Get a quote

Banking and data protection

Consent management system.

Software that records people's consent to the use of their personal data, and keeps proof of it, under India's DPDP Act 2023.

India’s Digital Personal Data Protection (DPDP) Act 2023 and the DPDP Rules 2025 let an organisation process someone’s personal data only with valid consent or for a “legitimate use” listed in section 7. The organisation also has to be able to prove that consent later. A consent management system is the software that collects, records and honours that consent, and keeps the proof.

In this project the system is set up for a bank, and consent is asked for during customer journeys such as account opening and KYC.

The roles

Who is involved

The terms used on this page, and what each one means in this project.

  • Data Principal

    The person the data belongs to. Here, a bank customer.

  • Data Fiduciary

    The organisation that decides why and how the data is processed. Here, a bank.

  • Data Processor

    A third party that processes data for the Fiduciary. Each processor is recorded in the system.

  • Guardian

    A parent or lawful guardian who gives consent for a child, meaning anyone under 18.

  • Enterprise application

    One of the Fiduciary's own apps that asks for consent. Each app is registered, and the system sends people back only to web addresses listed for that app.

  • Consent Manager

    Under the Act, a Consent Manager is a separate platform, registered with the Data Protection Board, that serves people across many companies. This system is not one of those. It is the Fiduciary's own.

The law

What the law asks, and what the system does

  • Notice (s.5, Rule 3)

    Before asking for consent, the organisation must say what data it collects, why, and how to withdraw or complain. The system keeps versioned notices in English and all 22 Eighth Schedule languages.

  • Valid consent (s.6)

    Consent must be free, specific, informed, unambiguous and given by a clear action. The system asks for each purpose separately, keeps mandatory and optional items apart, and records the exact purpose and notice version agreed to.

  • Withdrawal (s.6(4))

    Withdrawing must be as easy as giving consent. Customers withdraw from a dashboard, and the systems that use the data are notified.

  • Children (s.9)

    For anyone under 18, a guardian's verifiable consent is needed. The system then asks the guardian to verify and consent for the child.

  • Rights (ss.11–14)

    People can ask for access to their data, have it corrected or erased, raise a grievance and nominate someone. A grievance must be answered within 90 days, and the data protection officer (DPO) sets the response times in the system.

  • Retention (s.8(7), Rule 8)

    Data must be erased once its purpose ends. The system applies the retention rules and tells the person 48 hours before erasure.

End to end

How a consent request runs

  1. 01

    Configure

    The DPO defines purposes, data categories, processors, cross-border transfers, journeys, notices, retention rules, grievance response times and cookie policies. Apps can use a setup only once the DPO has published it as a new version.

  2. 02

    Request

    An app starts a consent request for one of its journeys. The system identifies the person and checks from the date of birth whether they are an adult or a minor.

  3. 03

    Verify

    The system runs its own verification page, with a one-time code (OTP) for an adult or DigiLocker for a guardian.

  4. 04

    Decide

    The app shows the notice, and the person accepts or declines each purpose.

  5. 05

    Record

    The system stores the consent, issues a receipt and writes an entry to a tamper-evident audit trail, so the decision can be proved later.

  6. 06

    Afterwards

    The system handles withdrawals, consent that expires, the day a child turns 18, grievances, and erasure when the retention period ends.

More work

Other case studies

  • Kautuki

    Education · Platforms

    A tutoring marketplace with live online classes for Class 6–12 students, built first for families in Tier 2, 3 and 4 towns in India. Parents choose a teacher the Kautuki team has checked and pay per class. Open for early-access sign-ups.

    Read the case study: Kautuki

  • ClaudeLight

    Technical advisory · Platforms

    A website and three apps for a firm that advises property and infrastructure owners. One sign-in covers a free price index calculator, a paid asset register for property portfolios and an expense tool for the firm's own staff.

    PHP · MySQL

    Read the case study: ClaudeLight

Have a project in mind?

Tell us what you want to build, and we'll tell you honestly how we'd approach it.

Get a quote