Anyone can capture a tick. A consent management system has to prove what was agreed, when, to what — and that withdrawing was as easy as giving.
For most Indian businesses the honest answer is not a web form, which is what most tools assume.
A card at the registration counter, a QR poster, and a receptionist explaining it in Hindi.
A sign-up flow, a marketing list someone built two years ago, and analytics nobody has audited.
A candidate agreeing to a background check, and an employee opting into a wellness programme.
It captures agreement. The Act asks for six more things, and the difference only shows up when somebody asks.
A consent you cannot evidence is, for enforcement purposes, a consent you never took.
Not a policy saying nobody will change it. A database constraint that refuses the change.
Every consent event — given, updated, withdrawn, erased — is written once. The
database blocks UPDATE and DELETE on the log outright. Not your
admin, not your developer, not us.
The evidence pack ships with a SHA-256 manifest, and the manifest hash is itself written into the log. Your auditor re-computes it independently — they do not have to take our word, or yours.
The audit screen has no edit control because the API has no edit route. An attempt to delete a record is refused and then itself logged as a security event.
Consent taken at a reception desk and consent taken on your website land in the same log, in the same shape.
Vanilla JavaScript, zero dependencies, against a 15 KB budget the build fails if it exceeds. It will not slow your page down, and it does not drag a framework onto it. If the network drops mid-capture it queues the event encrypted in the browser and retries, so a bad connection does not become a missing record.
Uploading ten thousand contacts creates ten thousand consent requests, not ten thousand consents. That is §6 — consent has to be given, and no import can give it on someone’s behalf. It is a deliberate limit, and it is the one that keeps the resulting records worth having.
Vetted by empanelled privacy counsel across industries, so the starting point is a reviewed document rather than a blank page.
Standalone, plain language, each purpose listed separately with the data it needs, third parties named, and the route to the Data Protection Board included — because Rule 3(c)(iii) requires it and most notices omit it.
Hindi, Tamil, Telugu, Kannada, Bengali, Marathi, Gujarati and English. Each version is held against the same notice, so they cannot drift apart when one is edited.
Optional purposes render switched off and cannot be pre-checked from anywhere. Mandatory processing under §7 renders as text with no toggle at all — because offering a choice that is not real is how a consent gets challenged.
Before a consent notice goes live it is checked against Rule 3 and §6 line by line — standalone, plain language, itemised purposes, named third parties, withdrawal as easy as giving, the Board complaint route, children’s provisions where §9 applies, and every placeholder resolved. Fail any required check and the publish button stays off. Your DPO does not have to catch it, because the system will not let it out.
§6(4) is one sentence and it is where most consent programmes fail an inspection.
Every data principal gets a private link to a branded portal. They see the purposes they agreed to, switch off any optional one, or withdraw everything at once. No login, no request form, no email to a shared inbox that nobody owns. The purposes you rely on under §7 are shown as information, and correctly cannot be switched off.
A withdrawal lands in a queue with the clock already running and a traffic light against it. Mark it processed and that becomes another entry in the log. If the person disputes how it was handled, it escalates into a grievance with the statutory 90-day clock from Rule 14(3) attached.
The free assessment scores consent, notice and rights separately and prices each gap against the Act’s Schedule. Five minutes, no login, yours to keep.
Capture is the easy half. These are the ones that surface months in, when the tool you chose has no answer.
Verifiable parental consent, with the Fourth Schedule exemptions applied — clinical care, education, crèche and transport are carved out, and a tool that does not know that will block treatment it should not.
Up to ₹200 CrSixty days before the birthday your DPO is alerted; thirty days before, the young adult is asked directly. On the day, the parental consent is archived, not deleted, and a thirty-day grace period runs before the record lapses.
Nobody else does thisRule 8(3) sets a one-year floor on the log, so erasing on withdrawal can itself be the breach. A 48-hour pre-erasure notice goes out first, legal holds always win, and inactivity erasure runs on its own schedule.
Up to ₹50 CrVendors are linked to the notices whose purposes they serve. When a data processing agreement lapses, sharing under those purposes is flagged as blocked — you stay accountable for them whether or not you noticed.
Up to ₹50 CrAny active notice that does not carry the cross-border clause is surfaced the moment a transfer outside India appears, rather than at the next audit.
