# FOCTTA - DPDP consent, data security and privacy compliance, made in India > FOCTTA runs consent, rights, breach response, data discovery, activity monitoring, detection and vendor risk for the DPDP Act 2023, with GDPR and CCPA. Hosted in India, or on your own server. Web page: https://foctta.com/ This Markdown copy has the same content as the web page. Built 2026-10-14. --- MADE IN INDIA DPDP · GDPR · CCPA # Show the Data Protection Board what you did, and when. Consent, data discovery, database monitoring and vendor risk for regulated Indian enterprises, from banks and insurers to NBFCs. Built for the DPDP Act, hosted in India or on your own server. [Book a demo](https://foctta.com/company) See it working - Hosted on AWS in Mumbai, or in your own cloud - Signed releases with an SBOM - Hash-chained audit trail - Notices in 23 languagesConsent सहमति সম্মতি ஒப்புதல் సమ్మతి संमती ಸಮ್ಮತಿ സമ്മതം સંમતિ ਸਹਿਮਤੀ ସମ୍ମତି رضامندی **Consent receipt** c09d…31b7 · notice v4 **Access request** Day 62 of 90 **Breach** CERT-In report due in 5h 12m Pause motion **New to DPDP?** India's data protection law in two minutes: who it covers, the key dates, the penalties. [Read the basics](https://foctta.com/dpdp-basics) [Free 12-lesson course, with a certificate to share](https://foctta.com/learn) [Glossary of terms](https://foctta.com/glossary) ## Start with the product your next audit will ask about. Consent, Discovery (DSPM), Activity (DAM), Detection (DDR) and TPRM are sold separately. Each works alone. FOCTTA Consent Privacy and consent governance Every consent a receipt. Every right on the clock. See how it works (https://foctta.com/consent) FOCTTA Discovery DSPM Data security posture management Find personal data wherever it hides. See how it works (https://foctta.com/discovery) FOCTTA Activity DAM Database activity monitoring Know who touched it, and if that was normal. See how it works (https://foctta.com/activity) FOCTTA Detection DDR Data detection and response A decision on every query, before it runs. See how it works (https://foctta.com/detection) FOCTTA TPRM Third-party risk management Every vendor scored, and every score explains itself. See how it works (https://foctta.com/tprm) [Training Academy](https://foctta.com/training) Phone and watch apps [DPDP readiness check](https://foctta.com/readiness) [Free gap assessment](https://foctta.com/company) Discovery (DSPM) finds the data. Activity (DAM) shows who reads it. Detection (DDR) decides who may. ### Connects to the systems you already run. Ready-made connectors, so the first integration is setup, not a project. 118 FOCTTA Consent Connector templates for CRM, email, marketing and ad platforms. Explore Consent (https://foctta.com/consent) 25+ FOCTTA Discovery (DSPM) Native scanners for databases, warehouses, cloud storage and SaaS. Explore Discovery (https://foctta.com/discovery) 7 FOCTTA Activity (DAM) Activity sources: PostgreSQL, SQL Server, Oracle, Snowflake, BigQuery, AWS CloudTrail and a SQL proxy. Explore Activity (https://foctta.com/activity) 3 FOCTTA Detection (DDR) Alert destinations: Splunk, Microsoft Sentinel and any webhook. Guards PostgreSQL queries inline. Explore Detection (https://foctta.com/detection) 34 FOCTTA TPRM Integrations for the tools your vendor reviews already use. Explore TPRM (https://foctta.com/tprm) Legacy systems too. Discovery (DSPM) reads IBM i (AS/400) Db2 databases and COBOL copybook mainframe extracts, alongside the modern stack. See Discovery (https://foctta.com/discovery) See it working ## One console. Every role. Consent Rights Discovery Vendors Training Pause app.foctta.com/consents Illustrative data FOCTTA Overview Consents Notices Rights Breach Assessments Discovery Vendors Training Reports Consent ledger Retail business unit · all purposes Export proof Active consents 1,24,806 Receipts today 8,430 Withdrawn this month 1,212 Languages served 14 Data principal Purpose Status Notice Language Receipt p\_8a3f…c7d2 Offers and updates Withdrawn v4 हिन्दी c09d…31b7 p\_41b0…9e12 Improve the service Granted v4 தமிழ் a7b3…f2e1 p\_7c22…04aa Credit bureau sharing Granted v4 English 4f1e…88c0 p\_19de…b3f5 Offers and updates Declined v4 বাংলা 9c1d…2a7e p\_0e7a…6d19 Location for fraud checks Expiring v3 मराठी 5b92…e0d4 p\_c3f8…1a60 Guardian consent (minor) Granted v4 ಕನ್ನಡ e81c…7f33 **Access request** RQ-2419 · s.11 Rights portal DPDP · 90 days **Day 62** Identity verified **Correction** RQ-2433 · s.12 Email DPDP · 90 days **Day 71** Re-KYC routing **Erasure** RQ-2440 · s.12 Rights portal DPDP · 90 days **Day 12** Awaiting approval **Grievance** GR-0318 · s.13 Complaint form DPDP · 90 days **Day 83** Escalated to DPO **Nomination** RQ-2451 · s.14 Rights portal DPDP · 90 days **Day 5** Both parties confirmed **GDPR access** RQ-2455 · Art. 15 Email GDPR · 30 days **Day 18** In progress Where What Records Consent coverage crm.customers Aadhaar numbers 48,210 **92%** s3://kyc-archive PAN card scans 12,604 **71%** \\\\fs01\\hr\\ Salary slips 3,118 **100%** crm.students Dates of birthChild 9,402 **38%** laptop · FIN-114 Bank statements 216 **0%** sharepoint · Sales Phone numbers 22,870 **84%** Scanning 42 data stores Only masked metadata leaves your network. Vendor Tier Band DPA Next review **Cloud payments processor** Tier 1 B Active 14 Oct 2026 **KYC verification provider** Tier 1 A Active 02 Dec 2026 **SMS and WhatsApp gateway** Tier 2 B Expires in 30 days 23 Oct 2026 **Call centre partner** Tier 1 C Missing Overdue **Analytics SaaS** Tier 3 A Active 11 Jan 2027 **Document storage** Tier 2 A Active 30 Nov 2026 Why band B 1 Processes customer personal data DPDP s.8(2) 2 Stores data outside India RBI Outsourcing 2025 3 Encryption evidence verified ISO 27001 A.8.24 Same inputs, same band. Second approver required. **86%** completed Overdue learners get a reminder automatically. **DPDPA fundamentals** 94% **Children's data, Section 9** 88% **Breach response, Rule 7** 81% **Handling rights requests** 77% **Consent done right** 64% Certificate issued **Ananya Rao** Children's data, Section 9 · 92% Signed by your DPO Add to LinkedIn Verify Withdrawal applied on every server Receipt issued · notice v4 [Explore Consent](https://foctta.com/consent) Why FOCTTA ## 36 details an Indian auditor will ask about, already built. DPDP Act Consent Data security Evidence Enterprise India Screens, clocks and citations follow the Act and the Rules, including the duties most tools leave to a spreadsheet. Complete privacy notices A notice can't publish without your name and complaint route. DPDP S.5 **FOCTTA Consent**A DPDP notice cannot publish without the fiduciary name and the route to complain to the Data Protection Board. Auto-erase dormant accounts Find inactive users, warn them 48 hours ahead, then erase. Third Schedule **FOCTTA Consent**Dormant users found for e-commerce, social media and gaming, a 48-hour notice by WhatsApp, SMS or email, then erasure. Duties for large data holders Yearly DPIA, audit and board sign-off in one tracked flow. SDF · Rule 13 **FOCTTA Consent**Annual DPIA with the Rule 13(3) algorithmic step, auditor attestation, board sign-off and the Rule 13(2) bundle. Safe nominee requests One-time codes for both people and a hold stop fake claims. DPDP S.14 **FOCTTA Consent**One-time codes for both parties, a cooling-off hold, and a waiver only by two different approvers. "What data do you hold?" One secure download, Aadhaar and PAN masked, legal holds respected. DPDP S.11 **FOCTTA Consent**No-tipping-off holds, Aadhaar and PAN masking, and a ZIP with a manifest, checksums and a certificate. Every breach deadline, one screen CERT-In, RBI, SEBI and IRDAI clocks tracked side by side. 6 h · 72 h **FOCTTA Consent**CERT-In, RBI and SEBI within 6 hours of detection, with IRDAI copied and a SEBI portal report at 24 hours. From May 2027, DPDP adds the Board and affected people told without delay, and a detailed Board report within 72 hours. Consent that a regulator can check, for every brand in the group, in every language your customers read. Proof of a "no" too A declined purpose gets its own record and receipt. **FOCTTA Consent**A declined purpose is its own record, with its own receipt, so you can prove a no as well as a yes. No lost consent clicks Choices retry offline for up to 7 days, and never duplicate. **FOCTTA Consent**Choices retry and queue offline for up to 7 days, and duplicates never create a second record. 23 Indian languages Banners and preference centres in English and all 22 scheduled languages. **FOCTTA Consent**Banners and preference centres in 23 languages, detected from the page. One tag for every brand Each group company keeps its own consents; withdrawals don't cross over. **FOCTTA Consent**The brand is recognised from the page domain, and a withdrawal never crosses to another company unless the person asks. Old consents keep their dates Migrated records keep original dates; external feeds sync every 5 minutes. New in 2.1 **FOCTTA Consent**Migrated consents keep their original date and import batch, and external consent feeds arrive every 5 minutes. Vendors confirm erasure