Let consent keep its own records: why we built pactbase

Think about a normal Tuesday at a small Indian business. An invoice goes out from the accounting app. A payment comes in through the gateway. A customer's complaint becomes a ticket, and by evening the ticket is closed. Every one of those moments leaves a record, and nobody had to think about it.

Then a customer writes in and asks: "What did I agree to when I signed up?" For most businesses, that is the one question with no record behind it.

That gap is why we built pactbase. It is a Consent Management Platform for India's DPDP Act, made for small and mid-sized teams. You add one script to your website, the way you once added analytics, and consent starts keeping its own records.

Every business keeps records. Except for consent.

None of us sat down and designed our record-keeping. The tools did it for us. The accounting app keeps the books. The payment gateway keeps the transactions. The helpdesk keeps the tickets. They work because they are simple: you sign up, you connect them once, and they run in the background while you get on with the work.

Consent never got a tool like that. In most companies it lives in pieces. A cookie banner from a plugin. A checkbox on a form someone built three years ago. A privacy policy in a document. A spreadsheet of people who asked to stop getting emails. Each piece made sense when it was added. Together, they cannot answer a simple question from a customer.

That is not carelessness. Nobody gave small businesses a simple way to do it.

DPDP, in plain words

The DPDP Act applies to every business that stores personal data digitally. Not only large companies. If your website has a contact form, a sign-up page or an analytics script, it applies to you.

What it asks for is fair, and easy to say:

• Tell people clearly what you collect and why.
• Ask before you use their data, one purpose at a time.
• Keep proof of what they said.
• Let them change their mind as easily as they agreed.

The rules come fully into effect in May 2027. That is enough time, as long as getting there is simple.

Why the existing options didn't fit

When we looked at how a small business would do this today, we kept finding the same four options.

• Large privacy platforms. Thorough and serious, but built for large companies. Enterprise pricing, and rollouts that run for months, often with a consultant.
• Free cookie-banner plugins. Quick to install, but they cover cookies only and keep no proof you can show later.
• A lawyer and a spreadsheet. You get a good policy. But a policy is a promise. It does not record what each person agreed to.
• Building it yourself. Possible, but it pulls engineers away from your product, and it is never quite finished.

Most small teams do not have a compliance officer or a GRC team. So the honest answer, for a lot of good businesses, has been "we'll deal with it later".

Why we started pactbase

DPDP is for every business that stores data digitally. We kept coming back to one thought: if the law is for every business, then complying with it should not be a pain for the small ones.

Most companies we talk to do not have someone whose job is compliance. So we asked a simple question. What if DPDP compliance were as easy as adding a Google Analytics script to your website's header? You add it once. It runs in the background. Nobody needs to be an expert to keep it going.

That is the core of pactbase, and the reason we started it. DPDP for small businesses, the way they already work. Nothing complex. We want to keep it simple and do the routine work for you, so you can spend your time on the real business.

It works like the tools you already use

If you have run a business, you already understand how pactbase works.

What you already do	What it looks like in pactbase
Paste an analytics script into your site's header	Paste the pactbase script. The banner appears in your visitor's language, and trackers wait for a yes.
Keep books that nobody edits after the fact	The consent ledger. Every yes and no is recorded, and nothing can be edited or deleted.
Send an invoice for every sale	A receipt for every consent, with the purpose, the notice version and the time.
Put a terms page on your website	Your Trust Center: your policies, the data you collect, and who to contact.
Give every support ticket an owner and a deadline	Data requests, with an owner and a clock. This is Data Rights.

What is live today

pactbase launches with four modules. They share one record underneath. If the term is new to you, start with what a Consent Management Platform is.

Cookies. Scans your site for cookies and trackers, flags the ones that fire before a visitor says yes, and holds them until consent is given. The banner speaks 22 languages.

Consent. Define each purpose once. Paste one snippet into the forms you already have, and it adds one unticked box per purpose. Every yes and no goes to the ledger with a receipt, and people can withdraw from a preference centre with one link.

Trust Center. One public page with your policies, a versioned list of the data you collect, your vendors, and your DPO and grievance contacts. You approve each language yourself.

Data Rights. A request portal on your Trust Center for access, correction, erasure and nomination requests. People verify with an OTP, every case carries a deadline, and grievances have their own queue.

Built for how small teams buy

• Sign up yourself. No sales call. Create an account and start in minutes.
• Live in a day. One script for your site, one snippet per form. No rebuild.
• A price you can plan for. Simple plans for small teams. No surprise invoices.

What comes next

We are still building. Over the coming months we want to hear from as many small businesses as we can. Tell us what feels hard, and we will work on making it simple. You can write to us at info@pactbase.in.

If you have ever added analytics to a website, you already know how to start. Sign up at v1.pactbase.in. For a fuller picture of what the law expects, read our guide to DPDP compliance software in India.

Prefer to read it as a letter? Here is the same story as our Release 01 launch note.

Proofs, not promises.

Shubham & Pradip