Skip to content27% offProofmatch for ₹10,999 ₹14,999
CloneifyPro

Consentdesk · DPDP privacy and consent

Privacy and consent for India's DPDP Act and Rules: a notice in English and Indian languages, a consent banner and form (a parent's email code for under-18s), a receipt for every answer, a privacy page where people withdraw consent or ask to see, correct or erase their data, requests with deadlines, a 72-hour breach register, and a data map with vendors.

Consentdesk's home screen with a breach's 72-hour clock, the DPDP readiness score, requests by deadline and consents over 30 days
Privacy team

Home: readiness, deadlines and the 72-hour clock

1 / 6

What Consentdesk runs

  • A notice with purposes, data and retention, in English and the 22 Eighth Schedule languages, published as versions
  • A website banner and a consent form, nothing ticked in advance; a parent's email code for under-18s
  • A receipt for every answer: what was shown, what was chosen, how, when, from where, with a SHA-256
  • A privacy page: email code, see and withdraw consent, ask to see, correct or erase data, complain, nominate
  • Requests with a deadline (at most 90 days) and a step per system in the data map; breaches with the 72-hour clock
  • A readiness score from your own records, a data map with vendors, and an API for your other apps
Platform
Web; the public pages are phone-first
Best for
Any company holding customers', parents' or staff data: shops, clinics, schools, apps
User roles
Owner, manager, member; the public need no account
Database
PGlite or any Postgres

Who it is for

  • Online shops, clinics and service businesses

    A banner and a form that take consent the way the Rules expect, receipts you can show, and a privacy page that answers customers before they need to complain.

  • Schools, coaching centres and children's apps

    Under-18s need a parent's verifiable consent: the parent confirms with a code sent to their email, one parent can give consent for each child, and every answer is on record.

  • CA firms, consultants and agencies

    Run a separate company per client from one installation: their notice, banner, requests and breach register, with a readiness score to show progress before May 2027.

Live now

Demo access

Try it before you download it. Annapurna Organics, an online grocery in Bengaluru, after four months of website visitors answering the banner, customers consenting at checkout, a few withdrawing, and nine requests. Its courier's breach is on Home with the 72-hour clock running. Open the website as a visitor, the consent form, or the privacy page (the code that would be emailed is shown). A school in Mysuru, with parents giving consent for their children, is one switch away. No sign-up.

Open the demo

  • Home

    Readiness, a breach's 72-hour clock, requests by deadline, consents in 30 days.

    Open home

  • Requests

    Erasure, access, correction, a complaint and a nomination, each with its deadline and checklist.

    Open requests

  • Breaches

    The courier's open breach with its steps and the drafts for the Board.

    Open breaches

  • Consents

    Everyone on record and every receipt, with the fingerprint.

    Open consents

  • Notice

    Purposes in English, Hindi and Kannada, and three published versions.

    Open notice

  • Website banner

    Annapurna's homepage as a visitor sees it, with the consent banner.

    Open website banner

  • Consent form

    Yes or no to each purpose, in three languages; the receipt at the end.

    Open consent form

  • Privacy page

    An email code, then withdraw with a switch or make a request.

    Open privacy page

People in the demo

No password in the demo. The bar at the top switches company and person, opens the website as a visitor, or starts a company of your own.

  • Imran Sheikh

    Data protection officer, Annapurna Organics

    Everything but settings: requests, breaches, the notice and the data map.

    Open the demo

  • Kavitha Rao

    Owner (Founder)

    Everything, plus settings, the team and the API key.

    Open the demo

  • Deepa Nagaraj

    Member (Customer support)

    Consents and requests: the support desk's view. Breaches and the notice are read-only.

    Open the demo

  • Ramesh Gowda

    Administrative officer, Vidyanikethan Public School

    A separate company: children's consents given by parents with an email code, and a request past its deadline.

    Open the demo

Postgres runs in your tab and keeps your changes in this browser. Nobody receives email: codes show on the page and every email is in the outbox. “Reset demo” in the bar starts over.

On your own machine

Install it and sign in

  1. 1
    npm install
  2. 2
    SEED_PASSWORD=choose-a-password npm run db:seed
  3. 3
    npm run dev

Then sign in with the sample admin:

Password

choose-a-password

Or whatever you set SEED_PASSWORD to. On Windows PowerShell: $env:SEED_PASSWORD="choose-a-password"; npm run db:seed

Without the seed, the first visit asks you to create your company. Name your privacy contact in Settings, add purposes and publish the notice, then paste the banner's script tag into your site.

Features

Grouped by where the work happens.