easily Each processor confirms deletion through a secure link, no account. **FOCTTA Consent**Each processor confirms erasure through a secure link. No account, no chasing by email. Find, watch and guard sensitive data without handing over passwords or slowing production down. Scan without sharing passwords Upload a schema, or run scanners that keep credentials on your servers. **FOCTTA Discovery (DSPM)**Upload a schema and FOCTTA classifies from structure. When scanners connect, credentials stay on your host. Reads PDFs and scans PDF, Word and Excel, scan errors fixed, unreadable files reported. **FOCTTA Discovery (DSPM)**PDF, Word and Excel files, common OCR misreads repaired, and a report of every file it could not read. Finds forgotten data stores Cloud accounts, asset lists and network sweeps, merged into one inventory. **FOCTTA Discovery (DSPM)**Cloud accounts, CMDB, directory, DNS sweeps and Kubernetes, merged into one inventory with owners. Look back to any date Snapshots show your data risk on any past date, for audits. **FOCTTA Discovery (DSPM)**Snapshots of the whole posture, and a diff between any two dates, for the audit you did not see coming. Sensitive fields masked live Queries are rewritten so the database returns masked values. PostgreSQL **FOCTTA Detection (DDR)**The gateway rewrites the query so the database returns masked values, and blocks a query it cannot mask safely. Spots misused app accounts Learns each application's normal queries, so misuse stands out. **FOCTTA Activity (DAM)**Each application's normal query pattern is learned, so a misused service account stands out. Proof you can hand to an auditor, from a product that never shows green while doing nothing. A receipt for every change A tamper-evident audit trail, and one-click proof of any consent. **FOCTTA Consent**A hash-chained audit trail, and one-click proof of every consent a person gave. Audit-ready evidence packs Signed packs for DPDP, SEBI CSCRF, GDPR and CCPA audits. Pilot **FOCTTA Discovery (DSPM)**DPDPA, SEBI CSCRF, GDPR and CCPA packs with a signed manifest. What FOCTTA stores, listed Every table and column FOCTTA keeps is documented, exportable as PDF. New in 2.1 **FOCTTA Consent**Every table and column FOCTTA keeps is described, and exportable as a PDF. No false "zero affected" Unknown impact reads "not yet established" in regulator drafts, never 0. **FOCTTA Detection (DDR)**An unknown number of affected people reads "not yet established" in a regulator draft, never 0. One ID, block to ticket The same ID links the blocked query, audit trail and ticket. **FOCTTA Detection (DDR)**The same ID in the blocked query, the decision, the audit chain and the ticket, with a "why was I blocked?" page. Certificates anyone can verify DPO-signed training certificates, with a public verification page. **Training Academy**Training certificates signed by your DPO, with a public verification page and Open Badges 3.0 data. Separation of duties, second approvers and explanations, because a bank will ask for all three. Two approvers for risky steps Destructive response steps need two different people, enforced on the server. **FOCTTA Detection (DDR)**Destructive playbook steps need two different approvers, enforced on the server. Controlled emergency access Needs a written reason, a time limit and two approvers. **FOCTTA Detection (DDR)**Emergency access needs a written reason, a 15 to 240 minute limit and two approvers, and ends with a summary. Vendor scores with reasons Each risk band cites the rule behind it; same inputs, same band. **FOCTTA TPRM**Every band cites the rule and clause behind it. Same inputs, same band, and a second approver on each step. No-login vendor questionnaires Vendors answer through a secure link: no licence, no password. **FOCTTA TPRM**Vendors answer through a portal link. No licence, no password, no friction. Directory health check 19 read-only checks on your Active Directory, scored 0 to 100. **FOCTTA Consent**19 read-only checks on your directory, scored from 0 to 100. Roles that split duties 8 roles and 144 permissions, custom roles, single sign-on and MFA. **FOCTTA Consent**8 roles and 144 permissions, custom roles, SSO, SCIM and MFA. Designed, built and hosted in India, and able to run inside your own walls. Hosted in India A dedicated database for each organisation by default. **Deployment**A dedicated database per organisation by default. Your own PostgreSQL FOCTTA runs on your database and never hosts your data. **Deployment**FOCTTA connects to and migrates your database. It