Designed by data-protection auditors · DPDP consent management for India
DPDP compliance, operationalised.
ConsentLo turns the Act into workflows your team can run: consent that stands up as evidence, personal data found wherever it sits, rights handled on the clock, breaches reported within 72 hours, and rules that update the moment the Government changes them.
15 days free, no card. Set it up yourself, with sample data in one click. Curated by practising DPDP auditors: every control produces the evidence an audit asks for.
41h 12m
left to notify the Data Protection Board
Containment logged
Done
Board draft
Approved by DPO
Principals notified
12,480 of 12,480
Evidence records
#4,112 sealed
Offers by email: withdrawn
sealed · 2 processors toldEvery obligation, run as a workflow.
Notices that hold up
Versioned notices in English and the 22 Eighth Schedule languages. An Invalidity Engine flags clauses the Act voids before you publish.
Consent as evidence
Every choice is a separate, un-ticked decision tied to the exact notice version, sealed in a hash chain. Withdrawal is one click and cascades to processors.
Rights & grievances
Access, correction, erasure and nomination, each on its own SLA clock, with the Board route opening automatically once redress is exhausted.
72-hour breach desk
Two clocks start on discovery. Board intimation and principal notices are drafted for you, approved by a human, and evidenced.
Children's safeguards
Age signals, verifiable guardian consent, harm reviews, and a hard block on tracking and targeted ads for minors.
Data map & processors
No activity goes live without a defensible basis. Processor contracts, retention, erasure and cross-border checks in one register.
SDF & the Board
DPO, DPIA and audit cycles for Significant Data Fiduciaries; correspondence, appeals and voluntary undertakings with the Board.
Rules Watch
Every deadline is versioned configuration. When a notification changes one, it is published once and every clock follows.
Find the personal data you hold, before a regulator or a breach does.
Notice, consent, erasure and breach reporting all depend on knowing where personal data sits. ConsentLo scans your databases from inside your network and shows, column by column, where Aadhaar numbers, PAN, phone numbers, bank and payment details live, without a single value leaving your premises.
Connect in minutes
Run the ConsentLo Connect agent next to your database with a read-only user. It only connects out over HTTPS: no inbound firewall rule, no public IP, no change to your application.
Scan inside your network
The agent reads table and column names and checks a sample of values locally against Indian identifiers and your own formats. Only names, data types and match percentages reach ConsentLo.
Review and put it on record
Each finding is a suggestion. Your team confirms it, links it to a purpose, and it joins your data map. Every decision is sealed in the Evidence Vault.
46 columns hold personal data
out of 312 scanned · 9 waiting for review
members.aadhaar_no
Aadhaar · sensitive97%members.pan_card
PAN · sensitive94%members.contact
Indian mobile99%orders.payer_vpa
UPI ID92%tickets.remarks
Free text · needs a person—Indian identifiers, checked properly
Aadhaar (with checksum), masked Aadhaar, PAN, mobile, email, UPI ID, card numbers (Luhn), IFSC, passport, voter ID, GSTIN, driving licence, IP addresses and stored photos, plus formats you add.
Stays current
Scheduled scans flag new tables and columns as your systems change, so the record of processing never goes stale.
Gaps you can see
Personal data not yet reviewed or not on record shows on the dashboard and in the compliance report. Sensitive data is flagged; free text and encrypted fields go to a person.
Your databases
PostgreSQL, MySQL / MariaDB, Microsoft SQL Server, Oracle and MongoDB. One agent per database, run as a Docker container or with Python.
Built by the people who audit DPDP compliance.
ConsentLo is curated by practising data-protection auditors. We have sat across the table from Data Fiduciaries and seen what holds up and what does not, so the product captures proof as your team works, instead of asking for it afterwards.
Get an auditor-led walkthroughStarted as an audit checklist
Every screen began as a question an auditor asks under the DPDP Act and Rules, not as a feature idea.
Evidence by default
Notices, consents, requests and deadlines are sealed in a tamper-evident Evidence Vault the moment they happen.
