Consent Management
Every choice people make, captured, respected and enforced.
Notices in the languages your customers read, consent recorded one choice at a time, and withdrawal that reaches your CRM, marketing tools and processors within seconds. Across web, app, branch and call centre.
Trusted by leading enterprises
Every journey in. One source of truth for consent out.
Consent is collected wherever people meet you and checked everywhere their data is used.
- Website
- Mobile app
- Branch and kiosk
- Call centre
- Email and SMS links
- Partner journeys
- Notices with every block the Rules require
- Consent recorded per purpose
- Live yes or no for every system
- Withdrawal pushed to every system
- Legacy customers re-noticed
- A consent history per person
Consent people can read, and records nobody can rewrite
22 + English
Eighth Schedule languages for every notice, machine-drafted and reviewed by a person
0 edits
Records are append-only and chained. A correction is a new record pointing to the old one
Seconds
For a withdrawal to reach your connected systems, with no approval step in between
Five steps from notice to enforcement
What consent management does for you
Consent that's enforced as well as recorded
Most consent tools keep a log and stop there. DataSurity blocks tracking until people agree, supports Google Consent Mode v2, gives your systems a live lookup before every use, and pushes each withdrawal by signed webhook. The record and the behaviour stay in step.
Notices people can actually read
Every notice carries the blocks Section 5 and Rule 3 require, in English and any Eighth Schedule language the person chooses. Translations are drafted by machine and approved by a person before they go live. The exact text shown is fingerprinted with each record.
Your legacy customers, brought in
Section 5(2) asks for a fresh notice to everyone whose data you held before the Act. Campaigns by email and SMS carry tokenised links. Each answer, including "stop contacting me", becomes a consent record. Your oldest data gets the same proof as your newest.
Identity stays with you
Your systems sign who the person is. DataSurity records the proof of the channel and the choice, and never becomes the owner of your customers' identities. Children's screens block under-18s without storing an identifier, and marketing can't be switched on for them.
What the Act asks, and how Consent answers
Every rule below is built into the product. None of them can be switched off by configuration.
- s.5(1), Rule 3
Notice with or before the request, with set contents
Notice builder with every required block. Screens can't publish without one
- s.5(2)
Fresh notice to people whose data you held before the Act
Legacy notice campaigns by email and SMS, answers recorded as consent
- s.5(3), s.6(3)
Notice and request in English or an Eighth Schedule language
Per-notice translations, reviewed by a person, language stored with each record
- s.6(1)
Consent free, specific, informed, unconditional and unambiguous
One record per purpose, no pre-ticked options, reject as easy as accept
- s.6(4), s.6(6)
Withdrawal as easy as giving, processing stops, processors told
No approval step. Signed webhooks and a live lookup to every connected system
- s.6(10)
The Data Fiduciary must prove consent was given
Append-only, chained records with the exact notice text fingerprinted
- s.9, Rule 10
Verifiable consent for children, no tracking or targeted ads
Age gate on flagged screens. Marketing purposes blocked for minors
- s.11
Access to a summary of the person's data and processing
Per-person consent history, exportable for a rights request
What Consent hands on
- Data Principal Rights PortalA withdrawal can open an erasure request, and a person's consent history answers their access request.
- Data Journey MappingPurposes come from the register, so each consent ties to a processing activity and its lawful basis.
- Assessment & Compliance ReportingConsent records and notice versions feed control testing on Sections 5 and 6.
Deploy it your way
Built for regulated Indian enterprises: your data stays where your policies say it must.
- 01
SaaS, hosted in India
Managed by SARC AI on infrastructure in Indian data centres.
- 02
Private cloud
Runs in your own cloud account, under your keys and access policies.
- 03
On-premises
Installed in your data centre. Scanners read in place, and nothing leaves your network.
Connects to
PostgreSQL
MySQL
Oracle Database
Microsoft SQL Server
MongoDB
MariaDB- IDIBM Db2
SAP HANA
Snowflake
Amazon Redshift
Google BigQuery
Databricks
Teradata
Amazon DynamoDB
Azure SQL
Apache Cassandra
Redis
Elasticsearch
Couchbase
ClickHouse
Apache Hive
Apache Kafka
SQLite
Neo4j
Connectors are enabled during onboarding. Logos belong to their owners and indicate compatibility, not endorsement.
Certified
Frequently asked questions
Is DataSurity a Consent Manager under the Act?
No. A Consent Manager is a separate company registered with the Data Protection Board, acting for Data Principals across many Data Fiduciaries. DataSurity is the platform a Data Fiduciary uses to give notice, capture consent, prove it and enforce it. It's designed to connect with registered Consent Managers as that system develops.
Do we need consent for every use of personal data?
No. The Act allows certain legitimate uses without consent, such as data a person gives voluntarily for a specific purpose, or processing for employment. Those need a notice, and consent covers the rest. DataSurity lets each purpose carry its own basis, so notices and records reflect the law accurately.
How does DataSurity prove a consent was given?
Each choice is one append-only record holding the person or device, the purpose, the notice version, a fingerprint of the exact text shown, the language, the screen and the time. Every record carries the fingerprint of the one before it, so any change breaks the chain and shows up.
What happens when someone withdraws?
The withdrawal is recorded at once, with no approval step. The person's current state changes in the same moment, a receipt goes out, and a signed webhook tells your connected systems. Anything that needs manual action opens as a task with a checklist of the systems involved.
What about customers we've had for years?
Section 5(2) requires a fresh notice to them. DataSurity runs notice campaigns by email and SMS with secure links, records every answer, and treats "stop contacting me" as a withdrawal. The oldest part of your customer base ends up with the same proof as the newest.
Which languages are supported, and who checks the translations?
English and all 22 Eighth Schedule languages. Each notice is drafted in the target language by machine translation, then reviewed and approved by a person before publishing. The record stores which language the person saw.
Trusted by leaders across industries
“We knew patient data sat in our hospital information system. We didn't know how much had spread into lab exports, scanned reports and shared drives until DataSurity's assessment showed us. The team understood hospital realities, from paediatric records to staff data, and gave us a plan we could actually run. Implementation is now moving ward by ward, with consent and rights handled in one place.”
Rakesh G
Head - Compliance, KDSG Hospitals (350-bed multispecialty hospital)
