About ConsentOS
DPDP consent infrastructure for India's regulated companies.
ConsentOS records and signs consent for Data Fiduciaries under the Digital Personal Data Protection Act 2023. It is built for NBFCs, fintech lenders, registered brokers and insurers: the companies whose DPDP duties meet a sector regulator's retention rules on the same record.
The Compliance Gap
India's Digital Personal Data Protection Act 2023 set a clear requirement. Businesses must collect personal data with explicit consent, store it with accountability, and honour every individual's right to withdraw that consent at any time. The law states the obligation without supplying the implementation, and enforcement is approaching.
Most businesses operating in India understand they need to be compliant. Most do not know what compliant actually looks like at an operational level.
ConsentOS handles the mechanics. Consent is captured against a stated purpose and kept as a signed record, and a withdrawal is signed against that same record. The target: 30 days from account creation to a consent framework running inside your product.
Operating Principles
How We Build
Three principles govern everything in ConsentOS.
- 01
Sovereignty by design.
The individual is the Data Principal. Every consent record names one of eight fixed purposes and carries a timestamp set by the server. A write without a purpose is rejected by the API. Withdrawal is available on every plan.
- 02
Precision over theatre.
The compliance industry has spent a decade producing consent popups designed to confuse and privacy policies written to obscure. ConsentOS replaces both. Every mechanism produces a consent record that is accurate, complete, and legally defensible.
- 03
Continuity.
Your product keeps its own data flows. Your engineers mint an API key in Settings and send each consent grant to a single endpoint,
POST /api/v1/consent, carrying the principal's email and a purpose code. No core feature is rebuilt.
Primary Segment
Built for Regulated Fintech
For NBFCs, brokers and insurers, the hard case is a KYC file that RBI and PMLA rules require kept for five years and a Data Principal asks to erase: the Compliance Vault flags that request and records the statute behind the hold. How the Legal Obligation Override works.
Purpose-built for India's regulated mid-market: the companies too small for Big 4 engagements and too regulated for banner tools.
Structural Advantage
Why India-Incorporated Matters
Rule 4 applies from 13 November 2026, when registration becomes mandatory for anyone operating as a Consent Manager. Under Sections 6(7) to 6(9), a Data Principal may give, manage, review, and withdraw consent through a registered Consent Manager, and that Consent Manager is accountable to the Data Principal. Data Fiduciaries are not required to route consent through one. ConsentOS is the consent infrastructure Data Fiduciaries use to capture, sign, and act on their own consent records.
Becoming a registered Consent Manager is a capital contest. The First Schedule conditions, including India incorporation, an interoperable platform, and a net worth of not less than Rs.2 Crore, favour incumbents. CivicLayer Technologies Private Limited intends to seek that registration once Rule 4 applies, subject to those conditions. ConsentOS today is consent infrastructure for Data Fiduciaries, not a registered Consent Manager. Each consent record and withdrawal event is signed with HMAC-SHA256 as it is written. A Consent Manager network API is on the roadmap for H1 2027, not live.
India-incorporated status is a credibility signal to your regulators, your auditors, and your data principals. CivicLayer Technologies Private Limited is regulated by the same authority our clients are. For regulated BFSI companies facing DPBI review, it is the foundation every compliance artefact rests on.
Nov 2026
Consent Manager Framework Activates
A Data Principal may give, manage, review, and withdraw consent through a registered Consent Manager. Data Fiduciaries are not required to route consent through one. ConsentOS signs and exports a fiduciary's own consent records today.
Accountability
The Founder
ConsentOS is built by Sarthak Kalucha at CivicLayer Technologies Private Limited, Gurgaon. Every article in the ConsentOS knowledge base carries his byline. He answers for its accuracy.
Boundaries
Scope and Exclusions
ConsentOS runs continuously, maintaining compliance as your product changes and your user base grows. A one-time audit produces a point-in-time report and stops there.
ConsentOS is built against the text of the DPDP Act 2023. It is not a GDPR framework mapped onto Indian requirements after the fact.
CivicLayer Technologies Private Limited is incorporated in India and regulated by the same authority our clients are regulated by. Consent Manager registration is open only to companies incorporated in India.
The gap between knowing the obligation and meeting it is measurable.
The free DPDP Gap Assessment covers five compliance areas under the DPDP Act 2023. Your compliance score appears on screen. The PDF report with a prioritised action list follows by email.
Get Your Free DPDP Gap AssessmentNo account required. The report arrives by email.