DPDPA Consent Manager Tool
Consent Hub: Notice, Consent and Withdrawal for the DPDP Act, With a Receipt for Each
Consent Hub is SecureRoot's consent management platform for Data Fiduciaries under the DPDP Act, 2023 and the DPDP Rules, 2025. It serves the notice, records the consent in a tamper-evident ledger, blocks the tags the person declined, and runs the withdrawal through to every downstream system. It deploys into your own cloud, not ours.
At a Glance
- Deployment
- Your infrastructure: Docker and Helm, customer-controlled
- Who operates it
- Your privacy team, through the client admin portal
- Written against
- DPDP Act, 2023 and DPDP Rules, 2025; international cookie regimes configurable
- Status
- Not a registered Consent Manager under Rule 4; not an IAB-certified CMP
Consent you can prove, on infrastructure you control.
In One Paragraph
In One Paragraph
Consent Hub is SecureRoot's consent management platform for Data Fiduciaries under the DPDP Act, 2023. It serves itemised notices, records every grant and withdrawal as a signed, hash-chained receipt, blocks declined scripts in the browser, and pushes withdrawals to connected systems through signed webhooks. It is deployed into the customer's own infrastructure and is not a registered Consent Manager under Rule 4 of the DPDP Rules, 2025.
The Problem
The Act asks for consent that is free, specific, informed and provable. A banner gives you one of those.
Section 6 of the DPDP Act makes consent the main lawful ground for processing personal data, and section 6(4) requires that withdrawing it be as easy as giving it. The DPDP Rules, 2025 add the notice content, the itemised purposes and the retention duties. Most cookie banners were written for a different law and record a yes or no against a page view, which is not evidence of any of that.
The harder half is what happens after the click. A consent record that lives only in the browser cannot answer a Data Principal who asks what they agreed to, cannot stop a tag that fired before the banner loaded, and cannot tell your CRM that the person withdrew last Tuesday.
Consent Hub was built to close that gap: a signed ledger entry for every decision, blocking that holds in the browser, and a withdrawal that travels to the systems that hold the data.
Capabilities
What Consent Hub Does
Each capability below is implemented in the platform and covered by its own automated tests. Nothing here is a roadmap item.
01
Notice and consent banner
A configurable banner and preference centre served by the browser SDK, with itemised purposes rather than one blanket agreement, and React bindings for product teams.
02
Script and iframe blocking
Tags the person has not consented to do not load. Blocking is enforced in the browser and proven by Playwright tests against a demo site, not assumed from a tag manager setting.
03
Google Consent Mode v2
Consent state is passed to Google tags in the signalling format they expect, so analytics and advertising tags respect the decision without custom code.
04
Tamper-evident consent ledger
Every grant, change and withdrawal is hashed into a chain and issued as an Ed25519-signed receipt, so a record can be shown to a Data Principal or a regulator and checked for alteration.
05
Withdrawal and erasure orchestration
A withdrawal fans out to connected systems through signed webhooks and a connector kit, with acknowledgements tracked separately from verified erasure.
06
Cookie and tracker scanner
A Chromium worker crawls your site in four consent states, discovers the cookies and trackers it finds, and proposes a classification for review.
07
Data Principal portal
A self-service portal where a person sees what they consented to, changes it, withdraws it, and raises the requests the Act gives them.
08
Versioned legal control registry
Ninety DPDP control records, each traceable from provision to implementation to test, shipped unverified until a named legal reviewer signs each one off.
How It Works
How a Deployment Runs
Consent Hub is deployed into your environment and configured with you. The consulting practice runs the deployment; the platform runs after it.
01
Purpose and notice design
We map your processing purposes, write the itemised notices the Rules require, and configure the legal bases, including the section 7 legitimate uses that are not consent and are never labelled as such.
02
Deploy into your cloud
Containers and a Helm chart go into your Kubernetes or Docker environment. PostgreSQL row-level security isolates each tenant; keys and secrets stay with you.
03
Install the SDK and scan
The browser SDK goes onto your sites with the CSP and tag-manager changes it needs. The scanner then confirms which tags fire in each consent state.
04
Connect and hand over
Connectors are wired to the CRM, marketing and data systems that must honour a withdrawal. Your team takes the admin portal; SecureRoot stays on as support or as your vDPO.
Workflow
The Consent Lifecycle, as Consent Hub Runs It
The six steps the Data Protection Board, an auditor or a customer will ask to see working, with the owner and the record each step leaves behind.
- 01
Notice
A standalone notice is shown before or with the consent request: itemised data, purpose, how to withdraw, how to exercise rights and how to complain to the Board.
- Owner:
- Product and Legal
- Record:
- Notice version ID
- 02
Capture
Purpose-level toggles, none pre-ticked. The affirmative action is recorded with the principal, purposes, timestamp, notice version, channel and method.
- Owner:
- Product
- Record:
- Consent record
- 03
Store
The decision is written to the tamper-evident ledger: canonically hashed into a chain and issued as an Ed25519-signed receipt.
- Owner:
- Consent Hub
- Record:
- Ledger entry and receipt
- 04
Propagate
Consent status is pushed to the CRM, marketing automation, analytics and processors through signed webhooks, so each system checks status before use.
- Owner:
- Connectors
- Record:
- Sync log
- 05
Withdraw
Withdrawal is offered on the same channel with the same ease. Gated tags stop on the next load and every connector is instructed.
- Owner:
- Product and Consent Hub
- Record:
- Withdrawal record and processor instruction
- 06
Review
Acknowledgements are tracked against verified erasure, and a sample test confirms that withdrawal suppressed downstream use.
