DPDP Act, in plain terms
DPDP compliance software for India: what the Act expects, in four pictures.
India's DPDP Act asks you to tell people what you collect, ask before you collect it, answer when they want it back, and prove you did. pactbase is a Consent Management Platform (CMP) that covers each of these in one place.
1 · Notice
You already have a privacy page. Can your customers read it?
Most sites have terms and a privacy policy in English. Under the DPDP Act the notice has to reach the people whose data you collect, in a language they understand, and you should be able to show which version they saw.
What most sites have
Privacy policy
English · one version
What a DPDP-ready notice looks like
Privacy notice v3 · published
- हिन्दी
- தமிழ்
- বাংলা
- मराठी
- తెలుగు
- ગુજરાતી
- ಕನ್ನಡ
- മലയാളം
…and 14 more, so all 22 scheduled Indian languages. Each language is approved separately.
| Typical website policy | DPDP-ready notice | |
|---|---|---|
| Language | English only | The languages your customers read |
| Versions | Overwritten when you edit | Each version kept and dated |
| Purposes | A general paragraph | Each purpose listed, with how long you keep data |
| Who to contact | A generic email | Grievance contact on every page |
Covered by pactbase Trust Center.
2 · Consent
One “I agree” for everything becomes one box per purpose.
Each reason you collect data gets its own unticked box, so a yes to a demo request is not a yes to marketing emails. Every yes is written down and the person gets a receipt.
Before
With per-purpose consent
- Contact me about my demo request
- Send me product updates by email
Receipt · one per consent event · withdraw any time
- 01
Person ticks a box
Per purpose
- 02
Ledger entry
Append-only
- 03
PDF receipt
One per event
- 04
Withdraw
From a preference center
Covered by pactbase Consent.
3 · Data requests
A data request is a support ticket your customer opens for you.
People can ask to see, correct or erase their data, or to nominate someone. If you run a help desk you already know the shape: a ticket, an owner, a deadline and a reply.
REQ-1042
Verifying identityErase my data
- Opened by
- The customer, from your trust center
- Owner
- Assigned to your team
- Deadline
- Tracked on the case
- 01
Customer submits
From your trust center
- 02
OTP check
Confirm who is asking
- 03
Ticket created
Owner and deadline
- 04
Reply and close
Case timeline kept
Covered by pactbase Data Rights.
4 · Cookies
A cookie popup that only decorates the page, or one that holds the scripts.
Analytics and ad scripts should wait for a yes. A scanner finds what runs on your site, and the banner keeps non-essential scripts blocked until the visitor accepts.
- Site essentialsRuns
- AnalyticsWaits for consent
- Ad pixelWaits for consent
- Chat widgetWaits for consent
Covered by pactbase Cookies.
What you need, and what covers it
DPDP needs, mapped to pactbase.
| What the Act asks of you | Area | pactbase module |
|---|---|---|
| Tell people what you collect and why, in their language | Notice | Trust Center |
| Ask before you collect, for each purpose, and keep proof | Consent | Consent |
| Ask before cookies and trackers run on your site | Cookie consent | Cookies |
| Answer access, correction, erasure and nomination requests | Data rights | Data Rights |
| Handle complaints with a named owner and a clock | Grievances | Data Rights |
Frequently asked questions
- What is the DPDP Act in simple terms?
- India's Digital Personal Data Protection Act asks businesses to be clear with people about why they collect personal data, to ask for consent for each purpose, to let people see, correct and erase their data, and to handle complaints. pactbase is software that covers these day-to-day tasks.
- Is a privacy policy page enough for the DPDP Act?
- A policy page is the starting point. The notice also has to be readable by the people whose data you collect, which means their language, and you need a record of which version they saw. pactbase's Trust Center publishes versioned notices in all 22 scheduled Indian languages.
- How is a data request different from a support ticket?
- It works like a support ticket that your customer opens for you. They ask to see, correct or erase their data, you verify who they are, and you reply by a deadline. pactbase Data Rights gives each request an owner, a deadline and a full case log.
- What does DPDP compliance software do?
- It handles the recurring work: publishing notices, collecting and recording consent, gating cookies, and running data requests and grievances. pactbase is a Consent Management Platform (CMP) built for the DPDP Act and Rules, with all four in one place.
- Is pactbase a registered Consent Manager under the DPDP Rules?
- No. A registered Consent Manager is a separate role under the DPDP Rules. pactbase is a Consent Management Platform: software that helps your business collect and prove consent.