DPDP Consent Management Platform
Ask fairly. Prove it. Act on time.
Eye On Consent records every consent choice on your websites, apps and systems as tamper-evident proof. Your team handles rights requests, breaches and DPDP readiness in the same console.
- Built for the DPDP Act 2023 and DPDP Rules 2025
- English and 22 Indian languages
- Hosted in India
Most DPDP duties apply from 13 May 2027
Notices, consent, security safeguards, breach reporting and Data Principal rights all apply from that date. Getting consent, records and workflows ready across every system takes time, so start early.
days to go
11 August 2023
The Digital Personal Data Protection Act, 2023 becomes law.
13 November 2025
The government notifies the DPDP Rules, 2025, and the provisions setting up the Data Protection Board take effect.
13 November 2026
The rules for registering Consent Managers come into force.
13 May 2027
Most obligations apply: notices, consent, security safeguards, breach reporting and Data Principal rights.
One console for your DPDP work
Four modules share one set of notices, one chain of receipts and one audit log. Start with consent and cookies, and add the rest when you need them.
Collect and prove consent
Versioned notices in English and 22 Indian languages, sign-up forms, consent by email, and a tamper-evident receipt for every choice.
How consent worksA fair cookie pop-up
One script tag with your logo and colour, cookie categories, trackers held back until people agree, and a hosted cookie policy.
See the pop-upEvery request on the clock
Access, correction, erasure, withdrawal, grievance and nomination requests, each with a due date, tasks and evidence.
How requests workBreaches, readiness and records
A breach register that works out the deadlines, a DPDP gap assessment, your record of processing and audit-ready reports.
See Compliance & AuditConsent that is fair by design
The pop-up shows your logo, your notice and its version number. Essential only and Accept all sit side by side in the same size and colour. Nothing is pre-ticked, and closing the pop-up is not consent.
Analytics and advertising tags wait until people allow them. If someone withdraws, the pop-up removes the cookies listed for that purpose and reloads the page, so the tags stop. A Privacy settings button stays on every page, so changing your mind is as easy as saying yes.
People read the notice in English or any of the 22 languages of the Eighth Schedule. Sign-up forms can show the same notice as checkboxes, and you can ask customers you already know for consent by email.
Proof that holds up
Every choice becomes a consent receipt within seconds. It records the exact notice version and a fingerprint of its text, each purpose as yes or no, the language, the button the person used, and the time in UTC and IST.
Receipts are append-only and chained together by hashes. A withdrawal is a new receipt, never an edit, so any later change to the history can be detected.
If anyone questions a consent, download that person's evidence pack: every record, the notice they saw in their language, and the tamper checks, as a PDF.
A receipt identifies the person by a one-way hash of your ID for them, never by their raw email or ID. IP addresses and browser strings are never collected.
Rights requests, tracked against the deadline
People can ask to access, correct or erase their data, withdraw consent, raise a grievance or nominate someone. They use a request page we host for you or your own portal through the API, or your team logs the request for them.
Each request is verified with a one-time email code or by your organisation. It gets a due date, 90 days at most or the shorter period you publish, and the clock pauses while you wait for the requester.
Tasks go to each system that holds the person's data. Webhooks tell your CRM or HR tool, results come back with evidence, and workflow steps make sure the right person signs off before you answer.
Every pop-up, form and rights page tells people how to complain to the Data Protection Board, after raising a grievance with you first.
When a breach happens, the deadlines are already worked out
Record the breach first. The Breach Register works out what is owed and by when: a notice to each person affected, the detailed report the Data Protection Board needs within 72 hours, and CERT-In's 6-hour deadline for cyber security incidents.
It drafts both texts, the notice to people and the report for the Board, reminds your team before each deadline, and keeps every action, file and note as evidence.
Your team stays in control. The register records each notification you make, and never sends anything for you.
Know where you stand against the Act and the Rules
The DPDP gap assessment checks what the platform can see for itself, such as whether your contact for data rights is published or rights requests are answered on time. Your team answers the rest. You get a readiness score, the gaps and an action plan.
Your record of processing (ROPA) lists each processing activity, the systems that hold the data, and every recipient and processor contract. It feeds access requests, erasure, breach response and your privacy notice.
The privacy notice builder writes your public privacy notice from what the platform already knows, offers it in any of the 22 languages, and keeps every version you publish.
The readiness score is a self-assessment to plan the work. It isn't legal advice, an audit or a certificate of compliance.
Everything built in
The details that make consent work day to day, across all four modules.
English and 22 Indian languages
Notices, the pop-up and your privacy notice in English and any language of the Eighth Schedule.
