Privacy compliance built on two decades of digital trust.
A two-part programme — consulting first, technology second — covering India's DPDP Act 2023, the UAE's PDPL, and the EU's GDPR, with one Consent Manager platform operationalising all three.
Consulting first. Technology second. One platform for three laws.
Two decades of PKI and digital-trust infrastructure, applied to privacy: consulting, consent management and data-subject rights — under one roof.
Built on trust infrastructure, not bolted on
Our group has built digital-trust infrastructure since 2006 — PKI and DSC certificates, HSM-based signing, Aadhaar eSign, enterprise signing, SSL/TLS lifecycle management, e-stamping, identity and verification APIs, AML tools — and now privacy consulting and consent management. When regulations change, our expertise runs deeper than the regulation itself.
- One Consent Manager operationalising DPDP, UAE PDPL and GDPR side by side
- Identity-verified consent using the same eSign rails we run for signing
- Choose SaaS, on-premise or embedded — data sovereignty is itself a compliance consideration
- A defensible compliance posture — not just a tool subscription
0+
Years of digital-trust experience
0K+
Certificates issued
0K+
Active users on our platforms
0+
Enterprise projects delivered
Three laws, one common claim underneath
If you process personal data, you have binding statutory obligations — with no size-based opt-out.
DPDP Act, 2023
Any entity determining the purpose and means of processing personal data is a Data Fiduciary with statutory obligations — no opt-out. Penalties up to ₹250 crore per violation. Key provisions: Section 4(1)(b) lawful processing grounds, Section 7 consent framework, Section 8 data fiduciary obligations, Section 9 children's data, plus Data Principal rights and cross-border transfer rules.
PDPL — Federal Decree-Law No. 45 of 2021
In force since 2 January 2022, administered by the UAE Data Office. Default lawful basis is consent (Article 4 prohibits processing without it, subject to enumerated exceptions) — stricter than GDPR's multi-basis model. Applies extraterritorially. DIFC and ADGM free zones run their own separate regimes — confirm which applies per client.
Executive Regulations covering breach-notification timelines and DPO criteria are tracked continuously; we confirm the requirements in force for each client at engagement start.
GDPR
Lawful basis under Article 6 (consent is one of six bases, not the only one), DPO obligations under Article 37, data subject rights (access, rectification, erasure, portability — Articles 12–22), 72-hour breach notification (Articles 33/34), cross-border transfer mechanisms (SCCs, adequacy decisions — Articles 44–50).
A two-part programme — consulting first, technology second
We map your data landscape before deploying any infrastructure. You get a defensible compliance posture, not just a tool subscription.
Data & Compliance Discovery
A structured engagement to map, assess and document your personal-data landscape against every obligation under the DPDP Act, UAE PDPL and GDPR.
- Personal-data discovery and mapping across all systems
- Gap assessment — control by control against each applicable law
- Record of Processing Activities (RoPA) overview
- Data Protection Impact Assessment (DPIA) overview
- Compliance roadmap and policy recommendations
Consent & Privacy Infrastructure
Deploying the Consent Manager and Privacy Rights Centre — operationalising compliance in production, not just on paper.
- Consent Manager deployment across all channels
- Purpose-linked, granular consent capture
- Immutable consent audit trail and records
- Privacy Rights Centre — DSAR portal deployment
- ERP / CRM integration over REST API
- Optional add-on modules: RoPA, DPIA
Data Discovery & Mapping — total insight into enterprise data
An automated tool you deploy once to see exactly what personal data you hold, where it lives and how it flows — without manual spreadsheet mapping.
One live inventory. Every module reads from it.
Data Discovery connects to your databases, CRMs, file stores and SaaS applications and builds a continuously updated inventory of personal data — structured and unstructured. Every other module reads from this same inventory instead of keeping its own copy of the truth.
- Automated discovery and classification of personal and sensitive data
- Data assets, owners, processors and cross-border flows mapped in one view
- Retention and lawful-basis mapping per processing activity
- Feeds RoPAs and DPIAs automatically — no stale snapshots
- Deployable as SaaS, on-premise or in your private cloud
Six modules. One complete privacy programme.
Each module deploys independently and works together as a unified privacy-management platform — covering every obligation under DPDP, UAE PDPL and GDPR.
Consent Manager
Capture, store and manage user consents across all channels with purpose-linking, versioning and instant revocation.
Privacy Notice Builder
Generate purpose-specific, plain-language privacy notices per regulation and per language — DPDP, UAE PDPL and GDPR kept accurate from one place.
Privacy Rights Centre
Customer-facing DSAR portal for access, correction, erasure, objection and grievance requests — automated workflows and deadline tracking.
RoPAs
Structured workflow to create and maintain your Record of Processing Activities — audit-ready from day one, fed by the live data inventory.
DPIAs
Structured assessment for high-risk processing — risk scoring against DPDP / PDPL / GDPR criteria, mitigation tracking and sign-off records.
Compliance Dashboard
Real-time view of consent coverage, DSAR queue, audit-trail health and overall compliance posture — for teams and auditors.
Every channel your users are on — covered
The Consent Manager captures, stores and manages consent across four channel types — each with purpose-linking, revocation and a tamper-proof audit trail.
Web Banner & Cookie Consent
A fully customisable, law-aware consent banner for your website — purpose-linked, multilingual and auto-generated. Visitors see granular choices before any data processing begins.
