Data Privacy · Module 01
A continuous governance loop that finds cookies, classifies them, gates them behind consent and watches for drift. Shipped as part of Consent Management.
Primary DPDP sectionsSec. 6(1)
98.7%
Known cookies catalogued
< 24h
Scan-to-policy refresh
100%
Tags gated pre-consent
4
Categories auto-mapped
Figures illustrative.
How it works
Five repeatable stages turn raw discovery into a live, geo-aware banner that blocks before it asks, then keep watching for drift
01
Crawl pages, SPAs, subdomains and authenticated journeys
02
Map each cookie to category, vendor, purpose and duration
03
Build the banner UI and the auto-block script
04
One snippet, or through your tag manager
05
Re-scan, detect drift, refresh the policy
Non-essential tags stay dormant until the visitor opts in, the default-deny behaviour Sec. 6(1) requires.
Capability
Scheduled crawls across pages, SPAs, subdomains and authenticated journeys find every cookie, pixel, tag and storage entry.
AI and rules map each cookie to Necessary, Functional, Analytics or Marketing — and non-essential tags stay dormant until the visitor opts in.
New or rogue cookies trigger DPO alerts and auto-refresh the cookie policy and banner declarations.
The banner stops being a decorative overlay and becomes an enforcement point — nothing non-essential fires before the affirmative action.
DPDP alignment
What the Digital Personal Data Protection Act, 2023 requires, and the control that satisfies it.
| Section | What the Act requires | How the product satisfies it |
|---|---|---|
| Sec. 6(1) | Consent must be by clear affirmative action, and processing may not begin before it is given. | Prior blocking is the control that makes this real: a tag firing before the affirmative action means processing began without consent, and no receipt can retrofit it. |
| Sec. 6(4) | Withdrawal must be as easy as giving consent. | The banner exposes a persistent re-open control with equal Accept and Reject prominence, so withdrawal is the same number of clicks as the original grant. |
| Sec. 5 | Notice must itemise what is collected and for what purpose. | Cookie declarations are generated from the live scan, so the published policy matches what the site actually sets rather than what it set at launch. |
A tag that fires pre-consent is unlawful processing from the first pageview, and it is the single easiest defect for a regulator or a journalist to verify from outside your perimeter.
Solutions by industry
The sectors carrying the most DPDP exposure for this control, each with its own threat model and regulators.
A DPDP readiness walkthrough maps your obligations to the controls that already exist, and names the gaps that do not.