Children's and guardians' consent
An age question, consent from a verified parent or lawful guardian, and nothing that tracks or advertises allowed for a child.
Consent by email
Ask customers or staff you already know for consent. Silence never counts as consent.
Consent in sign-up forms
The same notice as checkboxes inside your own form, recorded against the email entered.
Withdraw my consent page
A hosted page to link from your privacy policy. People confirm by email, and the withdrawal reaches every website and app.
Unsubscribe links
One link per recipient for your bulk email, with every opt-out recorded.
Cookie discovery
Finds cookies your websites set that your cookie list doesn't cover yet.
Hosted cookie policy
A public cookie policy page for each website, built from its cookie list, and a downloadable cookie register.
Consent retention
See which consents are active, ending soon or expired, and ask people again in time.
Roles and permissions
Built-in roles for the DPO, Compliance Analyst, Auditor and Developer, plus custom roles.
Audit log
Changes, exports and downloads are recorded: who did what, and when.
Your own storage (BYOS)
Keep full consent records in your own S3-compatible bucket, while the platform keeps only the proof.
Live in four steps
Write your notice
Start from a ready-made template, list each purpose, and add the languages you need.
Connect where you collect consent
Add one script tag to your website, show the notice in sign-up forms, or record consent from your systems through the API.
People choose, you keep the proof
Every choice and every withdrawal becomes a receipt within seconds.
Run your DPDP work
Answer rights requests, record breaches, close gaps and download reports from the same console.
Where Eye On Consent helps with the DPDP Act and Rules
The main duties, and the features that support each one. Meeting each duty stays your organisation's responsibility.
| Duty | Act and Rules | In Eye On Consent |
|---|---|---|
| A clear notice before asking for consent, and consent that is free, specific, informed, unconditional and unambiguous | s.5, s.6(1), rule 3 | Versioned notices per purpose, a fair pop-up, sign-up forms and a receipt for every choice |
| The notice in English or a language of the Eighth Schedule | s.5(3) | Translations into all 22 languages, and the receipt records the language read |
| A contact for data rights in every request for consent | s.6(3), rule 9 | Shown in every pop-up, form and consent request, and kept on each receipt |
| Withdrawing as easily as consenting | s.6(4) | Privacy settings button, Withdraw my consent page, unsubscribe links |
| Proof that notice was given and consent obtained | s.6(10) | Hash-chained receipts and a per-person evidence pack |
| Telling the Board and each person affected about a breach | s.8(6), rule 7 | Breach Register: deadlines, drafted notice and report, reminders, evidence |
| Children, and people with a lawful guardian | s.9, rules 10–12 | Age question, verified parent or guardian consent, nothing that tracks or advertises for children |
| Access, correction, erasure, grievances and nomination | s.11–14, rule 14 | Rights requests with due dates, tasks, workflows and responses |
| Complaining to the Board after a grievance | s.5(1)(iii), s.13(3) | Shown on every notice, form and rights page |
| Publishing your contact, how to make a request and your grievance time | rules 9, 14(1), 14(3) | Privacy notice builder |
| Significant Data Fiduciaries: DPO in India, independent audit, yearly impact assessment | s.10, rule 13 | Questions in the gap assessment, and your record of processing as evidence |
| Consent given through a registered Consent Manager | s.6(7)–(9), rule 4 | Not offered. Eye On Consent is a consent management platform, not a Consent Manager |
Section and rule numbers refer to the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. Sector regulators such as RBI, SEBI and IRDAI may set their own rules.
Built for your developers
Websites need one script tag, on plain HTML, WordPress or single-page apps, with no build step. Back-office systems record consent through a signed server API.
SDKs for JavaScript and TypeScript, Python and PHP (with WordPress) take care of the signing. Webhooks and task results connect rights requests to your CRM or HR platform, such as Keka, Zoho CRM, HubSpot or Salesforce, through a small connector you run.
Prefer to hold the records yourself? Write full consent records to your own S3-compatible bucket: AWS S3, Cloudflare R2, DigitalOcean Spaces, Backblaze B2, Wasabi or Google Cloud Storage.
<!-- Eye On Consent: paste into your site's <head> -->
<script src="…" defer></script>Your console shows the exact tag for each website.
Security and privacy built in
Your consent records are legal proof, so the platform is built to keep them safe and unchanged.
Hosted in India
The platform runs on servers in India.
Tamper-evident records
Receipts and audit logs are append-only, enforced by the database, and receipts are hash-chained.
Each organisation kept apart
The database keeps every organisation's data separate.
Encrypted secrets
Passwords are stored as strong one-way hashes. API keys, webhook secrets and storage keys are encrypted under your organisation's own key.
Encrypted in transit
Every connection uses TLS, including the ones to your bucket and your webhooks.
No personal data in logs
Logs carry a hashed reference, never a raw email, phone number, name or IP address.
Two-step sign-in and roles
Authenticator-app codes for console sign-in, and roles that give each person only what they need.
Consent is never dropped
Consent is recorded even past a plan limit, so a billing issue never costs you your proof.
Who needs to comply with the DPDP Act?
The Digital Personal Data Protection Act, 2023 applies to any organisation that processes digital personal data in India: data collected online, and data collected on paper and digitised later. It also applies to organisations outside India that process personal data to offer goods or services to people in India.
The Act calls these organisations Data Fiduciaries. If your business keeps customer, employee or vendor records in a CRM, an HR system, a shared drive or a database, the DPDP Act very likely applies to you.
Ready-made templates for
DPDP penalties at a glance
The Data Protection Board decides each penalty case by case, up to these maximums set in the Schedule to the Act.
No reasonable security safeguards
Failing to take reasonable security safeguards to prevent a personal data breach.
Breach not reported
Failing to notify the Data Protection Board or affected people of a personal data breach.
Children's data
Breaking the additional obligations for processing the personal data of children.
Significant Data Fiduciary duties
Breaking the additional obligations that apply to Significant Data Fiduciaries.
Any other breach
Breaking any other provision of the Act or the DPDP Rules.
Data principal duties
Individuals who break their own duties under the Act, for example by filing a false or frivolous complaint.
Works alongside our DPDPA consulting
Eye On Consent pairs with our DPDPA readiness consulting. The platform runs your consent records, requests and registers day to day, while our consultants handle gap assessments, readiness engagements and staff training.
Frequently asked questions
What is Eye On Consent?
Eye On Consent is Eye On Bits' consent management platform for India's DPDP Act 2023 and DPDP Rules 2025. It collects consent on your websites, apps and systems, keeps tamper-evident proof of every choice, and gives your team one console for rights requests, breaches, gap assessment, your record of processing and your privacy notice.
Is Eye On Consent a Consent Manager under the DPDP Act?
No. A Consent Manager is a separate role under section 2(g) of the Act, registered with the Data Protection Board. Eye On Consent is a consent management platform that processes data on your behalf. Your organisation stays the Data Fiduciary and decides how it uses the consent it collects.
Does using Eye On Consent make us DPDP compliant?
No tool can do that by itself. Eye On Consent gives you the notices, records, workflows and evidence the Act asks for, and the gap assessment shows what is left to do. How your organisation uses personal data remains its own responsibility, and our consultants can help.
How do we add it to our website?
Register the website in the console and paste one script tag into its <head>. It works on plain HTML, WordPress and single-page apps. Analytics and advertising tags you mark are held back until the visitor allows them.
Where is our data stored?
The platform runs on servers in India. If you prefer, full consent records can go to your own S3-compatible bucket, and the platform keeps only what it needs to find each record and prove it hasn't changed.
Which languages does it support?
English and all 22 languages of the Eighth Schedule to the Constitution. People choose their language, and the receipt records which one they read.
Can we record consent from our app, CRM or call centre?
Yes. Your servers send consent through a signed API, directly or with the JavaScript/TypeScript, Python or PHP SDK. Sign-up forms can show the notice as checkboxes, and you can ask people for consent by email.
Does it handle children's consent?
Yes. A notice can ask whether the person is 18 or older. A child's consent counts only once a parent or lawful guardian gives it and your organisation records how it verified them, and nothing that tracks or advertises can be allowed for a child. The checking itself stays with you.
What happens when we have a personal data breach?
Record it in the Breach Register. It works out what is owed to the Data Protection Board, CERT-In and the people affected, drafts the notice and the report, and reminds your team before each deadline. You send each notification yourself.
When do the DPDP obligations apply?
Most obligations, including notices, consent, security safeguards, breach reporting and Data Principal rights, apply from 13 May 2027, 18 months after the DPDP Rules were notified on 13 November 2025.
Is this a replacement for DPDPA consulting?
No, it complements it. Our consultants can run a gap assessment or a full readiness engagement, and Eye On Consent runs the day-to-day work afterwards.
What are the penalties for not complying with the DPDP Act?
The Data Protection Board can impose penalties of up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for not reporting a breach or for breaking the rules on children's data, and up to ₹50 crore for most other breaches.
See Eye On Consent in action
Tell us where you collect personal data today, on websites, apps, forms or HR systems, and we'll show you how Eye On Consent records and proves it.