by
For your team
Consent health at a glance
How many agreed, withdrew or lapsed, and what needs renewing soon.
DPDP consent management for India
Consent people understand. Proof that holds up.
Sehmat asks for consent on a link, WhatsApp, SMS or paper, in the person's own language. It keeps the notice version that the person saw. It handles withdrawals, rights requests and grievances in one console.
- English and 22 scheduled languages
- Data stored in India
- Paper, link, SMS and WhatsApp
- Audit trail for every decision
Example organisationSecure consent
Englishहिन्दी+21 more
आपकी सहमति आवश्यक है
Your consent is required
अपनी सहमति दें
What you agree to
- Provide the service you signed up forNeeded
- Reminders and updates by SMS
- Share your record with a partner organisation
Confirm it is you
Code sent to 98••• ••210
482619
Thank you
Your consent is recorded.
CNT-EXM-000482Notice v3 · HindiCode by SMS · 13:42 ISTSaved in India
My consents
- Provide the service you signed up for
- Reminders and updates by SMS
- Share your record with a partner organisation
Withdrawn. The organisation has been told.
Step 1 of 5Notice in their language
How it works
Ask. Confirm. Record. Respond.
The same four steps for every consent, whether it starts on your website, in a WhatsApp chat or on a paper form.
- 01
Ask
Show a clear, short notice in the person's own language. Show the purposes, the data and the rights.
- 02
Confirm
Record how the person agreed: OTP, signature, typed name, voice or video. Online, DigiLocker can confirm that a parent or guardian is an adult.
- 03
Record
Keep the notice version that the person saw, the evidence and a receipt. Sehmat stores them write-once in India.
- 04
Respond
Handle withdrawals, rights requests, erasure and grievances. Each request gets a number and a deadline.
At a glance
Built for the people who agree, and the teams who answer.
For the person
Change of mind in one tap
People turn one purpose off and keep the rest. Your systems are told.
For your website
Cookie choices, done right
A light banner on your sites. Scripts wait until the person allows their category.
Who it is for
Built for how India collects consent.
Ready-made templates for all types of organisation. Change all parts and publish.
Field teams, partners and paper
Programs collect consent in villages, camps and centres, often on paper and in local languages, and share data with partners and funders.
- Bilingual paper sheets read back into the record
- Offline collection on Android, synced later
- A register of every partner organisation on a program
- Parent and guardian consent, asked again at 18
Ready-made forms
- Beneficiary enrolment
- Program with partners
- Government scheme
- Direct benefit transfer
- Donation
Patients, records and results
Hospitals, clinics, labs and pharmacies ask for consent at the front desk, online and at camps, and share records with care partners.
- Signed or code-verified consent for each purpose
- Withdrawal of one purpose without losing the rest
- Retention set per purpose and linked to the law
- Proof of the notice each patient saw
Ready-made forms
- Patient registration
- Online consultation
- Hospital admission
- Lab test
- Health record sharing
- Clinical trial
KYC, credit checks and claims
Regulated businesses balance consent with laws that require records to be kept. Sehmat holds both.
- Legal holds on erasure, with the law that requires them
- Verified consent by one-time code
- Signed webhooks into your loan and policy systems
- Re-consent when a form changes
Ready-made forms
- Loan with KYC
- Video KYC
- Bank account opening
- Credit bureau check
- Insurance claim
- Mutual fund KYC
Students, parents and schools
Schools, colleges and learning programs hold data about children. The Act asks for a parent's verifiable consent before processing a child's data.
- A parent or guardian agrees, checked through DigiLocker or document review
- The student is asked again on turning 18
- Photo and video release as its own purpose
- Withdraw one purpose without leaving the school
Ready-made forms
- School admission
- Student enrolment
- Online learning
- Education program
- Photo and video release
- Alumni updates
Citizens, schemes and benefits
Departments and agencies running schemes ask large numbers of people for consent, often through field staff and partner organisations.
- Consent on paper and offline Android where there is no network
- Notices in English and all 22 scheduled languages
- A register of every partner organisation on a scheme
- Requests and grievances tracked to their deadlines
Ready-made forms
- Citizen services
- Government scheme
- Direct benefit transfer
- Social protection program
- Disaster relief program
- Survey and feedback
Customers, employees and visitors
If your organisation decides why and how personal data is used, the Act calls it a Data Fiduciary. That includes most businesses, schools, hospitals and NGOs.
- Employee onboarding, with leavers reported by your HR system
- Connectors for Salesforce, HubSpot, Zoho CRM, greytHR, Keka and Darwinbox
- Roles for admins, operators, DPOs and auditors
- Bulk import from Excel, checked before anything is added
Ready-made forms
- Employee onboarding
- