to your slug and therefore never editable here
- Billing: view your current plan, usage against its limits, and renewal details at a glance
- Team: the same invite-by-email and role-reassignment console as Team & Roles, reachable from the same settings area
- Reachable at /dashboard/account even before an organisation finishes its legal-entity setup, since profile and security are not conditional on it
Let a data principal name who exercises their rights after they're gone — a right most privacy platforms never built
Section 14 of the DPDP Act gives every data principal the right to nominate another individual to exercise their rights on their behalf if they die or lose capacity to act — a provision most consent platforms, built for GDPR's principal-only model, simply have no screen for. A self-service, guided wizard lets a principal name, change or revoke that nominee at any time, with plain-language reassurance that nomination grants no access today.
A bank customer sets up a DPDP Guard-backed account and, in the same settings area where they manage consent, nominates their spouse to act on their behalf if they're ever incapacitated — the kind of nominee provision Indian bank depositors already expect from their bank account, now extended to their data rights. They can change the nominee's contact details or revoke the nomination entirely, any time, without contacting support.
See digital nomination applied to BFSI→- Guided, multi-step wizard: understand what nomination means, name a nominee, confirm and save
- Detects whether the nominee's contact is an email or phone number and validates accordingly
- Plain-language reassurance at every step — a nominee cannot see or use the principal's data today; they can only step in on death or incapacity
- Change the nominee or revoke the nomination entirely, at any time, from the same page
- Current nomination status (active/revoked) always visible, not buried in a settings sub-menu
Stop assuming an ABHA consent artefact already satisfies DPDP — see the reconciliation gap instead
Most hospital IT teams wrongly assume the ABDM (Ayushman Bharat Digital Mission) ABHA consent-artefact token already covers DPDP consent — it doesn't; DPDP requires its own consent record with its own purpose, duration and withdrawal right. A dedicated console lets a DPO record which DPDP consents have a matching ABDM artefact and see linkage coverage across the organisation, so the gap between the two consent regimes is visible instead of silently assumed away.
A hospital's DPO is preparing for a DPDP audit and needs to know how many of the hospital's active patient consents are properly backed by both a DPDP consent record and an ABHA consent artefact. The Healthcare ABDM Bridge console shows linked vs. unlinked counts and a preview of unlinked consents, so the DPO can close the gap before an auditor finds it.
See the ABDM bridge applied to healthcare→- Record which DPDP consent records have a corresponding ABDM/ABHA consent artefact
- See linkage coverage for the organisation — total active consents vs. linked count
- Preview unlinked consents so a DPO can prioritise closing the reconciliation gap
- Purpose-built for healthcare fiduciaries who conflate ABDM's consent-manager framework with DPDP's own consent requirement
Get ready for India's Consent Manager regime before the November 2026 registration window opens
Rule 5 of the DPDP Rules opens a registration window on 14 November 2026 for licensed "Consent Manager" intermediaries — and separately, every data fiduciary will eventually need to be technically ready to plug into one. Two guided self-assessments — one scored against Rule 5's own registration criteria, one against the fiduciary-side technical interoperability criteria — plus a registration wizard with a filing-queue joiner and a live inbound-signal console turn an unpublished, evolving spec into a concrete checklist instead of a wait-and-see guess.
A company deciding whether to become a licensed Consent Manager runs the Rule 5 registration self-assessment — Indian incorporation, minimum net worth, data-blind operation, independence, interoperability, accessible UX — and gets a scored readiness result instead of re-reading the Rules from scratch. A separate data fiduciary, not seeking a CM licence itself, runs the integration-readiness assessment instead to check whether its own consent API, machine-readable purpose codes and withdrawal-signal handling are ready to talk to a registered CM once one exists — and can join the filing queue to be notified the moment the November 2026 window opens.
- Rule 5 registration readiness self-assessment, scored across six statutory criteria (Indian incorporation, net worth of at least INR 2 crore, data-blind operation, independence from data fiduciaries, interoperable platform, accessible UX)
- A separate integration-readiness self-assessment for fiduciaries who need to be technically ready to connect to a registered third-party Consent Manager, scored against MeitY's Consent Manager Business Requirements Document
- Each integration-readiness gap is named in plain language (e.g. "no consent API endpoint exposing your consent records to a registered Consent Manager") rather than left as an unexplained score
- A registration wizard with a Rule 4 filing-queue joiner, so an org can be notified the moment the registration window opens rather than polling for it
- A live inbound-signal console that receives and monitors signals from the government CM API bridge, with stats, filters and a setup wizard
- Every assessment pins the version of the (still-unpublished) technical spec it was scored against, so a result can be flagged for re-checking once MeitY publishes the real interoperability spec
Get pre-Rules data to a demonstrable consent standard before the Phase 2 deadline
From mid-November 2026 (DPDP Rules Schedule Phase 2), a Data Fiduciary must be able to demonstrate valid consent for personal data collected before the Rules took effect — not just for data collected afterwards. A 3-step guided wizard inventories exactly which principals lack that evidence, runs a re-consent campaign against them with a live email preview, and automatically schedules erasure for anyone who doesn't respond by the deadline you set — so the gap closes on a record, not on a guess.
A DPO auditing pre-Rules customer data ahead of the Phase 2 deadline opens the Legacy Data Compliance Wizard's Inventory step and sees exactly how many existing principals have no DPDP-standard consent on file. They configure a re-consent Campaign — notice, language, a fallback window — and launch it; the dashboard shows how many principals re-consented and how many didn't. When the fallback window lapses, non-responders are automatically scheduled for erasure, so the organisation is never left holding personal data it can neither justify nor account for.
- Step 1 Inventory: surfaces every principal with no DPDP-standard consent on record, so the gap is counted, not assumed
- Step 2 Campaign: configure the re-consent notice, language and fallback window, preview the actual email before sending, and launch it against the inventoried principals
- Step 3 Fallback: a live progress bar tracks who re-consented; a fallback sweep automatically schedules erasure for anyone who hasn't responded by the deadline you set
- Re-consent is credited per principal the moment they consent — not just counted — so the fallback sweep knows exactly who still needs a decision
- Directly evidences the Phase 2 (13/14 November 2026) obligation to demonstrate valid consent for data collected before the DPDP Rules, 2025 took effect
See exactly who a connected marketing plugin is suppressing — and add one yourself when an opt-out arrives outside any consent flow
Every consent withdrawal already populates a marketing suppression table your connected CMS/e-commerce plugin polls before it sends — but until now nobody at your organisation could see it. A DPO-facing console shows every suppressed contact with KPI tiles for total, active and lifted entries, lets you add a manual suppression when an opt-out arrives by phone or email instead of through the product, and lift a suppression once it's resolved.
A customer emails a support inbox directly asking to stop receiving marketing messages, instead of using the unsubscribe link or the consent banner. The DPO opens the Suppression List console, adds the contact by hand with reason "manual", and the connected e-commerce plugin picks up the suppression on its next poll of GET /api/v1/suppression-list — no engineering ticket required to honour a request the platform didn't otherwise capture.
See marketing suppression applied to e-commerce plugins→- KPI tiles for total, active, lifted and manually-added suppression entries at a glance
- Manual-add form with inline validation for an opt-out received outside any consent or DSR flow, tagged with its own "manual" reason
- Filter the list by status — All, Active, Lifted — with a tooltip explaining what each of the three suppression reasons means
- Lift a suppression once it's resolved, straight from its row
- Backs the same GET /api/v1/suppression-list route a connected CMS/e-commerce plugin already polls, so the console and the plugin can never disagree about who is suppressed
- Expand any withdrawal row for a "Downstream propagation" disclosure — an N-of-M-confirmed summary plus per-destination pending/acknowledged/overdue status, with a manual "Mark acknowledged" action for a DPO who has other proof a destination stopped processing
- A Server Integration Preview shows the exact GET /api/v1/suppression-list response your connected plugin sees, with a copy-to-clipboard curl snippet — no need to mint a key and reach for curl just to check
- Each pending or overdue propagation row also carries a "Confirm via API instead" panel with a ready-to-send curl example (the real propagation id already in the URL) so the downstream destination's own engineers can self-serve the acknowledgement, instead of only a DPO clicking it from inside the console
Find every Aadhaar, PAN and bank-account column hiding across your databases
Register a source — a database, file export or spreadsheet — and paste in its column manifest (table path, column name, and an optional declared type; never sample values). A pure, India-specific rule set classifies each column, links it to an existing RoPA activity and retention policy, and a coverage report surfaces personal-data columns nobody has mapped yet.
A bank's compliance team registers its core-banking database as a discovery source and pastes in a column manifest exported by its DBA team. The classifier flags columns matching Aadhaar, PAN and IFSC patterns as identifier and financial data, and the coverage report surfaces three columns holding personal data with no linked RoPA activity — which the DPO reviews, links to the right processing activity and retention policy, and closes out before an auditor asks.
See data discovery applied to a bank's core systems→- Register a discovery source and ingest its column manifest through a 3-step wizard — paste, preview, review/ingest — with a column-limit check matching the backend's own batch size
- A pure rule-based classifier tuned for India-specific identifiers (Aadhaar, PAN, IFSC, UPI VPA, Voter ID, ABHA and more), alongside general categories like contact, location, employment, health, biometric and children's data
- A coverage report shows classified, personal-data and unmapped column counts for a source, plus gap findings for personal-data columns with no linked RoPA activity or retention policy
- A paginated, reviewable list of every classified column, with a review dialog that lets a DPO override a column's category and link it to a RoPA activity and a retention policy
Answer a government tender's DPDP-readiness questionnaire from records you already have
Government and PSU procurement increasingly treats DPDP readiness as a bid-stage qualification, in tenders that otherwise have nothing to do with privacy — expecting a bidder to produce a DPO appointment, a RoPA, DPIAs, breach-response capability, retention policies and a signed processor register on the spot. The Bidder Annexure maps your platform's own compliance records onto that standard seven-item checklist, so a bid team can answer it from data already on file instead of assembling it by hand for every tender.
A bid team responding to a PSU bank tender that requires DPDP-readiness evidence opens the Bidder Annexure console and finds six of seven checklist items already scored 'Yes' from the organisation's existing DPO appointment, RoPA activities and signed processor DPAs. They add the tender reference, acknowledge the one item marked 'Partial', and export a ready-to-paste document for the bid response instead of chasing the evidence across five different teams.
See DPDP bid-readiness applied to public-sector procurement→- A fixed seven-question checklist — DPO appointment, RoPA coverage, DPIA approvals, breach-drill readiness, retention policies, signed processor DPAs and evidence bundles — computed automatically from records already on the platform
- Each item is scored Yes / Partial / No with an evidence note explaining exactly why
- A guided two-step export wizard — add an optional tender reference, then export — produces a ready-to-paste document for the bid response, generated through the same markdown-to-PDF export action as the RoPA export
- Exporting a checklist with any Partial or No item requires an explicit acknowledgment first, so a bid team can't export a less-than-fully-compliant annexure without registering they've seen the gap
Catch the banner-design choices that could invalidate every consent you've collected
Pre-ticked boxes and implied consent are already rejected at write time under DPDP legislation mode, but a banner can still be manipulative in ways that check doesn't cover — an accept-only choice with no reject option, a decline control with no visible label, or a dismiss-by-scroll gesture that quietly counts as consent. The Banner Dark-Pattern Audit scores your live banner configuration against those signatures, plus a consent-fatigue signal that flags a suspiciously high accept rate as a red flag instead of a marketing win, and walks a DPO through fixing each finding with a step-through wizard.
A DPO preparing for a board review runs the audit and finds the banner's decline button has no visible label — technically present, but easy for a visitor to miss. The finding links straight to the exact Consent Manager setting that fixes it, with a plain-language explanation of why an unlabeled decline control undermines the 'as easy to reject as accept' standard, so the fix is made and re-verified in the same session rather than logged as a follow-up nobody owns.
See consent-banner design risk applied to e-commerce→- Flags an accept-only banner with no reject/decline choice presented
- Flags a decline action with no visible label, which makes the withdrawal option easy to miss
- Flags a banner that can be dismissed by scrolling or refreshing without an explicit choice — a pattern that risks functioning as implied consent
- A consent-fatigue signal flags a suspiciously high accept rate (90%+ moderate, 97%+ high) as a sign visitors may be clicking through without a genuine choice, rather than treating it as a success metric
- A risk gauge (low/moderate/high) with a per-finding severity weighting, not just a pass/fail flag
- Each finding maps to the exact Consent Manager setting that fixes it, with a step-through remediation wizard
Self-assess whether your WhatsApp Business API consent flow actually meets DPDP's six criteria
Millions of Indian businesses run consent-collection and customer-engagement flows over the WhatsApp Business API — but a saved contact, a bulk-uploaded list, or an inbound message does not, by itself, count as DPDP consent. The WhatsApp Channel Audit walks a Fiduciary or DPO through a guided six-criterion self-assessment — consent collection, notice at collection, a DSR channel, a consent receipt, purpose limitation, and a linked retention policy — with a statutory citation and a plain-language remediation step for every gap.
A DPO at a company that runs customer support and order updates over WhatsApp works through the six-step wizard and finds two gaps: no itemised privacy notice is shown before the first message, and there's no linked retention policy for the chat data. Each gap comes with a specific fix — link the published notice in the first message, or connect an existing retention policy — and the live score updates as each is addressed, giving the DPO a defensible, dated record of where the channel stood and what was fixed.
See WhatsApp consent compliance applied to telemarketing→- Six-criterion guided self-assessment: consent collection, notice at collection, DSR channel availability, consent receipt generation, purpose limitation, and retention-policy linkage
- A statutory tooltip on every criterion (e.g. DPDP Act §6(1) on clear affirmative action, §5 on notice content) explaining why it matters, not just what to check
- A live 0–100 score computed server-side from the same criteria used to generate the gap list — never trusted from the client
- A plain-language, criterion-specific remediation step for every gap left unmet
- One assessment kept per organisation, so re-running it after a fix shows the same channel's score improve over time
Can I build DPDP consent into my own app?
Yes. Most websites need no SDK at all — the hosted consent banner installs from a copy-paste snippet. For native apps, a bespoke consent UI, or backend code that must check consent before it processes personal data, DPDP Guard publishes eight SDKs to public package registries — npm, PyPI, pub.dev, Maven Central and Swift Package Manager — all generated from and tested against one shared API contract package. The full /api/v1HTTP surface they call — org lookup, notices, banner config, anonymous consent, an email-based consent-status lookup for CMS/e-commerce plugins, and the authenticated token-brokering, consent-gate and rights-workflow methods — is live for every organisation today, and you can generate your own service API key self-serve from the Integrations page to start calling it right away.
- Web / JavaScript@dpdpguard/jsv2.1.0 · npm · MIT
- React Native@dpdpguard/react-nativev2.0.0 · npm · MIT
- Flutterdpdpguard_flutterv1.1.0 · pub.dev · MIT
- Android (Kotlin)ai.dpdpguard:consent-sdkv1.2.0 · Maven Central · MIT
- iOS (Swift)DPDPGuardConsentv1.3.0 · Swift Package Manager
- Node / TypeScript (server)@dpdpguard/serverv2.1.0 · npm · MIT
- Python (server)dpdpguard-sdkv1.1.0 · PyPI · MIT
- JVM — Kotlin / Java (server)ai.dpdpguard:server-sdkv1.1.0 · Maven Central · MIT
Frequently asked questions
What is the DPDP Act, 2023?
The Digital Personal Data Protection Act, 2023 is India's comprehensive personal-data protection law. It establishes the Data Protection Board of India — the body that adjudicates non-compliance — and the Digital Personal Data Protection Rules, 2025 operationalise the Act's obligations for data fiduciaries.
When do DPDP Act obligations come into force?
The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 (Gazette G.S.R. 846(E)) and take effect in three stages, each measured from the Rules' publication in the Gazette of India. The provisions establishing the Data Protection Board of India applied immediately on publication. Consent Manager registration obligations follow twelve months later, in mid-November 2026. The core operational duties for Data Fiduciaries — the notice to be given to Data Principals, personal data breach reporting, and the related compliance obligations — come into force eighteen months after publication, in mid-May 2027. Note that published commentary cites these milestones as either the 13th or the 14th of those months, because the notification is dated 13 November 2025 while Gazette publication followed on 14 November 2025 and the commencement clock runs from publication; treat mid-November 2026 and mid-May 2027 as the operative deadlines and do not plan to the final day either way. DPDP Guard lets you put consent capture, data-principal rights, breach reporting and retention in place well ahead of them.
Who is a Data Fiduciary and who is a Data Principal under the DPDP Act?
Under the DPDP Act, 2023 a Data Fiduciary is the entity that alone or with others determines the purpose and means of processing personal data (comparable to a controller under the GDPR), and a Data Principal is the individual to whom the personal data relates. DPDP Guard gives Data Fiduciaries the tooling to meet their obligations and gives Data Principals a self-service portal to exercise their rights.
Does DPDP Guard help with the DPDP Act's 72-hour breach notification?
Yes. When you report a breach, DPDP Guard immediately queues intimation to the affected data principals and to the Data Protection Board, then walks your DPO through a guided three-step workflow — notify principals, notify the Board, file the detailed report — that records each step as evidence (the channel used and an acknowledgement reference) and flags the incident overdue the moment the 72-hour deadline passes unfiled. This mirrors the two-stage duty in Rule 7 of the DPDP Rules, 2025 (notified 13 November 2025): an initial intimation to the Board without delay, followed by a detailed report within 72 hours.
Can I collect granular cookie consent with DPDP Guard?
Yes. The consent banner captures per-purpose consent — for example analytics versus marketing — with an audit trail, and supports DPDP, GDPR and CCPA legislation modes from a single live-preview designer.
Does DPDP Guard support Google Consent Mode v2?
Yes. The DPDP Guard banner script ships with Google Consent Mode v2 built in: it initialises all consent signals as denied by default, then updates ad_storage, analytics_storage, ad_user_data and ad_personalization the moment a visitor makes a choice, mapping your Marketing, Analytics and Preferences categories to the corresponding Google signals. Tagged scripts are also auto-blocked until the matching consent category is granted.
How do I install the DPDP Guard consent banner on my website?
DPDP Guard's Implementation guide generates copy-paste install code for you: a consent banner script scoped to the domain group you select, an always-current cookie/privacy declaration embed, and a Google Consent Mode v2 initialiser. You paste the banner script near the top of your page's <head> so it loads before other trackers, drop the declaration embed onto your privacy or cookie policy page, and a pre-launch readiness checklist confirms the banner is wired correctly. No SDK wiring or custom development is required.
Does DPDP Guard have SDKs for mobile apps and backends?
Yes. Eight DPDP Guard SDKs are published to public package registries: @dpdpguard/js, @dpdpguard/react-native and @dpdpguard/server on npm, dpdpguard-sdk (Python) on PyPI, dpdpguard_flutter on pub.dev, ai.dpdpguard:consent-sdk (Android) and ai.dpdpguard:server-sdk (JVM) on Maven Central, and DPDPGuardConsent for iOS via Swift Package Manager. They share one versioned API contract package, @dpdpguard/contract (published at 1.6.0), whose golden audit-hash vectors every SDK is tested against — which is what lets a consent record written from a phone reconcile with one written from your server. Seven of the eight SDKs are MIT licensed. The full /api/v1 HTTP surface the SDKs call is live for every organisation today, and you generate your own service API key self-serve from the Integrations page — no request to us required. Most websites need no SDK at all — the hosted consent banner installs from a copy-paste snippet. Full per-platform versions, install commands and API surfaces are on the SDKs page (/sdks) and in the SDK documentation (/docs/developer/sdks).
Does DPDP Guard support GDPR and CCPA as well as the DPDP Act?
Yes. While DPDP Guard is purpose-built for India's Digital Personal Data Protection Act, 2023, its consent banner can present under DPDP, GDPR or CCPA legislation modes, switchable from a single live-preview designer. This lets organisations that serve users in the EU or California present the appropriate consent experience alongside their DPDP Act compliance from one platform.
How is the DPDP Act different from the GDPR?
Both laws protect personal data and apply beyond their home territory, and their core roles line up: a Data Fiduciary under the Digital Personal Data Protection Act, 2023 is broadly the equivalent of a controller under the GDPR, and a Data Principal is the equivalent of a data subject. The main differences are that the DPDP Act is consent-first — it permits processing on the Data Principal's consent or on a defined set of 'legitimate uses' under Section 7, rather than the GDPR's six lawful bases; it does not yet define separate categories of 'sensitive' or 'special category' personal data; and it is enforced by the Data Protection Board of India, with financial penalties set by the Act's Schedule (up to ₹250 crore for failing to take reasonable security safeguards), rather than the GDPR's fines of up to €20 million or 4% of worldwide annual turnover. DPDP Guard is built for the DPDP Act, but because its consent banner can also present under GDPR or CCPA modes, one platform can serve users across all three regimes.
Which sections of the DPDP Act, 2023 does DPDP Guard help you meet?
DPDP Guard's shipped features map to specific duties in the Digital Personal Data Protection Act, 2023: the Privacy Notice Builder, an itemised, versioned, approval-gated notice served through the consent banner, supports the notice duty under Section 5; consent capture and the AI privacy-policy generator support the consent basis under Section 6; one-click consent withdrawal supports Section 6(4); the data-principal portal, backed by a DPO fulfilment console, supports the rights of access, correction and erasure under Sections 11–12; nomination of a representative supports Section 14; the breach workflow supports the Section 8(6) duty to notify the Data Protection Board and affected principals; retention-rule definition and scheduled erasure support the storage-limitation duty in Section 8(7); age confirmation and child-account flagging provide groundwork for Section 9 on children's data; and self-service grievance filing, backed by a DPO triage console, supports the Section 13 right to readily-available grievance redressal. Each is a working feature, not a roadmap item.
Do I need a separate cookie-consent tool alongside DPDP Guard?
No. DPDP Guard includes a drop-in cookie-consent banner with per-purpose consent, Google Consent Mode v2, auto-blocking of tagged scripts, and on-demand cookie and tracker scanning — the cookie-consent job a dedicated tool would do. Because it is built for India's Digital Personal Data Protection Act, 2023, it also covers obligations that pure cookie-consent tools do not: data-principal rights requests, 72-hour breach reporting, grievance redressal, retention and erasure, and an immutable processing audit trail. One platform covers both cookie consent and the wider DPDP Act duties.
Does DPDP Guard support data-principal rights requests?
Yes. From a self-service portal, individuals can view and withdraw consent, raise access, correction and erasure requests, and nominate a representative — and each request is logged against your organisation with a status the principal can track. On the Data Fiduciary side, a DPO fulfilment console triages every request in an overdue/awaiting-action queue and records how it was fulfilled — the channel used and the acknowledgement — as evidence before closing it, with an auto-generated response for summary requests and a recorded statutory basis when an erasure request is lawfully denied.
Can Data Principals withdraw consent as easily as they gave it?
Yes. A signed-in Data Principal can withdraw any active consent directly from their DPDP Guard dashboard, in the same place they can review it — one action, no email or support ticket required. This is designed for Section 6(4) of the Digital Personal Data Protection Act, 2023, which gives every Data Principal the right to withdraw consent at any time, with the ease of doing so comparable to the ease with which the consent was given.
Can a Data Principal nominate someone to exercise their rights?
Yes. From their dashboard, a Data Principal can nominate a representative to exercise their rights on their behalf — for example in the event of death or incapacity. This backs the right of nomination in Section 14 of the Digital Personal Data Protection Act, 2023.
Does DPDP Guard help meet the Section 8(7) duty to erase personal data?
Yes. DPDP Guard lets you define a retention rule per data category — a fixed period or an inactivity window, across multiple categories at once — and schedule an individual data principal's erasure, which sends an automatic 48-hour pre-erasure notification before the deletion runs and can be cancelled any time before then. This supports the storage-limitation duty in Section 8(7) of the Digital Personal Data Protection Act, 2023, under which a Data Fiduciary must erase personal data once consent is withdrawn or the specified purpose is no longer being served, unless retention is required by law.
Does DPDP Guard provide a grievance redressal mechanism?
Yes. Signed-in data principals can file a privacy grievance against your organisation from their dashboard and track its status, and each grievance is logged with an SLA due date the moment it is submitted. On the Data Fiduciary side, a DPO console triages every grievance in an overdue/due-soon queue, can log an interim update without closing it, and records the resolution as evidence — the channel used and what was said — before marking it resolved. This backs Section 13 of the Digital Personal Data Protection Act, 2023, which gives every Data Principal the right to a readily-available means of grievance redressal from the Data Fiduciary — a step the Act requires them to exhaust before approaching the Data Protection Board.
What is the penalty for not reporting a data breach under the DPDP Act?
Section 8(6) of the Digital Personal Data Protection Act, 2023 obliges a Data Fiduciary to notify the Data Protection Board and each affected Data Principal of a personal data breach. Failing to do so is penalised under Section 33 read with the Schedule to the Act, which sets a financial penalty of up to ₹200 crore for breach of the duty to give notice of a personal data breach. DPDP Guard's Breach Management module queues both notifications automatically when you log a breach, helping you meet this obligation.
Does DPDP Guard scan for cookies and trackers?
Yes. A dedicated scanning worker crawls the domains you add and returns a categorised inventory — Essential, Analytics, Marketing or Preferences — of the cookies and trackers actually loading, so the consent categories your banner presents match what your site really does. A dedicated Tracker Inventory console lists every discovered tracker across your organisation with its category and whether consent is required, one click from configuring that category in the Consent Manager.
Does DPDP Guard help with children's data and age verification under the DPDP Act?
Yes. DPDP Guard prompts signed-in data principals to confirm whether they are 18 or older and automatically flags any account that self-identifies as under 18, so a Data Fiduciary can apply heightened safeguards for children's personal data. This provides the groundwork for Section 9 of the Digital Personal Data Protection Act, 2023, which requires the verifiable consent of a parent or lawful guardian before processing a child's personal data and prohibits tracking, behavioural monitoring and targeted advertising directed at children.
Does DPDP Guard support data retention limits and an audit trail?
Yes. You can define a retention rule per data category — a fixed period or an inactivity window — schedule an individual data principal's erasure with an automatic 48-hour pre-erasure notice, and review an immutable processing-activity log alongside the consent audit trail. Together these evidence the storage-limitation and accountability expectations of the DPDP Act, 2023: that personal data is retained only as long as its purpose requires, and that a Data Fiduciary can demonstrate the lawful basis on which it processed personal data.
Does DPDP Guard give me a compliance dashboard that shows what to fix first?
Yes. When a Data Fiduciary signs in, the compliance command centre presents a single organisation compliance score with its breakdown alongside a prioritised action list generated from your live data — overdue breach detailed reports, data-principal requests past their response SLA, SLA-breached grievances and missing active policies are surfaced first, ahead of lower-priority items. Operational counters and a recent-activity feed sit beside it, so a Data Protection Officer can see the whole compliance posture and the next action in one place.
Which industries is DPDP Guard built for?
DPDP Guard is used across regulated, consumer-facing sectors — including BFSI and fintech, e-commerce, telemarketing, and healthcare — wherever Indian businesses process personal data and must meet DPDP Act obligations.
Does DPDP Guard track the Telecommunications (User Identification) Rules, 2026 obligations for corporate SIMs?
Yes. Rule 6(4) of the Telecommunications (User Identification) Rules, 2026 requires an enterprise running pooled corporate SIMs to intimate its telecom operator within 3 working days of a business connection's end user changing, and to complete the new end user's biometric identification within 7 working days. DPDP Guard's Telecom Business-Connection console lets you log a reassignment once and tracks both working-day clocks independently — pending, done or overdue — so neither deadline is missed silently.
Is DPDP Guard free to start?
Yes. You can create an account and set up your compliance workspace — consent banner, privacy-policy generator, data-principal portal and breach register — at no cost, then scale up as your needs grow.
How does the AI privacy policy generator work?
A step-by-step wizard collects your data-processing details, then an AI agent drafts a DPDP-aligned privacy policy. You can save drafts, keep versions, publish the policy, and host it at a public URL.
Is the AI-generated privacy policy legal advice?
No. DPDP Guard's AI Privacy Policy Generator produces a Digital Personal Data Protection Act–aligned first draft from the data-handling details you provide, which you can review, edit, version and publish at a public URL. It is compliance tooling designed to get you to an accurate, editable draft in minutes instead of starting from a blank page — it is not legal advice and does not replace review by qualified counsel. You remain the Data Fiduciary responsible for the notice you publish.
Is DPDP Guard suitable for multi-site or multi-brand companies?
Yes. Domain groups let you configure a distinct banner per brand and share consent across aliased domains, so every property is managed from one place.
Does DPDP Guard help me draft and publish a Section 5 privacy notice?
Yes. The Privacy Notice Builder lets you itemise exactly what personal data you collect and why, draft the notice in multiple languages against a coverage table for the Eighth Schedule, and route it through a real approval workflow — a colleague has to approve a draft before it can publish, and the server enforces that, not just the UI. A review dialog diffs the new notice against what's currently live before you publish, and past versions are superseded rather than deleted, so every consent stays tied to the exact notice version it was given against. The published notice is served directly inside the consent banner on your site.
What happens if a data principal reads a notice before its translation is reviewed?
DPDP Guard shows them a non-dismissible banner explaining that the notice they're reading is a machine translation that hasn't yet been checked by a human reviewer, and names the English version as authoritative. The same disclosure appears if a previously-reviewed translation goes stale after the source notice changes. This keeps the Eighth Schedule's multi-language notice support honest about review status rather than presenting an unreviewed translation as equally authoritative.
Can DPDP Guard block a purpose like targeted advertising for a child?
Yes. The Age-Assurance Console lets a Fiduciary or DPO record a data principal's self-declared age band and then evaluate a specific purpose — such as targeted advertising or behavioural tracking — against it before that purpose runs. For any principal not confirmed as an adult, the enforcement gate denies targeted advertising, behavioural tracking and behavioural monitoring outright, citing the Section 9 prohibition on directing these at children, and appends every allow/deny decision to a reviewable log with its reason. The graded 8-12/12-16/16-18 age-band framework itself is one proposed way to grade assurance strength, not a binding legal standard on its own — only the underlying Section 9 prohibition is enacted law. The same console also shows a jurisdictional age-threshold matrix (the Union DPDP Act's enacted 18, alongside proposed — not yet enacted — Karnataka and Andhra Pradesh state thresholds) and a Rule 10 conformance report grading your held population per age band as backed by a checked guardian relationship or not.
Does DPDP Guard help me find DPDP-relevant tenders and RFPs to bid on?
Yes. Tender Watch is a curated feed of open procurement tenders, RFPs and empanelments from PSU banks, insurers, and central and state government departments that call for DPDP compliance — filterable by issuer type and deployment mode, and sortable by a bid-fit score that weighs deployment-mode match, RFP kind and deadline urgency. Once you decide to respond, a per-tender checklist tracks how ready your response is and lets you attach an existing evidence bundle as proof of an already-covered requirement.
Does DPDP Guard support DPIAs (Data Protection Impact Assessments)?
Yes. The DPIA Workflow takes an assessment through a fixed draft → in review → approved lifecycle, with approval restricted to the DPO role. An AI assistant can draft a first-pass necessity and proportionality justification from a linked Register of Processing Activities (RoPA) entry, which you then edit and submit for review. Any assessment, at any stage, can be exported as a PDF for an internal file, an auditor, or the Data Protection Board of India.
Does DPDP Guard include a Register of Processing Activities (RoPA)?
Yes. The RoPA Builder records each processing activity's purpose, data categories, legal basis and cross-border-transfer status, and links it to the retention policy, processor, DPIA and consent artefact that back it up, so the register isn't a set of disconnected assertions. Every edit to an activity is versioned, and the whole register exports as a PDF.
Can I track my third-party vendors' data-protection risk under the DPDP Act?
Yes. The Vendor Risk Register tracks every data processor you share personal data with, derives a risk level and audit cadence per vendor instead of asking you to guess one, records each audit's outcome, flags a Data Processing Agreement (DPA) before it expires or once it's overdue, and can generate a DPA from a built-in template for a vendor that doesn't have one on file yet.
Can I get a webhook when a data principal gives consent or a rights request completes?
Yes. Register your own endpoint from the Integrations page and DPDP Guard delivers an HMAC-SHA256-signed HTTP callback (X-DPDP-Signature header) the moment a data principal gives consent (consent.given), withdraws consent (consent.withdrawn), a rights request reaches a completed state (dsr.completed), or a breach is recorded (breach.recorded) — no polling required, and no request to us needed to turn it on. A copy-paste Node.js snippet shows how to verify each delivery's signature before trusting the payload, and a per-endpoint delivery history lets you filter, export and manually retry any failed attempt. A rights-request-raised event is documented as coming soon but is not dispatched yet.
Can I show customers proof of my DPDP compliance without sharing a login?
Yes. Opt in from the Compliance Score page and DPDP Guard publishes a public, no-login trust badge at a stable URL (/badge/your-org) — a coarse compliance tier (strong, developing or early-stage) and, when your consent banner passes the same checks your DPO sees privately, a 'Consent Symmetry Verified' signal. The badge never exposes your exact score or a finding-by-finding breakdown, and it is off by default — it is your choice to publish it.
Can visitors see a plain-language summary of my data practices without reading a full privacy policy?
Yes. The Privacy Nutrition Label is a public, always-current, quick-scan summary — data types collected, purposes, third-party sharing, retention periods and a breach-notification commitment — generated automatically from the same policy and retention data you already maintain, at a stable URL (/nutrition-label/your-org). A live inline preview and a one-click copyable link on the Privacy Policies page let a DPO see and share it without leaving the app.
Can I see which external identities and sessions my backend has brokered?
Yes. The Token Broker Console is a read-only view over the Principal Token Broker — the golden-path auth mode where your own backend exchanges a service API key and one of your external user ids for a short-lived Data Principal access token. It shows KPI tiles, a linked external-identity list with a session-history drawer, and a recent-sessions table with Active/Expired badges, so you can confirm a brokering integration is working without querying the database yourself.
Can my team ask DPDP compliance questions and get a cited answer, instead of a generated one?
Yes. The Compliance Knowledge Assistant runs a plain-language question against the same curated DPDP Act and regulatory corpus the AI Policy Generator already draws from, and returns the closest-matching excerpts with citations and a similarity indicator — not an AI-generated summary that could be confidently wrong. It's rate-limited per organisation, keeps a reopenable history of recent questions, and is a separate, narrower surface from the super-admin-only corpus curation console.
How do I know if a DPDP obligation I've read about is actually in force?
Check the "In Force Today" Obligation Ledger, a public page at /obligation-ledger that grades every DPDP-related obligation as in force, notified-but-not-commenced, proposed, speculated or refuted — each with a rule reference, a plain-language explanation and a source link. It exists because general web search results have surfaced an uncited Wikipedia infobox naming a non-existent Data Protection Board of India Chairperson as fact, and vendor blogs asserting an ungazetted compliance-date acceleration as settled law; the ledger is curated from public regulatory sources instead.
How much does DPDP Act compliance actually cost, and can I check if a vendor's quote is fair?
Answer a few questions about your data-principal scale, sectors, children's-data handling and cross-border transfers on the public DPDP Compliance Cost Estimator (/cost-estimator) for an instant, defensible annual cost band — no sales call required. If a vendor has already quoted you a price, paste it into the Vendor-Quote Sanity Check on the same page and get a below/within/above-band verdict with the percentage gap, countering the market's routine ₹15-lakh-to-₹2-crore quote spread with a number you can defend.
Can I show a regulator every consent one specific person gave, with proof it's real?
Yes. The Consent Register groups every consent by the data principal it belongs to and grades each one's supporting evidence as full, partial or none from its own audit trail, so a gap in the evidence is a badge on the row rather than something you only discover by opening a modal. You can filter by status and capture source, then export a CSV evidence pack with an on-page SHA-256 digest and a per-record permalink — proof you can hand to a Data Protection Board inquiry without screenshotting a screen. The register is read-only by design: it never edits a consent, because the burden of proof is on the fiduciary.
Can I export my consent audit trail for a regulator or an internal review?
Yes. The Transparency Report totals your discovered trackers, consents given/withdrawn/active and audit-trail volume, breaks trackers down by category, and then exports the underlying consent audit trail as a CSV in a two-step flow — review the metrics, then export — so you can hand a reviewer a file instead of a series of screenshots.
Can I check what a specific customer has consented to without an API key?
Yes. Consent Status Lookup is an in-dashboard console for exactly this: enter a data principal's email address and see every purpose's current decision — opted in, opted out, or withdrawn — using the same resolution logic as the public GET /api/v1/consent-status route. It's built for a DPO fielding a grievance or support ticket who needs the answer immediately, not a developer with a service key and a terminal.
Can I manage my profile, security, billing and team from one place?
Yes. Account Center at /dashboard/account brings your profile and language, a security-posture report, your organisation's identity and public URLs, a plan-and-usage summary, and team management into one settings area — reachable even before your organisation has finished its legal-entity setup. Billing here is a view-only summary; upgrading your plan yourself is a separate, currently limited-rollout capability.
Can a data principal nominate someone to exercise their rights after they die or become incapacitated?
Yes. Section 14 of the DPDP Act gives every data principal this right, and DPDP Guard ships a self-service nomination wizard for it — name, change or revoke a nominee at any time from the principal's own settings. Nomination grants no access to the principal's data today; the nominee can only act if the principal dies or loses capacity to act for themselves.
Does an ABHA health-ID consent artefact already satisfy DPDP consent requirements?
No — this is a common and risky assumption in Indian healthcare IT. ABDM's ABHA consent artefact and DPDP consent are two separate legal requirements with different purposes, durations and withdrawal mechanics. DPDP Guard's Healthcare ABDM Bridge lets a DPO record which DPDP consents have a matching ABDM artefact and see the organisation's linkage coverage, so the reconciliation gap is visible instead of silently assumed away.
How do I prepare to become — or to integrate with — a licensed Consent Manager under Rule 5?
DPDP Guard ships two separate self-assessments: one scored against Rule 5's own registration criteria (Indian incorporation, minimum net worth, data-blind operation, independence, interoperability, accessible UX) for organisations seeking a Consent Manager licence, and one scored against the fiduciary-side technical interoperability criteria for organisations that simply need to be ready to connect to a registered Consent Manager once one exists. A registration wizard with a filing-queue joiner and a live inbound-signal console round out the suite ahead of the 14 November 2026 registration window.
How do I demonstrate valid consent for personal data I collected before the DPDP Rules took effect?
DPDP Rules Schedule Phase 2 (mid-November 2026) requires a Data Fiduciary to demonstrate valid consent for personal data collected before the Rules took effect, not just data collected afterwards. The Legacy Data Compliance Wizard's 3-step flow handles this directly: Inventory surfaces every existing principal with no DPDP-standard consent on file, Campaign launches a re-consent notice against them with a live email preview, and Fallback tracks who responded and automatically schedules erasure for anyone who doesn't by the deadline you set — so the gap closes on an auditable record instead of a guess.
Can I see who a connected marketing plugin is suppressing, or add an opt-out myself?
Yes. Every consent withdrawal already writes a suppression entry that a connected CMS/e-commerce plugin polls via GET /api/v1/suppression-list before it sends. The Suppression List console makes that table visible for the first time: KPI tiles for total, active and lifted entries, a status filter, and a manual-add form for an opt-out that arrives outside any consent or DSR flow — for example, by phone or a support email. Lifting a suppression takes one click from its row.
How do I prove a consent withdrawal actually reached every downstream processor?
Expand any withdrawal row on the Suppression List console for a "Downstream propagation" disclosure: an N-of-M-confirmed summary, then a per-destination status — pending, acknowledged, or overdue — for every processor holding that principal's data. If a destination confirms outside the platform (a phone call, a vendor's own portal), a DPO can mark it acknowledged manually. A `pending` row that goes unconfirmed past 24 hours is automatically flipped to `overdue` so stalled destinations don't look identical to ones dispatched a minute ago, and a downstream processor can also self-attest via the public POST /api/v1/withdrawals/{propagationId}/ack endpoint, authenticated with the same org-scoped API key as the rest of the public API. Each pending or overdue row also carries a ready-to-send curl example for that endpoint, so you can hand it straight to a downstream destination's engineers instead of relaying the acknowledgement by hand.
Can DPDP Guard help me answer a government tender's DPDP-readiness questionnaire?
Yes. Government and PSU procurement is increasingly treating DPDP readiness as a bid-stage qualification. The Bidder Annexure maps your existing compliance records — DPO appointment, RoPA activities, DPIAs, breach-drill readiness, retention policies, signed processor DPAs and evidence bundles — onto a standard seven-item Yes/Partial/No checklist, so a bid team can answer it from records already on file. A guided two-step wizard exports a ready-to-paste document for the bid response once any gaps are acknowledged.
Does DPDP Guard find personal data hiding in my databases, not just on my website?
Yes, with Data Discovery & Classification. You register a source (a database, file export or spreadsheet) and paste in its column manifest — the table path, column name, and an optional declared type, never sample values — and a pure, India-specific rule set classifies each column (Aadhaar, PAN, IFSC, UPI VPA, Voter ID, ABHA and more, alongside general categories like contact, health and biometric data). A coverage report then surfaces personal-data columns with no linked RoPA activity or retention policy, so a DPO can close the gap. This is a schema/column-level classifier for your own systems of record, distinct from the Cookie & Tracker Scanning feature above, which scans a public-facing website's runtime trackers.
Can a consent banner be technically valid but still count as a dark pattern?
Yes. Pre-ticked boxes and implied consent are already rejected outright when you save a banner under DPDP legislation mode, but a banner can still be manipulative in ways that check doesn't cover — an accept-only choice with no reject option, a decline control with no visible label, or a dismiss-by-scroll gesture that quietly counts as consent. The Banner Dark-Pattern Audit scores your live configuration against those signatures, plus a consent-fatigue signal that treats a suspiciously high accept rate (90%+) as a finding to investigate rather than a metric to celebrate, and links each finding to the exact setting that fixes it.
Does DPDP Guard help with WhatsApp Business API consent compliance?
Yes. A saved contact, a bulk-uploaded list, or an inbound 'Hi' is not, by itself, DPDP consent. The WhatsApp Channel Audit is a guided six-criterion self-assessment — consent collection, notice at collection, DSR channel availability, consent receipt generation, purpose limitation, and retention-policy linkage — with a statutory citation and a specific remediation step for every gap, and a live 0-100 score computed server-side from the same criteria.
DPDP Guard by industry
The same features map to the DPDP Act obligations that matter most in your sector. Explore a use case built for how your industry captures consent, honours data-principal rights, and handles breaches.
Ready to become DPDP compliant?
Set up your compliance engine in minutes — register, configure, and go. No lengthy onboarding required.