- Purpose-specific consent — no bundled opt-ins
- 22 Indian languages (Schedule 8), Arabic, English and EU languages
- Automatic cookie scanning and classification
- Consent versioning — re-consent on policy changes
- Real-time audit log with IP and timestamp
- One-line JavaScript embed — live in under a day
Mobile SDK
Native consent UI for Android, iOS and React Native — a drop-in SDK that surfaces purpose-linked consent at the right moment in your app’s onboarding or data-collection flow.
- Native SDKs for Android, iOS and React Native
- Contextual consent at the point of data collection
- Offline consent queuing with sync on reconnect
- Localisation across Indian, Arabic and EU languages
- Biometric and PIN authentication integration
- Syncs to the central Consent Manager dashboard
Data consent required
Before we proceed, please approve how your data will be used.
Identity-verified consent
For high-sensitivity processing where consent must be identity-verified and legally non-repudiable — powered by the same eSign rails we run for digital signing.
- India — Aadhaar OTP authentication via the UIDAI / eSign gateway
- UAE — Emirates ID / UAE Pass identity verification
- EU — QTSP-verified identification under eIDAS Article 24(1)(d)
- Cryptographically signed consent artefacts, identity-linked and non-repudiable
- Ideal for banking, healthcare and KYC-heavy workflows
- Full audit trail with the identity-provider transaction reference
● ● ● ● ● ●
API & embedded consent
For organisations collecting data through ERP workflows or backend systems — embed consent capture directly via REST API. No UI changes needed on your side.
- REST API with Swagger documentation and sandbox
- Webhooks for every consent lifecycle event (grant, revoke, update)
- ERP-embedded consent for SAP, Oracle and Dynamics
- Batch consent import for legacy data subjects
- Token-authenticated, HTTPS-only
- Sandbox environment available
POST /v1/consent/record Authorization: Bearer <token> { "data_principal_id": "DP-8821937", "purposes": [ { "id": "analytics", "granted": true }, { "id": "marketing", "granted": false } ], "channel": "api", "lang": "ar" } 200 OK { "consent_id": "CNS-20260614-7741", "status": "recorded", "audit_ref": "AUD-3F9B22" }
Deploy where your data governance demands it
Unlike pure-SaaS consent tools, the Consent Manager supports three deployment models — because data sovereignty is itself a compliance consideration.
SaaS Cloud
- ISO 27001 data centres — data-residency requirements scoped per deployment
- Zero infrastructure overhead — live in days
- Auto-scaled with 99.9% uptime SLA
- Automatic security and compliance updates
- Includes sandbox environment
On-Premise / Private Cloud
- Deployed within your own infrastructure
- Full data sovereignty — no third-party data access
- HSM support for cryptographic audit-trail signing
- LDAP / Active Directory integration
- Custom retention and archival policies
Embedded API / SDK
- Consent logic embedded in your own product
- White-label — no vendor branding required
- Native SDKs: Android · iOS · React Native
- Full Swagger / OpenAPI documentation
- Webhooks for all consent lifecycle events
From kickoff to compliance in 8–12 weeks
Milestone-driven, with clear deliverables at every stage — so your team always knows what comes next.
Consulting
Kickoff & Data Discovery
Stakeholder interviews, system inventory and personal-data-flow mapping across the organisation — structured and unstructured.
Consulting
Gap Assessment
Control-by-control assessment against each applicable law, with a prioritised remediation plan and ownership matrix.
Consulting
RoPA & DPIA Documentation
Regulator-ready Records of Processing and Data Protection Impact Assessments — audit-ready from day one.
Implementation
Consent Manager Deployment
Deployment across all channels, ERP integration and consent audit-trail activation across your applications.
Implementation
Privacy Rights Centre
DSAR portal deployment, automated response workflows and grievance management — every data-subject right enabled.
Handover
Sign-off, Training & Handover
Final compliance review, staff awareness training and complete documentation handover — with optional ongoing retainer support.
Built for organisations that handle personal data across borders
Any organisation processing personal data of individuals in India, the UAE or the EU has obligations. We specialise in these sectors.
Banking, Insurance & FinTech
Banks, NBFCs, insurers and payment platforms with large volumes of sensitive financial and identity data — and layered consent requirements.
Professional Services
Accounting, audit and advisory firms acting as data fiduciaries / controllers for client financial data, with professional-body sensitivity overlays.
SaaS & Technology Platforms
Platforms processing user data as core infrastructure — needing embedded consent and privacy-by-design architecture.
Healthcare & Diagnostics
Hospitals, labs and health-tech platforms managing sensitive health data under heightened obligations.
Enterprise & Manufacturing
Large enterprises with employee, customer and vendor data across locations and ERP systems requiring deep integration.
Multinationals with India, UAE or EU operations
Global entities aligning an existing GDPR posture with DPDP and UAE PDPL requirements — one programme, three laws.
Concrete deliverables. Not just a report.
Every engagement ends with documented assets you own and production tools that keep working.
Personal Data Map
Full inventory across systems, teams and vendors — with classification and retention mapping.
Gap Assessment Report
Prioritised control-gap analysis with remediation actions, ownership and a compliance timeline.
Record of Processing Activities
Regulator-ready RoPA covering all processing, lawful bases, data subjects and retention periods.
DPIA Documentation
Data Protection Impact Assessments for high-risk and automated processing.
Live Consent Manager
Deployed across all channels — with immutable audit trail and real-time dashboard.
Privacy Rights Centre
Operational DSAR portal with automated workflows for every data-subject right.
Policy Documentation Suite
Privacy, consent, retention and incident-response policies aligned to each applicable law — ready to adopt.
Training & Handover Pack
Staff awareness training and complete handover documentation for your compliance team.