- Owner:
- Privacy lead
- Record:
- Verification evidence
Who It Is For
Who Consent Hub Is For
Organisations that collect personal data from people in India at a scale where consent has to be operated, not just displayed.
Consumer platforms and marketplaces
High-volume consent across web and app, with marketing tags that must switch off on withdrawal.
Banks, NBFCs and fintechs
Consent records that an RBI-regulated entity can produce on request, held in infrastructure it controls.
Health, insurance and education
Sensitive purposes and children's data, where verifiable parental consent under section 9 has to be designed in.
Groups with several brands
White-label, multi-tenant deployment so each brand runs its own notices on one platform.
Regulatory Mapping
What the Law Asks, and What the Platform Does
The rows below name the provision and the control. Where the platform cannot satisfy a provision on its own, the row says so.
DPDP Act, 2023, section 5
- What it requires
- A notice, before or with the request for consent, stating the personal data, the purpose, how rights are exercised and how to complain to the Board.
- What Consent Hub does
- Itemised notices configured per purpose and served by the SDK; the notice version shown is recorded against each consent.
DPDP Act, 2023, section 6
- What it requires
- Consent that is free, specific, informed, unconditional and unambiguous, limited to the stated purpose, and as easy to withdraw as to give.
- What Consent Hub does
- Purpose-level grants, a one-step withdrawal in the banner and the portal, and a signed ledger entry for every decision.
DPDP Act, 2023, section 7
- What it requires
- Processing for certain legitimate uses without consent, which must not be dressed up as consent.
- What Consent Hub does
- Legitimate uses are modelled as their own legal basis in the registry and are never described to the person as consent.
DPDP Rules, 2025, notice and consent rules
- What it requires
- Notice content in plain language, itemised description of the goods, services or uses, and a link to withdraw.
- What Consent Hub does
- Notice templates built to the Rules' content list, with the legal control registry tracing each element to its rule.
DPDP Rules, 2025, Rule 4 (Consent Managers)
- What it requires
- Registration with the Data Protection Board, Indian incorporation and net-worth conditions for an entity acting as a Consent Manager.
- What Consent Hub does
- Nothing. Consent Hub is a Data Fiduciary's own consent tool. It is not a registered Consent Manager and does not claim to be one.
Consent Mode v2 and international cookie regimes
- What it requires
- GDPR, UK PECR and similar regimes expect prior consent for non-essential cookies and a signal to advertising platforms.
- What Consent Hub does
- Configurable cookie categories per jurisdiction, Google Consent Mode v2 signalling, and blocking enforced in the browser.
Browser-side blocking cannot recall data already transmitted before the SDK loaded or clear storage it cannot reach. The deployment step includes the CSP and tag-manager changes that make the gate hold.
Plainly Stated
What Consent Hub Is Not
It is not a registered Consent Manager under Rule 4 of the DPDP Rules, 2025, and it is not an IAB-certified consent management platform. It is a Data Fiduciary's own control implementation, deployed into that Fiduciary's infrastructure.
Its legal control registry ships with every record marked unverified. A named legal reviewer verifies each record against the official text before it is relied on, and the software does not substitute for that review or for legal advice.
A connector acknowledgement is not verified erasure. The platform records the acknowledgement and tracks verification as a separate step with its own evidence.
Pricing
Pricing
Consent Hub is scoped per deployment: the number of sites and apps, the connectors that must honour a withdrawal, the tenants, and whether SecureRoot operates it or hands it over. We put the scope and the price in writing after a scoping call, and we do not publish a list price that would be wrong for most of the organisations reading this.
Is Consent Hub a Consent Manager under the DPDP Rules, 2025?
No. A Consent Manager under Rule 4 is a separately registered entity that a Data Principal uses to manage consent across many Fiduciaries. Consent Hub is software a Data Fiduciary runs for its own processing. The two can coexist, and the platform is built so a registered Consent Manager could be integrated later, but it is not one and the page does not claim otherwise.
Where does the data live?
In your environment. Consent Hub is delivered as containers and a Helm chart for deployment into infrastructure you control, with PostgreSQL row-level security between tenants and signing keys that stay with you. SecureRoot does not host your consent records.
What does the consent receipt actually prove?
Each decision is canonically hashed into a chain and signed with an Ed25519 key, so a receipt shows what the person agreed to, against which notice version, and that the record has not been altered since. It is evidence of the decision, not a legal opinion on whether the decision was valid.
Does it block tags, or only record a preference?
It blocks. Script and iframe loading is gated in the browser by the SDK and verified by automated tests that check the network for blocked tags in each consent state. The deployment includes the content security policy and tag manager changes that stop a tag firing before the SDK does.
What happens when someone withdraws consent?
The withdrawal is written to the ledger, the SDK stops the gated tags on the next page load, and a workflow notifies each connected system through signed webhooks. Each system's acknowledgement is tracked, and verified erasure is recorded as a separate step with evidence rather than inferred from the acknowledgement.
Can it handle cookie consent outside India as well?
Yes. Cookie categories and notice text are configurable per jurisdiction, and the platform speaks Google Consent Mode v2 for advertising and analytics tags. It was written for the DPDP Act first, with international cookie regimes as configuration rather than an afterthought.
Services
Where It Fits in the Work
The services SecureRoot delivers with Consent Hub, read from the catalogue.
Ready When You Are
Tell us what is due and who is asking. You will leave the call with a written scope, a timeline and a fixed price, and an honest answer if we are not the right firm for it.