OrbCyber Consent captures itemised notice, granular purpose-level consent and one-click withdrawal, and stores each one as a tamper-evident artefact you can produce years later, in the language the data principal actually chose.
cns_7f3a91d4c6v4 · mr-INSHA-256 verifiedBuilt for
DPDP Act 2023DPDP Rules 2025GDPRISO 27001SOC 2IAB TCF-readyA cookie banner records a click. The DPDP Act asks you to produce something far harder: proof of what a specific person was told, in which language, on which version of the notice, for which purpose, and what they did about it afterwards.
That is when the question usually arrives: from an enterprise customer's security review, from due diligence, or from the Board. Most consent tools cannot answer it, because they stored a boolean instead of an artefact.
OrbCyber Consent is built the other way round. Every capture writes an immutable record: the notice text served, its version and language, the purposes offered, what was accepted and refused, the timestamp, and a hash that proves none of it was edited since. Withdrawal writes a new record rather than erasing the old one, so the history stays intact.
Most teams are live on a first domain inside four weeks. The long pole is agreeing your purpose list, not the integration.
Define every purpose you process for, and which are consent-based versus legitimate uses under Sec. 7.
Compose itemised notices in the notice builder, then publish translations across the languages you serve.
Drop in the web SDK, mobile SDK or server API. Offline and call-centre capture use the same record format.
Consent state is queryable at runtime, so downstream systems can check before they process rather than after.
Export any artefact, run coverage reports, and answer a rights request or an audit from a single console.
Everything below ships in the core product. Nothing here is a paid add-on.
Compose notices that list each purpose and the personal data it needs, in plain language, with version control so you always know which text a given person actually saw.
Serve the notice in English or any of the twenty-two languages in the Eighth Schedule, with the served language recorded on the artefact itself.
The heart of the product. Each capture writes an immutable, hash-chained record (notice version, language, purposes, decision, timestamp, source) that can be exported and independently verified.
No bundled "I agree". Each purpose is accepted or refused on its own, and refusing one never blocks a service that does not need it.
A hosted preference centre where a data principal can review everything they have granted and withdraw any of it in a single action, with consequences shown before they confirm.
Access, correction, erasure and nomination requests arrive through the same interface, with identity verification, SLA clocks and a complete response log.
Where under-18 users can reach your product, route them through age assurance and verifiable parental consent, and suppress tracking and behavioural advertising automatically.
When consent is withdrawn or a retention window closes, the platform emits an erasure signal your systems can act on, and records that it did.
Query consent state before you process, not after. Web and mobile SDKs, a server API, and webhooks that keep your warehouse and CRM in step.
See consent coverage by purpose, product and geography, spot the surfaces still capturing nothing, and export an audit bundle without engineering help.
Built by a security firm, so the safeguards under Sec. 8(5) are part of the product rather than a checklist beside it.
Regulated sectors can run the whole platform inside their own boundary, with OrbCyber operating it or handing over the keys entirely.
The platform is not a compliance guarantee (no software is). It is the evidence layer under the clauses below, and this is exactly which ones.
Clause references are to the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. Software supports compliance; it does not deliver it on its own. Organisational measures, contracts and security controls sit alongside. This page is general information and not legal advice.
These two terms are used interchangeably across the market, and they are not the same thing. Buying the wrong one, or believing you have registered when you have not, is a live risk.
What OrbCyber Consent is.
A regulated intermediary under Section 2(g) and Rule 4.
Almost no business needs to become a registered Consent Manager. It is a role for intermediaries, not for companies managing their own users' consent. If you are considering the application, our DPDP team can assess eligibility against Part A of the First Schedule before you commit.
We did not start with a banner and add compliance. We started with the evidence an auditor asks for and built backwards.
Every capture is an artefact, not a flag. Designed to be produced under scrutiny two years later, not just to render a dialog.
We are a cybersecurity firm. Encryption, key management, access control and immutable logging are core engineering, not a trust page.
Built in India, hosted in India, with all twenty-two Eighth Schedule languages and DPDP semantics rather than a retrofitted GDPR model.
The same team that runs DPDP gap assessments and ISO 27001 audits. If the platform is the wrong answer for you, we will say so.
What prospective customers ask us most often about the platform.
It is in early access. We are onboarding a limited number of design partners ahead of the 13 May 2027 deadline, which means direct access to the engineering team, influence over the roadmap, and preferential licence terms locked for the first three years. Tell us your stack and volumes and we will say honestly whether you are a fit for this phase or better served at general availability.
No, and be careful of anyone who says otherwise. The platform gives you the notice, consent and evidence layer, a substantial part of the Act, but not all of it. Security safeguards under Section 8(5), retention and erasure in your own systems, processor contracts, breach response and governance all sit outside a consent tool. That is what our DPDP consulting practice covers.
No. OrbCyber Consent is a consent management platform licensed to data fiduciaries, which is a different thing from the statutory Consent Manager role under Section 2(g) and Rule 4. That role requires registration with the Data Protection Board, incorporation in India, a minimum net worth of two crore rupees, and an obligation to keep routed data unreadable to yourself. The framework comes into force on 13 November 2026. We will say clearly on this page if that ever changes for us.
Yes. Enterprise licences support single-tenant private cloud, fully self-hosted deployment inside your own boundary with your own KMS, and air-gapped installation on request. BFSI and healthcare customers usually take one of these. SaaS runs on India-region infrastructure by default.
Most teams are live on a first domain within four weeks. The integration itself is typically a few days of engineering; what takes the time is agreeing your purpose list and drafting notices that survive legal review. If you have already completed a RoPA with us, that work is done and deployment is faster.
You may not need to. If your existing platform captures purpose-level consent, records notice version and language, and can export a verifiable artefact, it may be adequate. Three things commonly fall short for DPDP: Eighth Schedule language coverage, verifiable parental consent under Section 9, and evidence that withdrawal actually propagated downstream. We will assess your current tool against those honestly before proposing a replacement.
You export the full artefact store in open JSON with hashes intact, so the records remain independently verifiable outside our platform. There is no proprietary lock on your consent evidence. It is your compliance record, not our asset. Export is available at any time on every tier.
The platform covers consent. These cover everything around it.
Gap assessment, RoPA, Section 8(5) safeguards, breach readiness and DPO-as-a-Service.
ISO 27001, SOC 2, NIST, PCI DSS, GDPR: readiness through certification on a unified control library.
Continuous third-party assurance: the processor side of your consent obligations.
A 30-minute working session. Bring one product surface and we will show you the artefact it would produce, using your purposes and your notice text.