Notice and consent

5
  • Purposes with the data they use and how long it's kept; each one either the person's choice or a legitimate use (Act section 7)
  • The notice in English and any of the 22 Eighth Schedule languages, with what's still to translate shown
  • Versions: publishing freezes the notice, every answer points at the version seen, and the banner asks again
  • A banner for your website (two lines), a consent form and a QR-friendly link; nothing ticked in advance
  • For under-18s, the parent's or guardian's consent, confirmed by a code sent to their email (Rule 10)

Proof

4
  • A receipt for every answer: code, choices, notice version, language, source, IP address, time in IST
  • A SHA-256 over what was shown and chosen; receipts are never changed, a withdrawal is a new one
  • Each person's full history, consent recorded by staff for paper forms and calls, and a CSV of every receipt
  • An API for your other apps: record consent from their forms, and check before messaging someone

The people's rights

5
  • A privacy page opened with an email code; it never tells a stranger whether an email is on record
  • Withdraw with one switch, as easily as consent was given (section 6(4)); a receipt by email
  • Ask to see, correct or erase data, complain, or nominate someone (sections 11 to 14)
  • Requests numbered, with a deadline (your days to answer, at most 90), a step per system in the data map, replies by email
  • Closing as completed, or rejected with a reason; the answer emailed and the complaint route to the Board given

Breaches and readiness

5
  • A breach register with the 72-hour clock to the Board's detailed report (Rule 7) on Home
  • Steps: contained, Board told, people told, report sent, closed; closing needs the Board and the people told
  • Drafts of the first note to the Board, the detailed report and the note to each person, from what's entered
  • A data map of systems and vendors, with countries, retention and signed agreements
  • A readiness score worked out from the records, and a morning email about deadlines and late reports

Tech and requirements

Exact versions, because that is the first thing a developer checks.

Stack

Framework
Next.js 16, App Router
Interface
React 19, Tailwind CSS 4
Language
TypeScript
Database
PGlite by default, or PostgreSQL 13+
Proof
Receipts never changed, each with a SHA-256; email codes kept only as hashes, 10 minutes and 5 tries
Website banner
One script tag, drawn in a shadow root; window.Consentdesk.choices() for your scripts
Email
Resend (optional); every email kept in an outbox

To run it

Node.js
22.6 or newer
Database
None to start; Postgres for production
Secrets
AUTH_SECRET, and CRON_SECRET for the morning email
Email
A Resend account to send codes and receipts (optional to try it)

What you get in the download

consentdesk.zip, 200 KB: the whole project as it unzips, counted from the zip itself.

  • Complete source code, nothing obfuscated
  • A seed script with the sample data the demo shows
  • A README: quick start, configuration and deploying
  • An .env.example with every setting and its default
  • The script that builds the browser demo
Buy · ₹12,499 How it works
consentdesk.zip84 files · 200 KB
  • Pages and API routes25 files
    24 KB
  • Core logic20 files
    220 KB
  • Server6 files
    19 KB
  • Screens and components22 files
    219 KB
  • Scripts2 files
    5 KB
  • README and configuration9 files
    95 KB

Common questions

01. Does this make us compliant with the DPDP Act?

It gives you what the Act and Rules ask you to run and prove: a clear notice in the languages people read, consent that's specific and recorded, withdrawal as easy as consent, a way to exercise rights with answers inside the deadline, parental consent for children, a breach process with the 72-hour report, and records of your data and vendors. What you write in the notice, and how you use the data, is still yours to get right: have a lawyer read your notice before you publish it.

02. When do the Rules apply?

The DPDP Rules, 2025 were notified on 13 November 2025. Most of them, including the notice, consent, security, breach reporting, children's data and grievance redressal, apply from 13 May 2027.

03. How does consent for children work?

Switch on “Children under 18 use our service”. The consent form then asks whether it's for the person or for their child; for a child, the parent or guardian gives their name and email and types a code sent to that email before anything is recorded. One parent can give consent for each child, and sees all of them on the privacy page.

04. How do people withdraw consent?

On the privacy page: they type their email, enter the code sent to it, and switch any purpose off. That's a new receipt, emailed to them, and your other apps see it through the API. On your website, a “Cookie settings” link reopens the banner.

05. What is a receipt, and why the SHA-256?

Every answer is stored as a receipt that's never changed: the code (like CD-7K2M-9Q4X), the notice version shown, each choice, the language, how it was given, the IP address and the time. The SHA-256 is a fingerprint of that content, so an emailed or printed copy can be checked against the record.

06. Can our other software use it?

Yes. Make an API key in Settings; your CRM, HR or membership app can record consent from its own forms and check, before sending a message, whether the person agreed. The README has the two calls.

More products

All products

Leadtrail

Sales CRM

A sales CRM for any number of companies: enquiries from IndiaMART, JustDial, Facebook and the website, a repeat check on every mobile number, follow-ups, WhatsApp templates, a drag-and-drop pipeline, and one-click invoices in Billcraft.

  • Next.js 16
  • React 19
  • TypeScript
  • PostgreSQL
Files
74
Lines
10,823
Source
₹12,499
Open live demoDetails Buy · ₹12,499

Renewly

Membership management

Memberships and fees for gyms, studios, dance academies and coaching classes: members and plans, part payments with receipts, renewals and pauses, WhatsApp reminders, Razorpay payment links, and a Today screen of who to collect from and who to renew.

  • Next.js 16
  • React 19
  • TypeScript
  • PostgreSQL
Files
86
Lines
12,718
Source
₹9,999
Open live demoDetails Buy · ₹9,999