Consent, cookies, breach response and Data Principal rights — one platform, built natively for DPDP 2023, not adapted from GDPR.
The DPDP Act 2023 is law, with its substantive obligations and penalty regime commencing 13 May 2027. Every digital service processing personal data of Indian residents will be in scope — regardless of where the company is headquartered.
All plans include DPDP 2023 compliance, CERT-In tracking, and India data residency. No hidden fees.
From cookie consent to CERT-In breach tracking — see exactly how Consiva keeps your organisation compliant across DPDP, GDPR, and CERT-In simultaneously.
Auto-scans every cookie and tracker on your domain, categorises them by purpose, and presents DPDP-format consent banners in any Eighth Schedule language — deployed via a single script tag.
DPDP 6, 11–14 gives every Indian user clear rights over their personal data. Consiva automates intake, identity verification, routing, fulfilment, and the immutable audit trail — with escalation before SLA breach.
A data breach triggers two separate regulatory clocks simultaneously. Consiva tracks both independently — CERT-In's 6-hour window and DPDP Board's notification window — with auto-drafted reports for each regulator.
Connect your database in one click. Consiva scans every table, flags personal data at rest, and maps it to your DPDP processing purposes — powering your ROPA automatically.
<script> tag and paste it in your site's <head>. For WordPress, install the Consiva Consent Banner plugin and paste your Script Key in Settings — done in under 60 seconds.Expert guides on DPDP compliance, cookie consent management, data privacy, and CERT-In obligations — written for Indian compliance teams and legal officers.
Legal, IT and marketing each own a slice of privacy compliance, and none of it talks to the others. What a genuine privacy management platform consolidates — consent, rights routing, vendor tracking and breach response — into one shared dashboard.
The DPDP Rules were notified in November 2025 and the full penalty timeline runs to May 2027 — but compliance isn't something you bolt on in a weekend. A ten-step guide to what the Act requires and where India's rollout actually stands.
Spreadsheets, email chains and a bolted-on consent banner quietly fall apart under real DPDP scrutiny. What DPDP compliance software actually does across consent, rights requests, breach clocks, data discovery and ROPA — and why it turns a scramble into a routine.
Not every tool calling itself a DPDP compliance solution actually is one. The ten features that separate the real thing from a rebadged GDPR platform — the checklist to bring to any vendor demo.
Picking a DPDP compliance platform is a decision you live with for years. A practical framework for the call — the non-negotiables, six lenses to judge any shortlist, and the traps that catch buyers.
Rule 8(3) requires a minimum one-year retention of personal data and processing logs — even after account deletion. Section 12 gives a right to erasure. Here is how the two obligations actually interact.
Not yet, in the sense that matters. The Data Protection Board is established and Rules 1, 2 and 17 to 21 are in force. The substantive obligations and the entire penalty regime commence on 13 May 2027, eighteen months after the Rules were published on 13 November 2025. Consent Manager registration opens on 13 November 2026. Note separately that CERT-In's 2022 Directions are already in force, with a six-hour incident reporting window — so breach readiness is a present obligation, not a future one.
Yes. DPDP follows the data, not the corporate domicile. Any entity that collects, stores, or processes personal data of individuals in India — regardless of server location or company registration — is subject to DPDP. A US SaaS with Indian users must comply. This mirrors the GDPR extraterritorial model.
CERT-In's April 2022 Directions require reporting cybersecurity incidents within 6 hours of detection — completely independent of DPDP's Board notification obligation. Most consent tools only handle DPDP notification and miss the CERT-In window entirely. Consiva tracks both clocks independently from the moment a breach is logged, with separate auto-drafted reports for each regulator.
The free plan includes 1,000 cookie consents and 50 form consents per month — permanently free, no credit card required. You get basic cookie scanning, DPDP banners in English and Hindi, basic analytics, manual rights request handling, and WordPress plugin support for one domain. Automated DSR workflows, the CERT-In breach tracker, 22 languages, and multi-domain support require the Pro plan.
Data Discovery connects to your SQL Server, MySQL, or PostgreSQL databases and scans every table for personal data at rest — email addresses, phone numbers, Aadhaar patterns, and other PII. This is required for an accurate ROPA under DPDP and to identify data that must be erased when a §12 erasure request arrives.
Install the Consiva Consent Banner plugin from the WordPress Plugin Directory. Go to Settings → Consiva Consent Banner and paste your Script Key from the Consiva dashboard. Save — the banner is immediately active on every page, no theme edits needed. The plugin syncs directly with your Consiva dashboard.
The DPDP Act gives every Indian individual: §6(4) withdraw consent at any time; §11 access information about their data being processed; §12 correction and erasure of inaccurate or unnecessary data; §13 grievance redressal through the Data Fiduciary's Grievance Officer; §14 nominate a representative to exercise rights on their behalf after death or incapacity. Consiva manages intake, identity verification, SLA tracking, and fulfilment workflows for all these rights.
Yes — Multi-Framework Mode on Pro and Enterprise plans. Consiva detects the visitor's jurisdiction via IP geolocation and serves the appropriate banner: DPDP format for India, GDPR-compliant for EU/EEA, CCPA opt-out for California, LGPD for Brazil. All from one script tag.
All consent logs, rights request records, breach incident reports, and audit trails are stored exclusively in India on cloud infrastructure meeting DPDP data localisation requirements. Database credentials entered for Data Discovery are encrypted at rest and are write-only — never returned by any API response.
An SDF is a Data Fiduciary designated by the Government under DPDP §10 based on volume, sensitivity, and national security risk. SDFs face additional obligations: appointing an Indian resident as DPO, annual data audits, Data Protection Impact Assessments, and algorithmic accountability measures. Consiva's SDF module — on Enterprise plans — covers all of these.
Set up in under 10 minutes. 1,000 cookie consents + 50 form consents included every month — forever free. No credit card required.