never hosts your data. On your own server Linux or Windows Server, signed releases, nothing sent to FOCTTA. **Deployment**Linux or Windows Server, signed releases, an SBOM, and nothing sent to FOCTTA by default. Buy one product, or all Five products that work alone, and better together. **Product line**Consent, Discovery (DSPM), Activity (DAM), Detection (DDR) and TPRM work alone, and better together. DPO phone and watch app Android and Wear OS apps that work offline too. Pilot **Android and Wear OS**An Android app and a Wear OS tile and watch-face complication, with an offline queue. Accessible banners by default Brand colours that fail contrast rules are held for review. **FOCTTA Consent**Brand colours that fail WCAG AA are held until someone acknowledges them, citing RPwD s.46. Free · 12 questions · 3 minutes ## How ready are you for May 2027? [Take the check](https://foctta.com/readiness) [Book a demo](https://foctta.com/company) Question 3 of 12 · S.6(4) **Is withdrawing as easy as giving consent?** Yes Partly Not yet ## Built in India, for Indian law, in English and all 22 scheduled languages. India Hosted in India The hosted service runs on servers in India. 23 Languages English and all 22 scheduled Indian languages. DPDP Built on the Act Screens and clocks follow the Act, section by section. GDPR · CCPA Ready abroad Notices and request clocks for Europe and California too. ## Three laws. Six sector overlays. IN DPDP Act 2023 and Rules 2025 Up to ₹250 crore What FOCTTA covers IN · WHAT FOCTTA COVERS Notices with the Board complaint route Rights under Sections 11 to 14 Children's data, Section 9 SDF duties under Rule 13 EU GDPR Up to €20 million or 4% What FOCTTA covers EU · WHAT FOCTTA COVERS Geo-aware notices for EU visitors 30-day request clock, 60-day extension Article 28 DPA clause checklist Breach clock of 72 hours US CCPA and CPRA Per-violation fines What FOCTTA covers US · WHAT FOCTTA COVERS Geo-aware notices for US visitors CCPA DPA clauses for service providers 45-day clocks on requests your team logs Switched on when you need it **RBI** 6h incident clock, DAKSH **SEBI** CSCRF 6h notice, 24h portal **IRDAI** 6h copy, record retention **CERT-In** 6h reporting **PMLA** 5-year hold, no tipping off **RPwD** WCAG AA contrast check The life of one consent ## Every tap on the banner becomes a receipt, chained to the one before. Notice in their language Versioned, with the Board complaint route. DPDP S.5 A choice becomes a receipt Refusals are recorded too. DPDP S.6 Systems ask before use Every system checks consent before using data. DPDP S.4 They withdraw consent Applied on every server at once. DPDP S.6(4) Their data is locked Masked or blocked, with FOCTTA Detection (DDR). DPDP S.6(6) Erased, or kept by law Each erasure decided by rule, with a certificate. DPDP S.8(7) Proof in one click A tamper-evident trail and a receipt for each choice. DPDP S.6(10) 23 Languages 181 Industry packs 58 Assessment templates 346 Webhook events 6 Training courses ## Hosted in India, or on your own server. [Deployment](https://foctta.com/deployment) FOCTTA cloud, in India On AWS in Mumbai, dedicated database by default. Shared and isolated One shared database, each organisation walled off. Fastest start. Your own PostgreSQL We connect to it. We never host your data. Your server or cloud On-premise, or your AWS, Azure or Google Cloud account. Android and Wear OS Pilot · not on an app store yet ## The DPO's day, on your wrist. Report a breach Breach intake on the phone, with every regulator clock. Sign off assessments Review and approve DPIAs away from your desk. Rights and grievances Every queue with its clock. Alerts that reach you Push notifications, mirrored to the watch. Compliance on your watch Score, breaches, rights and DPIAs at a glance. Acknowledge from the wrist Escalations acknowledged even offline, synced later. **9:41** **FOCTTA** Retail · DPO **82** **Compliance health** 3 items need you today **Breach · CERT-In** 4h 51m left Card data exposed in a test bucket **Grievance GR-0318** Day 83 of 90 **DPIA · loan app v2** awaits your sign-off Approve Review **Erasure RQ-2440** In progress **Notice v5 · 3 languages** Published Today Breach Rights Alerts Compliance **82** 1 breach · 4h 51m Acknowledge Pinned connection · device integrity checked May 2027 ## Most DPDP duties apply from May 2027. Find out which reach you first. The DPDP Rules were notified in November 2025; most duties apply 18 months later. [Book a demo](https://foctta.com/company) [Talk to us](https://foctta.com/company)