# FOCTTA Consent - DPDP consent management, rights requests and breach response > Consent and cookie banners in 23 languages, rights requests with statutory clocks, breach timelines, DPIAs, ROPA and a hash-chained audit trail, built for the DPDP Act and Rules 2025. Web page: https://foctta.com/consent This Markdown copy has the same content as the web page. Built 2026-10-14. --- FOCTTA CONSENT DPDP Act 2023 and Rules 2025, section by section # Consent you can prove. Withdrawal you can enforce. FOCTTA Consent is consent management software for India's DPDP Act : it collects and proves consent, handles data rights requests and tracks breach deadlines. In English and all 22 scheduled languages, and ready for GDPR and CCPA. [Book a demo](https://foctta.com/company) Follow one consent, step by step **Made in India, for India** Hosted in India Consent, in every scheduled language Consent सहमति সম্মতি ஒப்புதல் సమ్మతి संमती ಸಮ್ಮತಿ സമ്മതം સંમતિ ਸਹਿਮਤੀ ସମ୍ମତି رضامندی Consent receipt issued hash-chained · tamper-evident Purpose withdrawn. Query blocked. At the database, with FOCTTA Detection (DDR) Data access request S.11 · day 62 of 90, on track Languages English plus 22 Indian languages Industry packs 1,229 ready-made purposes Assessment templates Ready-made privacy risk assessments DPIA · PIA · TIA System event types Signed updates to your other systems Webhooks Regulator clocks Breach reporting deadlines, tracked together CERT-In · RBI · SEBI · IRDAI · Board The life of one consent ## From a tap on a banner to a receipt you can show the Board. 01A notice in their language 02A choice becomes a receipt 03Systems ask before they use data 04They change their mind 05Checked at the database 06Erased, or lawfully kept 07Proof you can show the Board Notice S.5 · Rule 3 The banner speaks their language and names who to complain to. Language Tamil · தமிழ் Notice version v4 · published Complaint route Data Protection Board A DPDPA notice cannot be published without the fiduciary name and the Board complaint route. Consent S.6 · S.6(10) Every choice, including a refusal, is its own record with a receipt. Offers and updates declined · receipt Improve the service granted · receipt Receipt a7b3…f2e1 · notice v4 Clicks retry and queue offline for up to 7 days, and duplicates never create a second record. Consent check S.4 Any system can ask "may I?" and get the current answer. crm.campaigns purpose: marketing → no app.analytics purpose: service → yes Change feed webhook delivered · signed 346 signed event types reach your systems, with a delivery log. Withdrawal S.6(4) · S.6(6) Withdrawal is as easy as giving, and it lands everywhere at once. Cached "yes" answers retired on every server Downstream systems withdrawal event sent Live database sessions ended Ending live database sessions needs FOCTTA Detection (DDR) in the data path. With FOCTTA Detection (DDR) Enforcement S.6(6) · S.8(7) A query for a purpose without consent is masked or blocked, with a reason. SELECT name, pan … masked · purpose not consented SELECT \* FROM kyc … blocked · BLK-7F2C SELECT plan, city … allowed Allow, mask a column or block, through the FOCTTA Detection (DDR) gateway on PostgreSQL. With FOCTTA Detection (DDR) Erasure S.12 · S.8(7) A legal decision tree erases what it should and keeps what the law requires. Marketing CRM erased · flagged Loan ledger retained · tax law citation Processor confirmed by link Flag-and-suppress by default, hard delete only if you opt in, with a certificate anyone can verify. Evidence S.6(10) Prove what this person agreed to, and when, in one click. Audit chain verified · unbroken Consent history 3 receipts · notice v3 → v4 Evidence pack DPDPA · signed manifest Hash-chained audit events, receipts on every consent, and a verification page for certificates. **Built on the Act, not adapted to it** Every screen, clock and citation is organised the way the DPDP Act 2023 and the 2025 Rules are written. ## Pick a section. See what FOCTTA does for it. Each section of the DPDP Act sets a duty. Pick one to see what the law asks and how FOCTTA helps. Notice S.5 Consent S.6 Legitimate uses S.7 Processors S.8(2) Breach S.8(6) Erasure S.8(7) Inactivity S.8(8) Children S.9 Extra duties S.10 Access S.11 Correction S.12 Grievance S.13 Nomination S.14 