Consent Lifecycle Management
Capture, prove and honour consent across every channel — with a ledger that stands up when a regulator asks what someone actually agreed to.
What it does
Under the DPDP Act consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action. That is a high bar, and most consent banners do not clear it. The harder part is proving, months later, what a particular person agreed to and when.
dpflo keeps a pseudonymised consent ledger: every grant, change and withdrawal recorded against a purpose, with the notice version the person actually saw. Because the ledger is pseudonymised, the record of consent does not itself become a new pile of identifiable data to protect.
Withdrawal is treated as an event with consequences, not a checkbox. When someone withdraws, the module propagates it to downstream processors and collects their acknowledgements, then produces a signed timeline showing how long honouring took.
Capabilities
Pseudonymised consent ledger
Append-only record of every grant, change and withdrawal, tied to the purpose and the exact notice version shown.
Multi-channel preference centre
Web, kiosk, QR and SMS, in the languages the Eighth Schedule requires — so consent is collected the same way wherever someone meets you.
Purpose-based tracking
Consent is held per purpose, not per person, so withdrawing from marketing does not silently revoke what keeps the service running.
Withdrawal honouring with processor acknowledgements
Propagates withdrawal to downstream processors and records their acknowledgement, closing the loop you are accountable for.
Signed honouring-timeline evidence
A tamper-evident report showing when withdrawal was received and when each system acted — the document a regulator asks for.
Which duties this discharges
The obligations under the DPDP Act 2023 that this module is built to satisfy. The Act takes full effect on 13 May 2027.
- s.6(1)Consent must be free, specific, informed and unambiguous
- s.6(4)Withdrawal must be as easy as giving consent
- s.6(6)Cease processing within a reasonable time of withdrawal
- s.5Give an itemised notice, in the language the person chooses
Section references are to the Digital Personal Data Protection Act, 2023 and are provided for orientation, not as legal advice.
Works with
Data Principal Rights
Automate the rights a Data Principal is owed — access, correction, erasure, nomination and grievance — end to end, with signed proof.
Read moreGovernance, Records & Audit
The obligations that prove you are compliant — records, assessments, retention and audit integrity — kept current instead of rebuilt before each audit.
Read moreData Discovery & Classification
Find every piece of personal data you hold — across databases, cloud storage, SaaS apps and APIs — before you try to govern it.
Read moreSee Consent Lifecycle Management on your own data
A 30-minute walkthrough against the systems you actually run — not a generic demo environment.