Controls mapped to the law
Each workflow traces back to the obligation it satisfies, so gaps show up before an inspection, not during one.
An auditor’s seat inside
A read-only, scoped Auditor role reviews the same records your team works from and logs findings in place.
DPDP compliance for your industry.
Everyone sees exactly what their role needs.
Workspaces are fully isolated. The platform operator publishes regulatory changes and manages plans, and cannot see a single principal, consent or incident of any tenant.
Tenant Admin
Sets up the Data Fiduciary, users and integrations.
DPO
Owns breaches, DPIAs and the Board; approves rights work.
Grievance desk
Works rights requests and grievances within SLA.
Engineer
Wires in the Consent SDK, APIs and webhooks.
Auditor
Read-only, scoped; records audit findings.
Data Principal
Self-service portal in their own language.
Plans that scale with the principals you serve.
Growth
Talk to us
Mid-market with multiple processors: adds data mapping, processor contracts, breach management, retention automation and child safeguards.
Enterprise
Talk to us
Likely or confirmed Significant Data Fiduciaries: the full SDF module, regulatory interface, cross-border control, SSO and custom SLAs.
Government / regulated
Talk to us
Public-sector or heavily regulated entities: dedicated or on-premise deployment and sectoral policy packs (RBI / SEBI / IRDAI / health).
Understand the DPDP Act and DPDP Rules, 2025.
Plain-language explainers on consent management, breach notification, penalties, children's data and a step-by-step compliance checklist.
DPDP Act 2023 explained: a practical guide for Indian businesses
What the Digital Personal Data Protection Act, 2023 means for your business: who it applies to, consent, rights, children, breaches, penalties and how to comply.
Read the guide
DPDP Rules 2025: what they require and when
A clear summary of the Digital Personal Data Protection Rules, 2025: phased commencement, notices, consent managers, breach reporting in 72 hours, retention and children.
Read the guide
Consent management under the DPDP Act
How to collect, record and honour valid consent under India's DPDP Act: notices, purpose-by-purpose choices, withdrawal, proof of consent and a consent management platform.
Read the guide
DPDP compliance checklist: 12 steps to get ready
A practical DPDP Act compliance checklist: data mapping, notices, consent, rights, grievances, processors, breach response, children, retention, security and evidence.
Read the guide
DPDP consent management, answered.
What is ConsentLo?
ConsentLo is a DPDP consent management and compliance platform for India. It runs notices, consent, data discovery, rights, grievances, breach reporting, children's data and evidence for the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025.
Is ConsentLo a consent management platform?
Yes. It captures purpose-by-purpose consent through a website widget, SDK or privacy portal, keeps a tamper-evident consent ledger, and makes withdrawal one step. It can also receive consent from registered Consent Managers.
Can ConsentLo find personal data in our databases?
Yes. The ConsentLo Connect agent scans PostgreSQL, MySQL / MariaDB, SQL Server, Oracle and MongoDB databases and shows, column by column, where personal data such as Aadhaar, PAN, mobile numbers, email, UPI IDs, card and bank details sits. A person confirms each finding before it joins your data map, and scheduled scans flag new tables and columns as your systems change.
Does our data leave our network during data discovery?
No. The agent runs inside your network and only connects out to ConsentLo over HTTPS. It checks sample values locally and sends only table and column names, data types and the share of values that matched each pattern. No row, value, database password or connection string is ever sent, and your IT team can preview exactly what would be sent before anything goes.
Does ConsentLo support Indian languages?
Yes. Notices and the privacy portal work in English and the 22 languages of the Eighth Schedule, including Hindi, Bengali, Tamil, Telugu, Marathi, Gujarati, Kannada and Malayalam.
How does ConsentLo handle the 72-hour breach rule?
Logging a breach starts both clocks, for the Data Protection Board and for affected people. ConsentLo drafts both notices, requires human approval, sends them and keeps the evidence.
Is my data kept separate from other customers?
Yes. Every organisation gets an isolated workspace, and even the platform operator cannot see your principals, consents or incidents.
The clocks are already running.
See it on your own data flows: we will walk you through notices, consent, rights and the breach desk.