DPDP Act, 2023 & DPDP Rules, 2025 · Architecture Checklist
14 essential points a Consent Management System must always have
A cookie banner alone cannot defend your organisation in a proceeding under the Digital Personal Data Protection Act, 2023. Review the 14 non-negotiable engineering and legal safeguards built into DPDP Star—then fill in your details to automatically receive the complete architecture & screen guide by email.
The 14-Point Standard
Built for cryptographic proof, legal verification, and DPO governance
Every capability below is engineered so your DPO, legal counsel, and engineering team can stand behind your records when questioned.
-
01Live
PCA · Personal Consent Artifact
Every Data Principal receives a downloadable, cryptographically verifiable Personal Consent Artifact (PCA) binding their chosen purposes, timestamp, and a cryptographic fingerprint of the exact notice.
-
02Live
Legal Verification Signature Certificate
Produces a digitally signed evidence report to support your Section 63(4) Bharatiya Sakshya Adhiniyam certificate. Your authorised officer signs the certificate; admissibility is for the court to decide.
-
03Live
Compliance & ROPA Completeness Checker
Automated Record of Processing Activities (ROPA) completeness checker flags missing retention periods, unmapped purposes, and statutory gaps alongside DPIA risk-scoring readiness.
-
04Live
Erasure with Caution to Legal & Retention Holds
Erasure never runs blindly. Every erasure request pauses for explicit DPO sign-off with statutory retention and legal-hold cautions (Rule 8(3) & Third Schedule) before purging downstream.
-
05Live
Tamper-Evident System
Each organisation keeps its own tamper-evident, cryptographically chained record that blocks retroactive edits, with daily blockchain-anchored evidence and independent trusted time-stamps.
-
06Live
Versioned Notices Bound by Cryptographic Proof
Every consent choice permanently records the exact notice version and its cryptographic fingerprint, proving what wording was shown on the day consent was given or withdrawn (Section 6(10)).
-
07Live
Self-Service Rights & Grievance Portal (90-Day SLA)
Dedicated Data Principal portal for one-step withdrawal, summary requests, correction, erasure, and nomination (Sections 11–14), with automated reminders before the Rule 14(3) 90-day limit.
-
08Live
48h & 72h Breach Register & Board Countdown
Tracks personal data incidents with live 48-hour and 72-hour countdowns for Data Protection Board of India (Rule 7(2)) and CERT-In notifications, plus one-click PDF and CSV exports.
-
09Live
Section 9 Children’s Consent & Parental Check
Dedicated parental consent flow and DPO verification queue that logs the exact identity/age record verified under Section 9 and Rule 10 before enabling child data processing.
-
10Live
Role-Separated Console (DPO, Operator, Admin)
Strict role-based access control separating Admin setup from DPO compliance sign-offs and Operator queues, protected by mandatory TOTP MFA and single-use recovery codes.
-
11Live
Privacy Policy Drafted from Live Site Scan
Scans your website’s active scripts, cookies, forms, and installed apps to generate a structured draft DPDP notice for your legal team to review and publish.
-
12Live
Real-Time Consent Verifier & System Sync
Server-to-server consent checks and signed change notifications propagate withdrawals and erasure decisions immediately to your CRM, ERP, and marketing systems.
-
13Live
Zero-Plaintext Encrypted PII Vault
All stored emails and phone numbers are encrypted at rest, and audit trails and logs are kept free of plaintext PII.
-
14Live
Multi-Platform Connectors & Sovereign India Hosting
Hosted in India with strict per-organisation data isolation, with native connectors built for Wix, Shopify, WordPress, and WooCommerce and enterprise connectors following.
Trust & Evidence Infrastructure
Evidence you can show, built in from day one
Alongside our live Indian data-centre hosting, every DPDP Star account includes:
- Blockchain-anchored evidence Records are anchored daily to a public blockchain, so later changes can be detected.
- Digital signatures Consent artifacts and evidence reports are digitally signed and can be verified independently.
- Independent trusted time-stamps (RFC 3161) Independent time-stamps show when each day’s records existed.
- CERT-In 6-hour incident reporting The breach module alerts your team within CERT-In’s 6-hour reporting window.
Statutory timeline under the DPDP Act, 2023 & Rules, 2025
- 13 November 2025: The Digital Personal Data Protection Rules, 2025 were notified in the Gazette of India (G.S.R. 846(E)).
- 13 November 2026: Rule 4 (registration conditions for Consent Managers) comes into force. DPDP Star is Consent Management & Evidence software operated by Data Fiduciaries, not a Rule 4 intermediary.
- 13 May 2027: Full enforcement of Rules 3 and 5–16, including Section 5 Notice, Section 6 Consent & Proof, Rule 6 Security Safeguards, Rule 7 72-Hour Breach Notification, and Rule 14 90-Day Rights & Grievance SLAs.
Audit trails and consent artifacts only exist from the day your system begins recording them. Starting early builds the verifiable chain your DPO and legal counsel rely on.