Up to ₹50 CrA minor edit keeps existing consent valid. A material change to purposes does not, and the system says so — then runs the re-consent campaign to the right audience, excluding everyone who has already withdrawn.
The quiet one
Three honest comparisons for anyone weighing up a consent management platform. Each of these is good at something — just not at this.
Good at: web tracking consent, quickly.
It governs cookies on one website. DPDP consent covers every purpose you process personal data for, on every channel — a patient form, a call centre, a WhatsApp opt-in. The banner has no view of any of it.
Good at: GDPR, at scale, across many countries.
Built around GDPR’s structure and priced in dollars. It will not know Rule 3’s itemisation, the Fourth Schedule exemptions, Rule 8’s one-year floor, or that §7 processing must never be shown as a toggle.
Good at: being the system your team already lives in.
It stores a field. It does not store the notice text that was shown, keep an unalterable history, or produce evidence years later — and its consent field is editable by anyone with access, which is exactly the problem.
We are not asking you to replace any of them. We are asking where the record lives when someone questions it.
No implementation project, no professional-services quote, no six-week discovery.
Choose the template for your sector and purposes, fill in your details, and let the compliance check pass it. Copy the snippet.
Widget on the site, QR at reception, the portal link in your emails. Every one of them writing to the same log from the first record.
A pack with a manifest your auditor can verify independently — assembled from what actually happened, not written up afterwards.
No. Existing consent stays as it is; RuleExpert governs it from here on. Where a notice materially changes — new purposes, new recipients — consent for those purposes does need to be taken again, and the re-consent campaign does that to exactly the right audience, automatically excluding anyone who has already withdrawn. Where the change is minor, existing consent stays valid and the system says so rather than making you guess.
A first notice can be published and capturing the same afternoon: choose a vetted template, fill in your company details, let the compliance check pass it, paste one script tag. There is no implementation project and no professional-services quote. The longer work — mapping every purpose across every system — is worth doing, but it is not what stands between you and your first evidenced consent.
For the website, one script tag — a few minutes of someone’s time. QR codes, the rights portal and call-centre capture need no engineering at all. You would involve developers only to capture consent inside your own product through the API, and that is a normal REST integration rather than an SDK to learn.
Keep it. The two answer different questions: a cookie banner governs tracking on one website, while DPDP consent covers every purpose you process personal data for, on every channel. Worth knowing that the Act has no cookie-specific provision — cookies matter under DPDP only where they process personal data, and then it is ordinary §5 notice and §6 consent, which is exactly what this does.
You take them. The evidence pack is ordinary files — the audit log, the notices and their versions, withdrawal and grievance records, vendor coverage — with a SHA-256 manifest anyone can re-verify. It is built to be readable without our software, because evidence that only works inside one vendor’s product is not much use in front of the Board.
Because the database will not allow it. UPDATE and DELETE are
blocked on the consent log by a constraint, not by a policy or a permission setting —
so it holds for your administrators, your developers and for us. An attempt to delete is
refused and then logged as a security event. The evidence pack’s manifest hash is
written into the log itself, which is what lets a third party check the pack against the
record independently.
On infrastructure in India, data at rest and backups both. We hold the consent record itself, and the person in it is identified by a one-way SHA-256 hash rather than by name, email or phone number — even IP addresses are hashed. We are ISO 27001 certified.
No, and the distinction matters. “Consent Manager” is a defined role under the Act and Rule 4 — an entity registered with the Data Protection Board that acts on behalf of data principals. RuleExpert is a tool you operate as a Data Fiduciary to meet your own obligations. Anyone selling you software while calling themselves a Board-registered Consent Manager is worth a second question.
Three things, and most tools do only the first. It has to collect consent wherever your customers are, which for an Indian business is rarely a web form — a counter, a QR poster, WhatsApp, a call centre. It has to prove what was collected months later, which means a record your own team cannot quietly edit. And it has to act on a withdrawal, so that saying no actually stops the processing rather than setting a flag nobody reads. Most consent management tools do the first well and the other two barely at all — and consent management software that captures a tick and stores it in a table has given you a database, not a defence.
Real client quotes, attributed by role and sector — we never name a client.
Working across
Start with the free assessment, or have someone walk you through it with your purposes and your channels on the screen.
Thank you — we have it. Someone will reply by email, usually within one working day.
Nothing else is needed from you. If it is urgent, email tushar@ruleexpert.com and it will reach the same people.
RuleExpert