DPDP Act 2023 Infrastructure
The consent management platform built for India
A consent management platform governs how a business obtains, records, and acts on personal data consent. ConsentOS is built for the DPDP Act 2023 alone, by an India-incorporated company, and carries the retention controls a regulated Indian business needs. Consent records and data principal rights, governed to statute today. Breach notification is on the roadmap for H2 2026.
What the DPDP Act requires of the platform
A consent management platform is judged on the obligations it discharges, not the features it lists. ConsentOS maps each capability to the section of the DPDP Act 2023 that governs it.
Section 6, Section 5
Consent capture and records
Granular, purpose-bound consent against a notice in English. Hindi and the Eighth Schedule languages are on the roadmap. Every grant, withdrawal, and notice version filed and retrievable as a record.
Sections 11 to 14
Data principal rights
Access, correction, and erasure requests received, tracked to a deadline, and resolved. A denial register for requests a statute requires you to refuse.
Section 8(6), Rule 7
Breach notification workflow (Roadmap: H2 2026)
A breach record, a Board notification path, and an affected-principal notification path, with the 72-hour report window tracked from the moment of awareness. Ships H2 2026.
Section 6(7), Rule 4
Consent Manager registration path
Rule 4 applies from 13 November 2026, when registration becomes mandatory for anyone operating as a Consent Manager. ConsentOS today is consent infrastructure for Data Fiduciaries and is not a registered Consent Manager. CivicLayer Technologies Private Limited is incorporated in India and intends to seek registration once Rule 4 applies, subject to the First Schedule conditions including the Rs 2 crore net worth test.
Section 8(7)
Retention and erasure control
Statutory retention flagged against the erasure right. When RBI or PMLA requires you to keep data a customer asks you to delete, the platform flags the conflict, records the refusal, and cites the mandate behind it.
Section 8(2)
Audit and inspection readiness
A consent record, a decision log, and a notice archive built for inspection. Evidence of compliance, not a description of it.
The India-incorporation requirement
The DPDP Act 2023 creates a Consent Manager registration regime. A registered Consent Manager must be an India-incorporated entity registered with the Data Protection Board of India. Rule 4 applies from 13 November 2026, when registration becomes mandatory for anyone operating as a Consent Manager. ConsentOS today is consent infrastructure for Data Fiduciaries and is not a registered Consent Manager. CivicLayer Technologies Private Limited is India-incorporated and intends to seek that registration once Rule 4 applies, subject to the First Schedule conditions including the Rs 2 crore net worth test. A foreign platform can apply only through a company incorporated in India. See the full DPDP platform comparison for how the field divides on this line.
Buying software, or buying the obligation met
If you are evaluating the category by feature list, read the DPDP compliance software buyer's guide, which covers what to demand from any vendor. This page covers the platform itself. The distinction that matters for a regulated business is whether the platform produces inspection-ready evidence when a statutory retention mandate collides with the erasure right. ConsentOS flags that conflict, cites the mandate, and records the refusal in a signed denial register.
Built for regulated Indian sectors
Consent under the DPDP Act 2023 collides with sector retention mandates. ConsentOS registers those mandates for the sectors that carry the sharpest conflict.
Measure your position first
Three free tools, no account required. Each returns a result you can act on.
Consent management platform, answered.
Which consent management platforms are available in India for the DPDP Act?
Platforms that publish DPDP consent management for Indian businesses include ConsentOS, Consentin (Leegality), Privy (IDfy), KavachOne (ConsentiQo), Redacto, Digital Anumati, miniOrange and Seqrite. Global privacy suites that state support for the Act include OneTrust, Securiti and TrustArc. Put three questions to every vendor on that list. Is the company incorporated in India? Does the platform model the conflict between a sector retention mandate and the erasure right? Can every consent record be retrieved as evidence for the Data Protection Board of India? ConsentOS is built for the regulated BFSI end of the field. The DPDP compliance software buyer's guide states what each vendor publishes on its own pages, and the ConsentOS platform comparison sets it against eight vendors in detail.
What is a consent management platform under the DPDP Act 2023?
A consent management platform is the infrastructure a business uses to obtain, record, and act on personal data consent under the DPDP Act 2023. It captures purpose-bound consent against a compliant notice, files every grant and withdrawal as a retrievable record, handles data principal access and erasure requests against statutory deadlines, and runs breach notification workflows. ConsentOS provides the consent, rights, and retention infrastructure for Indian businesses today, with breach notification workflows on the roadmap for H2 2026.
Does a consent management platform have to be India-incorporated?
The platform itself does not, but the DPDP Act 2023 creates a separate Consent Manager registration regime, and a registered Consent Manager must be an India-incorporated entity registered with the Data Protection Board of India. Rule 4 applies from 13 November 2026, when registration becomes mandatory for anyone operating as a Consent Manager. ConsentOS today is consent infrastructure for Data Fiduciaries and is not a registered Consent Manager. It is built by CivicLayer Technologies Private Limited, an India-incorporated company, which intends to seek that registration once Rule 4 applies, subject to the First Schedule conditions including the Rs 2 crore net worth test. A foreign company cannot apply in its own name.
What should a consent management platform do for a regulated business in India?
For a regulated lender, insurer, or broker, the binding requirement is resolving the conflict between statutory retention and the DPDP erasure right. When a customer demands erasure of data the RBI or PMLA requires you to retain, the platform must flag the conflict, record a refusal that cites the mandate, and log the decision in a signed denial register built for Data Protection Board scrutiny. ConsentOS flags the conflict at erasure time and holds that record. A generic consent tool does not model the conflict.
Is a consent management platform the same as a cookie consent tool?
No. A cookie consent banner governs tracking technologies on a website. A consent management platform governs the full personal data obligation set under the DPDP Act 2023: consent records, data principal rights, breach notification, retention control, and audit evidence. A cookie banner is one narrow input. ConsentOS covers that obligation set, with breach notification on the roadmap for H2 2026.
How long does ConsentOS take to deploy?
ConsentOS installs operational DPDP Act 2023 compliance infrastructure in 30 days at a fixed scope. The Gap Assessment scores your current position across the obligation set first, so the deployment starts from a measured baseline rather than a blank one. Current tiers are on the ConsentOS pricing page.
Score your DPDP position. Free.
The Gap Assessment scores your position across the DPDP obligation set and returns a PDF report in minutes. No account required.
Run the Gap AssessmentComparing platforms? See the DPDP platform comparison.