Cross-border S.16 Rights portal R.14 The Board S.27 S.5 · Notice **The Act asks:** An itemised notice before or with the consent request, with how to withdraw and complain. Versioned notices that cannot publish without the complaint route. Every consent stamped with the notice in force Served by country, language and brand Re-consent when the notice changes S.6 · Consent **The Act asks:** Free, specific, informed and unambiguous consent, and withdrawal as easy as giving it. A consent ledger that proves yes, proves no, and enforces withdrawal. One record per person, purpose and business unit Refusals recorded as evidence Withdrawal applied on every server at once S.7 · Legitimate uses **The Act asks:** Processing without consent only for the uses the Act lists. The lawful basis is on every record, and the DPIA reads it. Deemed consent and legitimate uses recorded as the basis Assessments conclude from the recorded basis, never a guess S.8(2) · Processors **The Act asks:** Processors engaged only under a valid contract. Sharing consent is refused without an active processing contract (DPA). Processor register with DPA status and expiry Alerts at 180, 90, 60, 30, 14 and 0 days DPA clause checklist for DPDPA, GDPR and CCPA S.8(6) · Personal data breach **The Act asks:** Inform the Board and each affected person of a breach. Parallel regulator clocks from the moment you know. CERT-In, RBI, SEBI 6h; IRDAI copy; Board from May 2027 Blast radius matched to your data map Board breach report and a drafted action plan S.8(7) · Erasure **The Act asks:** Erase when consent is withdrawn or the purpose is served, unless law requires retention. A legal decision tree for every system, with a certificate. Retention reasons from a catalogue of 11 laws Legal hold respected Processors confirm erasure by secure link S.8(8) · Erasing inactive accounts (Third Schedule) **The Act asks:** Erase after the prescribed inactivity, with a 48-hour notice first. The 48-hour notice by WhatsApp, SMS or email, then erasure. Dormant users found for the Third Schedule classes Legal hold respected Switched on per organisation S.9 · Children's data **The Act asks:** Verifiable guardian consent, and no tracking or targeted ads at children. Tracking blocked for children, even when they tap Accept All. Child-directed mode and an under-18 choice in the banner Guardian details required and encrypted Children's data makes a DPIA mandatory S.10 · Significant Data Fiduciary **The Act asks:** A DPO in India, independent audit, periodic DPIA and algorithmic due diligence. The extra duties of a Significant Data Fiduciary, as one governed chain. Annual DPIA with the Rule 13(3) algorithmic step Independent auditor attestation and board sign-off Rule 13(2) submission bundle S.11 · Right to access **The Act asks:** A summary of the data, the processing and who it was shared with. An access package with India-aware redaction. No tipping off, Aadhaar and PAN masking ZIP with manifest, checksums and certificate Opened behind a one-time code S.12 · Correction and erasure **The Act asks:** Correct, complete, update or erase on request. Correction fanned out to every system, with rollback. Re-KYC routing for hard fields Correction certificate Credit-information compensation accrual S.13 · Grievance redressal **The Act asks:** An effective grievance mechanism within the prescribed period. A 12-state workflow on the 90-day clock. Public complaint form with 13 categories Warnings at 50, 75 and 90 percent Board escalation packet after redressal is exhausted S.14 · Right to nominate **The Act asks:** Let a person nominate someone to act for them. Nomination with two-party confirmation and a cooling-off hold. One-time codes for both parties A waiver only by two different approvers DPO approval S.16 · Cross-border transfer **The Act asks:** Transfers restricted only to countries the government notifies. Transfer country and safeguards on every vendor. Per-vendor transfer records A cross-border register in the evidence pack, with Discovery (DSPM) R.14 · Publishing how to exercise rights **The Act asks:** Publish how to exercise rights and which identifiers are needed. A rights portal builder per business unit. Identifier sets under Rule 14(5) Identity-check floors that rise for BFSI and