Collect consent, prove it, act on withdrawals and erasures, answer rights requests and report breaches. Six modules, one chained record.
3 checks failing. Each one links to its fix.
Choose your starting point. Each path uses the same platform and the same record.
Create one application, write one notice, and add the website script. Consent starts to flow into a record you can prove. Then add the portal so customers can withdraw without a call to you.
You must also act on a withdrawal, erase data when its purpose ends, answer rights requests on time, and report a breach in 72 hours. Promiz adds these duties to the consent you already collect.
Each website, app or loan system is an application with its own branding, domains, keys and webhooks. Admins and Viewers see only what their role allows. Signed webhooks keep your CRM and data systems in step.
Every step writes to the same record. When a customer changes their mind, Promiz opens a task for your team and keeps the proof in the same chain.
Banner, form or email in 23 languages
Per purpose, with optional OTP check
Fingerprint, version, screen snapshot
Withdraws or raises a rights request
Deadline starts; webhook sent
Your system confirms back
The closing proof is a new entry in the same chain. Nothing is edited or deleted.
Switch on the modules you need. Each one reads and writes the same record, so proof is never split across tools.
No-code notices for your website, forms and email.
Find what runs on your site and file it under the right purpose.
A permanent, chained record of every grant, change and withdrawal.
A branded self-service site and a request queue for your team.
Deadlines for stopping processing and for erasing data.
Log, track and report a breach against the clock.
How each part of Promiz works, and which DPDP duty it serves. Your legal team decides purposes, legal bases and retention periods; Promiz runs the process.
Last reviewed 18 Sep 2026
You build a notice in five steps, without code, and choose how it shows: a cookie banner on your site, a consent panel inside a form, or an emailed request with a single-use link. Each purpose gets its own choice, so required and optional processing are handled apart.
The binding text is written once and fingerprinted. Promiz stores that version with every consent it collects, in English and the 22 Eighth Schedule languages, so you can always show exactly what a person agreed to and in which language.
Maps to: S. 5 · Rule 3 - Clear, itemised notice before processing · S. 6 - Free, specific consent for each purpose · S. 9 · Rule 10 - Verifiable consent for children's data
The scanner crawls your site and lists every cookie, script and tracker it finds, then files each one under a cookie category and the purpose it serves. Every run is kept, so you can see what changed between scans.
The website script blocks each tag until its purpose is allowed. When a visitor makes a choice in the banner, only the tags they permitted fire, and the choice is written to the consent record like any other.
Maps to: S. 5 · Rule 3 - Clear, itemised notice before processing · S. 6 - Free, specific consent for each purpose
Records are never edited or deleted. Every grant, change and withdrawal is a new entry linked to the one before it, so the history of a consent is a chain rather than a row that gets overwritten.
Promiz walks that chain in one click and flags any break. Each record also keeps a snapshot of the screen the customer saw, the notice version and language, and can be exported as a PDF receipt or in machine-readable form.
Maps to: S. 6 - Free, specific consent for each purpose · S. 6(4) - Withdrawal as easy as consent
Customers sign in with a one-time code, see every consent they have given, withdraw any of them, and raise access, correction, erasure, grievance or nomination requests without calling you. The portal is a branded site with your logo and colours.
On your side, every request lands in one queue with a clock on it: 30 days by default, with the grievance period set by you. Customers get an email when a request is opened and when it is closed, and identifiers stay masked until someone needs to reveal them.
Maps to: S. 11–14 · Rule 14 - Access, correction, erasure, grievance, nomination · S. 6(4) - Withdrawal as easy as consent
"Stop using it" and "delete it" are different duties under the Act. A withdrawal opens a stop-processing task with a confirmation deadline; an erasure starts when a purpose ends and sends a 48-hour notice before anything is deleted. Promiz keeps the two apart so data you must keep by law is never erased by mistake.
Legal holds freeze the clock at three levels for a dispute or investigation. A deletion task can only be closed by your system confirming back, so the record shows machine proof rather than a manual tick.
Maps to: S. 6(6) - Stop processing after withdrawal · S. 8(7) · Rule 8 - Erase when the purpose ends
The 72-hour countdown starts on screen the moment you log a breach, with its severity and who is affected. You then record your investigation and fixes as they happen.
Promiz builds the structured Rule 7 report from what you recorded, and tracks every notice you send to the Board and to affected people, so you can show who was told and when.
Maps to: S. 8(6) · Rule 7 - Report a personal data breach
One login for all your products. Each website, app or back-end system has its own branding, domains, API keys and webhooks. Keys are bound to your allowed domains, so a leaked key does not work anywhere else.
A live view of consent activity, open requests and your DPDP compliance score. Each failing check links to its fix. Trend charts cover 7, 30, 90 or 365 days, with CSV export.
Invite staff as Admin (full control) or Viewer (read-only). Promiz stops you from removing your last Admin.
Email addresses are encrypted at rest. IP addresses and phone numbers are stored only as one-way codes. The database keeps each business's data separate. Every admin action goes into a tamper-evident audit trail.
DPDP work crosses teams. Each team works in the same record, with the view it needs.
Decide purposes, legal bases and retention once. Prove them for every consent.
Run campaigns only on purposes the customer allowed.
One script, one API, one set of events.
Evidence you can hand to an auditor or the Board.
Consent comes in from each channel. Every change goes out at once as a signed webhook, so your tools act only on what the customer allowed.
Signed - verify each message with your signing secret.
Retried - failed sends retry, then wait for your review.
Logged - inspect, resend or test any delivery.
Events you can subscribe to
Connect any tool that accepts webhooks or calls an API. Promiz does not ship pre-built app connectors today.
Yes. Each module can be switched on separately, but they all write to the same chained record. Most teams start with notices and the cookie scanner, then add the portal and obligation queues as their DPDP programme matures.
Through a REST API and Python SDK for your own apps and forms, an emailed consent request with a single-use link, and consent captured inside KYC or onboarding flows with an OTP check. Every channel writes the same record.
By signed webhook, sent at once. Failed deliveries are retried and then held for your review. Your system confirms back to Promiz, which is what closes the stop-processing or deletion task.
For any consent: the notice version and language shown, a snapshot of the screen, every later change in a linked chain, and a receipt in PDF or machine-readable form. Promiz verifies the chain in one click, so a break in the record shows immediately.
Purposes can carry a child restriction, and guardian consent is verified against an adult identity through DigiLocker. Exempt classes under Rule 12 are recorded for the organisation and applied per purpose. Confirm which exemptions apply to you with your legal team.
Promiz is built for India's DPDP Act 2023. It is not a GDPR tool. Today it does not act as a registered Consent Manager and does not control cross-border transfers.
A 30-minute session on your own use case.