Built for India's DPDP Act
Consent and privacy you can prove.
Veritrail keeps your notices, consents, withdrawals, rights requests and deletions in one place — with audit-ready evidence behind every step.
- No sales call
- Runs in your browser
- Hash-chained evidence
- Built for the DPDP Act 2023 and Rules 2025
- Notices today in English, हिन्दी, ગુજરાતી and मराठी
- Two-factor sign-in for every user
- Tamper-evident, hash-chained audit log
The deadline
The DPDP Act turns privacy into something you must be able to show
Every business that handles personal data of people in India needs clear notices, provable consent, working withdrawals and rights, and deletion on time.
November 2025
DPDP Rules notified
The Data Protection Board of India is set up and the phased rollout begins.
13 November 2026
Consent Managers
Registration and obligations for Consent Managers take effect.
13 May 2027
Full obligations
Notice, consent, rights, retention, security and breach duties apply to every data fiduciary.
Penalties can reach
₹250 crore
Failing to take reasonable security safeguards against a personal data breach
₹200 crore
Failing to notify a breach, or breaching the extra duties for children’s data
₹50 crore
Breaching any other provision of the Act or Rules, such as notice and consent
How it works
One record from the first notice to the final proof
01
Publish a notice
Pick your purposes, write the notice in each language and publish a frozen, fingerprinted version.
02
Capture consent
Through the website widget, a staff desk screen or your backend. Each decision links to the exact wording shown.
03
Honour withdrawals
One click to withdraw. Every connected system gets a job and must confirm it acted.
04
Answer rights requests
A public portal with email verification, deadlines, officer alerts and drafted replies.
05
Delete on time
Retention clocks per purpose, approved deletion batches and a hashed proof for each one.
06
Show the evidence
PDF and CSV reports for any period, which anyone can verify against the audit log.
The platform
Eight modules, mapped to the Act
Use them together, or start with the consent widget and add the rest as you go.
DPDP s.5
Notices
DPDP s.6
Consent capture
DPDP s.6
Consent ledger
DPDP s.6(4)
Withdrawal propagation
DPDP ss.11–14
Rights requests
DPDP s.8(7)
Retention and deletion
Evidence
Reports and verification
Operations
Readiness dashboard
By the numbers
Substance you can check, not vanity metrics
- modules, each mapped to a duty in the Act
- 8
- languages live today, rolling out to all 22 the DPDP Act allows
- 4
- consent widget, embeddable on any site
- 10 KB
- append-only records, verifiable against the audit log
- 100%
modules, each mapped to a duty in the Act
languages live today, rolling out to all 22 the DPDP Act allows
consent widget, embeddable on any site
append-only records, verifiable against the audit log
Inside Veritrail
Built for the people who answer to auditors
Privacy officers see what needs attention today. Auditors get read-only access to the ledger and the evidence.
The consent ledger: every decision, its channel and language, and the notice version shown.
Evidence reports with fingerprints, and a check for any file someone hands you.
Why Veritrail
Designed around evidence from day one
Proof, not promises
Made for Indian languages
Your data stays with you
Honest about legitimate use
The consent widget, as your visitors see it.
On the roadmap
An AI gap scanner, coming to Veritrail
Paste your website and our AI will read your forms, cookies and notices, then list exactly what the DPDP Act needs fixed — turning today’s free self-check into an automatic one.
- Reads your forms, cookies and notices
- Maps each gap to a DPDP duty
- Feeds straight into your readiness score
Compared
Why not a spreadsheet, a consultant or an enterprise suite?
Each has its place. Here is where an India-first, evidence-first tool is different — judged on substance, not sales decks.
| How you compare | Spreadsheets & email | Consultants | Enterprise suites | Veritrail |
|---|---|---|---|---|
| Setup time | Days of manual work | Weeks of engagement | Months to roll out | Live in days |
| Cost to start | Low, but hidden effort | High fees per review | Enterprise contracts | Start free, scale later |
| Proof the Board can verify | Hard to prove | Static, point-in-time | Usually yes | Verifiable evidence |
| Updates when the Rules change | Manual rewrite | Pay to re-review | Vendor updates | Built in |
| Works in Indian languages | Do it yourself | Varies | Few Indian languages | Indian languages, more coming |
| Start without a sales call | Yes | No | No | Free DPDP check now |
Security
Your customers’ trust, protected by design
Row-level tenant isolation, encrypted identifiers, append-only records and required two-factor sign-in.
Isolated by default
Minimal data
Tamper-evident
FAQ
Questions we hear most
When do DPDP obligations apply to my business?
The DPDP Rules were notified in November 2025 with a phased rollout. Consent Manager provisions start on 13 November 2026, and notice, consent, rights, retention and security duties apply to every data fiduciary from 13 May 2027.
What are the penalties under the DPDP Act?
The Schedule to the Act sets penalties of up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failing to notify a breach or for breaching children’s data duties, and up to ₹50 crore for other breaches.
Does the DPDP Act apply to a small business or a 10-person company?
Size alone does not exempt you. The Act applies to any business that handles the digital personal data of people in India, whatever its headcount. The government may notify lighter obligations for some classes of data fiduciary, including certain startups, but the core duties of notice, consent, rights and deletion apply broadly. Confirm your exact position with your lawyer.
Do we need to appoint a Data Protection Officer?
A dedicated Data Protection Officer is required only if the government designates you a Significant Data Fiduciary, which most SMEs are not. Every data fiduciary must still name a contact who can answer questions about its processing and handle grievances, and publish that contact. Veritrail routes rights requests and grievances to that person with deadlines and reminders.
How do we prove consent if a customer or the Data Protection Board asks?
Veritrail links every consent to the exact notice version the person saw, in their language, and stores it in an append-only ledger. You can produce a proof-of-consent PDF for a single person and an evidence report for any period, each carrying a SHA-256 fingerprint that anyone can verify against the audit log.
Is Veritrail a registered Consent Manager?
No. Veritrail is consent management software that your business runs as the data fiduciary. A Consent Manager is a separate role that must register with the Data Protection Board of India.
Does Veritrail make us DPDP compliant?
Veritrail gives you the workflows and records that compliance needs, and evidence you can show an auditor. It is not legal advice and does not issue certificates, so work with your lawyer on your obligations.
How does Veritrail connect to our systems?
Through HMAC-signed webhooks, an outbound-only agent that runs SQL inside your network, or tracked manual tasks for spreadsheets and vendors without an API.
Which languages are supported?
Notices and messages go out today in English, Hindi, Gujarati and Marathi. We are rolling out to all 22 languages in the Eighth Schedule to the Constitution — the ones the DPDP Act lets a person choose their notice in.
What should we ask any consent platform before buying, including Veritrail?
Can it show the exact notice wording a person agreed to, and when? Can an auditor verify its records independently rather than take its word? Does a withdrawal actually reach your other systems, or stop at the platform? Is personal data kept to a minimum and encrypted? We built Veritrail to answer yes to each, and we are happy to show you how.
See where you stand on DPDP
Answer nine quick questions for a free readiness score and a short list of gaps to fix. It runs in your browser — no email, no sales call.