children English and Hindi portal text today S.27 · Complaints to the Board **The Act asks:** A person may complain to the Data Protection Board. The Board complaint link on every banner and notice. Tamper-evident escalation packet The person records their Board filing reference 16 capability areas ## Notices, consents, rights requests, breaches and DPIAs in one console. Pick an area to see what FOCTTA Consent does in it. An orange tag marks a stated limit. Consent records Cookie banner Privacy notices Group companies Importing consents People's data rights Erasing dormant accounts Children's data Breach response Risk assessments Data map and register Vendors and contracts Audit and evidence Workflows and alerts Sign-in and access Reports and branding S.4 · S.6 · S.6(10) Prove exactly what each person agreed to, and that they said no when they did. **One record per purpose**: Each purpose a person agrees to is recorded separately. Per person, purpose, regulation and business unit, with lawful basis and notice version. **Refusals as evidence** A "no" gets its own record and receipt too. **Expiry and renewal**: Consents expire after 12 months by default, with reminders. Alerts at 30, 7 and 2 days. **Withdrawal everywhere** A withdrawal retires saved "yes" answers on every server at once. **38 consent templates**: Ready-made consent forms for 21 industries, plus a generic set. Including a minor-and-guardian template. **Consent by email link** Collect consent from people who never visit your website. Add-on S.5(3) · S.6 A compliant banner in every Indian language whose choices become provable consent. **23 languages** English and all 22 scheduled languages, picked from the page. **Google Consent Mode v2**: Google tools start as "denied" until the visitor chooses. Default-denied state and updates, with region defaults. **No lost choices** Choices retry and wait offline for up to 7 days. **Banner Builder**: Design the banner with live desktop, tablet and phone previews. Publish and archive versions. **Cookie scanner**: Find the cookies your website sets, quickly or in depth. Instant check plus a deep crawl in a real browser. **Child-directed mode**: Blocks tracking for children, even after Accept All. With a Section 9 notice. S.5 · Rule 3 The right notice, in the right language, for the right brand, every version kept. **Versioned notices**: Every edit is saved as a new version, never overwritten. Each version is immutable and carries a change summary. **Complete notices only** Won't publish without your organisation's name and the Board complaint route. DPDP S.5 **Served by country and brand**: Each visitor sees the right law's notice and the right brand. India to DPDPA, EU to GDPR, US to CCPA, brand from the domain. **Re-consent campaigns**: Ask people to renew consent when the notice changes. Move consents under an older notice to renewal in one click. **Embeddable consent form** Turn any web form into a DPDP notice with a purposes table. English text Business units Run a whole group on one platform. Each company keeps its own consents. **One tag, many brands** One website snippet recognises each brand from its domain. **Settings per company** Keys and system connections are bound to one company. API keys · webhooks New in 2.1 **Withdrawals never cross** A withdrawal moves to another company only by the person's audited choice. New in 2.1 **Roles per company** Members and permissions set per company, checked on the server. Day one history Bring years of consents across with their true dates and withdrawals intact. **Bulk import with dry run** Import past consents after a test run; each row gets a receipt. Enterprise and BFSI **Migrated consents say so** Imported consents keep their original date and import batch. New in 2.1 **External consent feeds New in 2.1**: Consents from your other systems arrive every 5 minutes. For example from an eKYC platform. S.11 · S.12 · S.13 · S.14 Every right in the Act with its own queue, clock, identity check and evidence. **A copy of their data S.11**: Give people a secure copy of what you hold on them. India-aware redaction, a ZIP with manifest and certificate. **Corrections S.12**: Correct a person's data in every system, with rollback. Re-KYC routing for hard fields. **Erasure requests S.12**: Erase what should go, and keep what the law requires. A legal decision tree decides for each system. **Complaints S.13**: Handle complaints within the 90-day clock the Rules allow. 