DPDP core obligations become mandatory in 2027
Be DPDP-ready — with proof.
India's DPDP Act asks one question your company must be able to answer: can you prove it? ProofKosh is the consent ledger, DSR desk and tamper-proof audit binder for Indian mid-market companies — live in days, from ₹25,000/month.
Data hosted in India · Append-only evidence log · No sales call required
See ProofKosh in 60 seconds
Consent in 8 languages, the tamper-evident ledger, statutory DSR deadlines, audit-ready reports and one-day integration — the complete platform in about a minute.
How it works — the full compliance loop
Capture → Evidence → Enforce → Respond → Prove: how one script tag becomes an audit binder, step by step.
What the DPDP Act actually requires
Every company processing Indians' personal data must show notice and take valid, purpose-specific consent; honour withdrawal as easily as consent was given; answer access, correction and erasure requests within statutory deadlines; and maintain the records to prove all of it — with penalties up to ₹250 crore. Your law firm can tell you this. What they can't give you is the running system.
ProofKosh is the running system.
Six modules. One evidence vault.
Everything writes to a single append-only, hash-chained log — so compliance and its proof can never disagree.
Consent Ledger
Every consent recorded with who, what purpose, when, which language, and against which notice version. Court-grade proof, not a cookie banner.
Consent-check API
One API call before every send: “is this user's consent valid for this purpose?” Your CRM and marketing tools physically cannot contact users who withdrew.
DSR Desk
A ready-made portal where users file access, correction and erasure requests — each on a statutory countdown that escalates before it can breach.
Notice Manager
Define purposes once; consent notices generate in the required languages. Change a notice and affected consents are re-collected automatically.
Audit Binder
One click assembles the evidence an auditor or the Data Protection Board would ask for — with a cryptographic chain any third party can verify.
Consent Widget
An 8KB embed for your website and app. Per-purpose choices, English + Indian languages, shows only when a decision is actually pending.
Works with the stack you already run
Download a ready-made plugin from your account — your key, portal link and brand settings already inside. Install in minutes, DPDP consent capture on every page.
Make the banner yours: pick your brand colour and position (bottom left, centre or right) once in Settings — every page picks it up instantly, and text stays readable on any colour automatically. Anything else speaks plain HTTPS: Zoho, HubSpot, ERPNext, or any database via the API and CSV import.
Anyone can show a consent popup.
We produce the evidence.
Every action in ProofKosh — a consent, a withdrawal, a notice change, an erasure request, even generating the audit binder itself — becomes a record in a hash-chained, append-only log. Nothing can be edited or deleted, by anyone, including us. When the Data Protection Board asks, your proof verifies itself.
- ✓ Append-only: rejected at the database level, even for administrators
- ✓ Hash-chained: altering any record breaks every hash after it
- ✓ Independently verifiable: auditors re-check the chain without trusting us
live evidence log
17:12:10 consent.grant principal:ravi-101 1f77a7e9…
17:12:11 consent.withdraw principal:ravi-101 d7278e85…
17:37:01 notice.published officer:priya 700035f3…
17:43:42 dsr.received principal:priya-2044 0fe3e632…
17:54:40 binder.generated officer:priya 062bdff3…
✓ chain verified — all events intact
Live in days, not quarters
- 1
Define your purposes
Marketing, analytics, whatever you process — as structured data, in minutes.
- 2
Drop in the widget & API
One script tag on your site; one API call in your tools. Consent starts recording — and enforcing.
- 3
Run compliance daily
DSR deadlines tracked, notices versioned, and the audit binder one click away. Forever.
DPDP questions, answered directly
When is the DPDP compliance deadline?
The DPDP Rules were notified on 14 November 2025. Core obligations for companies — consent notices, valid consent, and data-principal request handling — become mandatory around May 2027 (18 months from notification). Consent Manager registration and the Data Protection Board arrive around November 2026.
What are the penalties under the DPDP Act?
Up to ₹250 crore for failing to maintain reasonable security safeguards, up to ₹200 crore for breach-notification and children's-data violations, and up to ₹50 crore for other violations — per instance.
Does DPDP apply to companies outside India?
Yes. Section 3 applies to processing outside India when it is connected to offering goods or services to people in India. A US or Gulf company serving Indian users has the same obligations as an Indian one.
Is ProofKosh a registered Consent Manager?
No — and deliberately so. Consent Managers are separately regulated entities under the Act. ProofKosh is the operational system a data fiduciary (your company) runs to meet its own obligations: recording consent, enforcing it, handling requests, and producing evidence.
How is this different from OneTrust or a cookie-banner tool?
Cookie banners record a click. Enterprise suites cost ₹40–50 lakh a year and are built for global GDPR programs. ProofKosh is DPDP-first and evidence-first: a tamper-proof, hash-chained log underneath every action, a live enforcement API, and statutory DSR workflows — at a flat Indian mid-market price.
Find out where you stand — in 3 minutes
Ten questions. A score, your gaps, and exactly what to fix before the deadline. Free, no signup.
Take the DPDP Readiness Score