DPDP Act compliance, ready before 13 May 2027
ConsentKit gives Indian businesses the consent notices, consent records, data rights portal, breach reporting and deletion schedules the DPDP Act asks for. Add it to your website or app with one snippet or plugin.
- Notices in English and Indian languages
- Data stored in India
- WordPress, Laravel, Next.js
Sharma Coaching Centre asks for your consent
Choose what we may use your data for. You can change this anytime.
Three dates every Indian business should know
The DPDP Act passed in 2023. The Rules that make it enforceable were notified in November 2025, with an 18-month runway that ends next May. There is no size threshold and no grace period after it.
-
DPDP Rules notified. The Data Protection Board of India is set up and running.
Done -
Registration opens for Consent Managers, the platforms people can use to manage consent across businesses.
Next -
Full compliance. Notice, consent, security safeguards, breach reporting, data rights, retention and children’s data duties all apply at once.
Enforcement
The maximum penalty per instance for failing to protect personal data. Separate penalties apply for unreported breaches and for mishandling children’s data.
What the law asks, and how ConsentKit handles it
Each DPDP obligation maps to one part of ConsentKit. Switch on only what your business needs; everything writes to the same audit trail.
Tell people what you collect and why, before you collect it.Notice and consent, Sections 5 and 6
Consent notices
Itemised notices for each purpose, readable in English or Indian languages, with a timestamped consent record for every choice.
Withdrawing consent must be as easy as giving it.Withdrawal of consent, Section 6(4)
Preference centre
A link in every email, SMS and account page where people change or withdraw consent in one click. Your systems get a webhook the moment they do.
Let people see, correct and erase their data, and raise grievances.Rights of the data principal, Sections 11 to 14
Data rights portal
A branded request page with identity checks, due-date tracking and a reply trail, so no request is missed or answered late.
Report every personal data breach to the Board and to affected people.Breach intimation, Rule 7
Breach register
Log an incident and ConsentKit starts the 72-hour clock, drafts the report to the Board and prepares plain-language notices for affected users.
Delete data once its purpose is served.Retention and erasure, Rule 8
Retention scheduler
Set a retention period per purpose. ConsentKit sends the 48-hour notice before erasure where the Rules require it, and keeps a deletion record.
Get verifiable consent from a parent before processing a child’s data.Children’s data, Section 9 and Rule 10
Parental consent
Age gating and parent verification flows for schools, colleges, coaching centres and edtech apps that enrol students under 18.
Protect data with reasonable safeguards and keep logs for at least a year.Security safeguards, Rule 6
Audit trail and evidence export
Every consent, request and deletion is logged and retained. Export a dated evidence pack whenever an auditor or the Board asks.
Live on your site in three steps
No re-platforming. ConsentKit sits alongside the website, forms and apps you already run.
Take the readiness check
Answer questions about what data you collect and where. You get a gap report and a list of purposes to configure.
Add the snippet or plugin
Install the WordPress plugin, a Laravel or Next.js package, or paste one script tag. Your notices go live in the languages you pick.
Stay audit-ready
Requests, withdrawals, breaches and deletions run through one dashboard, with every action recorded for the Board.
DPDP compliance for your industry
A college, a clinic and an online store collect very different data. ConsentKit ships with purposes, notices and retention rules set up for each sector.
Colleges and universities
Admission records, parental consent for under-18 applicants, alumni lists.
Schools
Parent-verified consent for every student, photos, transport and fee data.
Coaching institutes
Lead forms, WhatsApp updates, result sharing and marketing calls.
Edtech platforms
App sign-ups, learning analytics and restrictions on tracking minors.
Hospitals
Patient records, insurer sharing, and access requests from patients and nominees.
Clinics and doctors
Appointment booking, prescriptions and reminder messages.
Diagnostic labs
Sample and report data, home collection, report delivery on WhatsApp.
E-commerce and D2C
Checkout, marketing consent, and erasure of inactive accounts.
Real estate developers
Site-visit leads, broker sharing, KYC and booking documents.
Banks, NBFCs and fintech
KYC, credit checks, recovery calls and sector-specific retention.
Insurance
Proposal forms, claims data and sharing with brokers and TPAs.
Hotels and travel
Guest ID copies, bookings and loyalty programme data.
HR and recruitment
Candidate CVs, background checks and employee records.
SaaS and IT services
Processor contracts, customer data and security safeguards.
Gyms and fitness studios
Member details, body measurements and trainer access.
Housing societies
Resident registers, visitor logs, CCTV and gate apps.
NGOs and trusts
Donor records, beneficiary data and volunteer details.
Restaurants and cafés
Table bookings, delivery orders and loyalty offers.
No match yet. Tell us your industry and we’ll set up the purposes with you.
One snippet, or a plugin for the stack you already use
Show notices, read consent before you fire a pixel or send a message, and get a webhook when someone withdraws. Built by a team that ships Laravel, Next.js and WordPress for a living.
- WordPress plugin
- Laravel package
- Next.js and React
- Shopify app
- REST API
- Webhooks
<!-- Add once, before </body> --> <script src="https://cdn.dpdpconsentkit.in/v1/kit.js" data-site="YOUR_SITE_KEY" data-languages="en,hi,bn" async></script>
// Only send WhatsApp updates with consent const ok = await ConsentKit.has('whatsapp_updates'); if (ok) sendClassUpdate(student); // React when someone withdraws ConsentKit.on('withdraw', (e) => { unsubscribe(e.principalId, e.purpose); });
// routes/web.php Route::post('/enquiry', EnquiryController::class) ->middleware('consent:admission_records'); // Record consent from your own form ConsentKit::record($user, ['admission_records', 'whatsapp_updates']);
DPDP compliance support across India
Software for every city, with onboarding help from our team in Kolkata. Pick your city for local guidance and sector examples.
Questions businesses are asking
Short answers here. Our DPDP Act guide goes into each obligation in detail.
When does the DPDP Act apply to my business?
The DPDP Rules were notified on 13 November 2025 with an 18-month rollout. Notice, consent, security, breach reporting, data principal rights and retention duties become enforceable on 13 May 2027.
Does the DPDP Act apply to small businesses?
Yes. There is no size threshold. Any business that collects digital personal data of people in India is a data fiduciary, whether it is a coaching centre, a clinic or an online store.
What are the penalties under the DPDP Act?
Penalties go up to ₹250 crore per instance for failing to take reasonable security safeguards, with separate penalties for failing to report breaches or meet obligations for children’s data.
Is ConsentKit a registered Consent Manager?
No. ConsentKit is consent management software that you run as the data fiduciary. Consent Managers are separate entities registered with the Data Protection Board. ConsentKit keeps records in a format that can work alongside them.
Is my existing cookie banner enough?
Usually not. DPDP needs an itemised notice for each purpose, an option to read it in English or a scheduled Indian language, withdrawal that is as easy as giving consent, and a record you can produce as evidence.
Find out where you stand today
The readiness check takes about ten minutes and gives you a gap report you can act on, whether or not you use ConsentKit.