13 categories and a 12-state workflow. **Nominees S.14**: Let a person name someone to act for them, safely. Two-party confirmation and a cooling-off hold. **Rights portal English and Hindi**: A page on your website where people make requests. Embeddable, with a builder per business unit. Third Schedule · S.8(8) · Rule 8 One of the Rules' most specific duties, handled end to end. **Inactive users found** Finds inactive users on e-commerce, social media and gaming platforms. Third Schedule **Warning before erasure** A 48-hour notice by WhatsApp, SMS or email first. **Legal hold respected** Held records are kept; erasure is off until you switch it on. S.9 · Rule 10 · Rule 11 Children's data flagged, protected from tracking and escalated wherever it appears. **Tracking blocked** Child-directed mode and an under-18 choice in the banner. **Guardian details**: A parent's details are required for a child's consent. Stored encrypted. **Breaches flagged critical** A breach with children's data is critical from the start. **Staff course on children** A course with quiz and certificate in the Training Academy. S.9 S.8(6) · Rule 7 From first report to regulator filing, every clock visible and the plan drafted. **Every deadline at once 72 h · 6 h**: All regulator reporting deadlines run side by side. CERT-In, RBI and SEBI within 6 hours of detection, IRDAI copied; the DPDP Board duty from May 2027. **Who is affected** Worked out from your data map and consent records. Best with Discovery (DSPM) **Action plan** Drafted for the board and regulators, never filed on its own. **Board breach report** An eight-section PDF for the Data Protection Board. DPIA · SDF · S.10 · Rule 13 Assessments that follow the Act and leave tamper-evident evidence. **58 assessment templates** Ready-made privacy risk assessments, 44 made for specific industries. DPIA · PIA · TIA **Extra duties, one chain SDF · Rule 13**: Yearly assessment, auditor sign-off and board approval, in one tracked flow. For a Significant Data Fiduciary: annual DPIA, auditor attestation, board sign-off and the Rule 13(2) bundle. **Risk register**: Log privacy risks and score them on a matrix. 3x3 to 5x5 matrices with a signed lock. **Tamper-evident report**: A PDF anyone can check has not been altered. It carries a fingerprint and a verify endpoint. ROPA · records of processing A register that draws itself, and shows where declaration and reality differ. **181 industry packs**: Ready-made data, purpose and clause lists for your industry. 2,570 data elements, 1,229 purposes and 1,577 clauses. **Diagram import and export**: Move data-flow diagrams in and out of common tools. draw.io, Mermaid and Graphviz. **Bulk import** Load up to 10,000 rows, with a test run first. **Declared versus discovered Needs Discovery (DSPM)**: Compare what you declared with what FOCTTA Discovery (DSPM) finds. Children's data flagged first. S.8(2) · DPA Know every vendor that handles your data, and share only under a valid contract. **Vendor register**: Every vendor handling your data, with its contract status. DPA status, transfer country and safeguards. **Expiry alerts**: Reminders before a vendor contract runs out. At 180, 90, 60, 30, 14 and 0 days. **Contract clause checklist DPA**: Check each vendor contract has the clauses each law needs. 10 DPDPA, 12 GDPR and 8 CCPA clauses. **No contract, no sharing** Consent to share is refused without an active vendor contract. DPA S.6(10) Evidence a regulator can verify, and transparency about FOCTTA itself. **Tamper-evident audit trail** Every change gets a receipt, and any later edit shows. Hash-chained **Proof per person** Everything one person agreed to, in one click. **"What FOCTTA stores" New in 2.1**: A plain list of every table and column FOCTTA keeps. Exportable as a PDF. **Logs to security tools SIEM**: Forward audit events to your security monitoring system. QRadar and Splunk push, or a pull key. Automation Any event can start a workflow, and the right person hears in time. **Visual workflow designer** Draw workflows from email, webhook, event and breach steps. Some actions coming **Two-person approval** Ordered approvals before any correction or erasure. Maker-checker **WhatsApp and SMS**: Message people through 15 India-ready providers. DLT enforced. **Slack, Teams, PagerDuty** Alerts in the tools your team uses, with timed escalation. Administration Enterprise sign-in and separation of duties from day one. **Company sign-in SSO · SCIM**: Staff sign in with company accounts, added and removed automatically. SAML 2.0, OIDC and SCIM 2.0 provisioning. **Two-step sign-in** A code from an app, with backup codes and session control. MFA · TOTP **8 roles, 144 permissions**: Give each person only the access they need. Plus custom roles. **Directory health check** 19 read-only checks on your directory, scored 0 to 100. Active Directory Board-ready The DPO's day in one queue, and your brand on every public surface. **Approval queue** Everything waiting for the signed-in approver, in one list. DPO My Queue **Board report** A report for your board, with DPDP penalty exposure. **Your brand, pulled in** Colours, fonts and logo taken from your website. **Accessibility guard**: Hard-to-read colours are held until someone acknowledges them. Checked against WCAG AA contrast. Breach management · S.8(6) · Rule 7 ## One incident. Every regulator clock, from the moment you know. After a personal data breach, each regulator has its own reporting deadline. FOCTTA tracks every one that applies. Your sector's clocks Deadlines for your sector, counted from the moment you know. Breach scope What a breach reached, matched to your data map. Action plan drafted A plan for the board and regulators, never filed on its own. Board breach report, eight sections Escalation to every data protection officer Children's data escalates to critical 6 hours CERT-In 6 hours RBI (DAKSH) 6 hours SEBI, portal 24h 6 hours IRDAI (CERT-In copy) 72 hours Board, from May 2027 For groups of companies ## One platform for the whole group. Each company keeps its own consents. One tag, every brand One website snippet recognises each brand from its domain. **Keys and notices stay put** Keys, webhooks, notices and preference centres stay with their company. Withdrawals never cross It stays with its company unless the person asks. Evidence, not assertions ## Every change leaves a receipt, chained to the one before. Each record is linked to the one before it, so any later change shows. That is proof a regulator can check. Tamper-evident audit trail A receipt for every change, and any later edit shows. Hash-chained Proof per person Show everything one person agreed to, in one click. **Signed evidence packs** With FOCTTA Discovery (DSPM): packs for DPDPA, SEBI CSCRF, GDPR and CCPA. Accessibility report (WCAG 2.2 AA) on request Company sign-in and two-step login Personal details encrypted Consent granted · marketing prev 9c1d… → a7b3… #846 Notice v4 published prev a7b3… → 4f1e… #847 Consent withdrawn · marketing prev 4f1e… → c09d… #848 Erasure certificate issued prev c09d… → 31b7… #849 India-first, by design ## Every notice and choice in English and all 22 scheduled languages. Designed and built in India Hosted in India, or on your own server. हिन्दी বাংলা తెలుగు मराठी தமிழ் اردو ગુજરાતી ಕನ್ನಡ ଓଡ଼ିଆ മലയാളം ਪੰਜਾਬੀ অসমীয়া हिन्दी বাংলা తెలుగు मराठी தமிழ் اردو ગુજરાતી ಕನ್ನಡ ଓଡ଼ିଆ മലയാളം ਪੰਜਾਬੀ অসমীয়া मैथिली संस्कृतम् कोंकणी नेपाली सिन्धी डोगरी कॉशुर ꯃꯩꯇꯩꯂꯣꯟ बड़ो ᱥᱟᱱᱛᱟᱲᱤ English हिन्दी मैथिली संस्कृतम् कोंकणी नेपाली सिन्धी डोगरी कॉशुर ꯃꯩꯇꯩꯂꯣꯟ बड़ो ᱥᱟᱱᱛᱟᱲᱤ English हिन्दी The DPDP timeline Penalties up to ₹250 crore per breach of duty 13 Nov 2025 Rules notified The Data Protection Board and definitions came into force. **Nov 2026 Consent Manager rules**: Rules begin for companies registered to manage people's consents. Consent Manager provisions start under Rule 4. The Board has not yet published how to apply. May 2027 Main obligations Notice, consent, security, breach reporting and rights apply. ## Add FOCTTA Detection (DDR) and consent is checked at the database. Stop a query that touches a withdrawn person, and find where personal data really lives with FOCTTA Discovery (DSPM). [See how Detection blocks a query](https://foctta.com/detection) [See how Discovery finds data](https://foctta.com/discovery) [Book a demo](https://foctta.com/company)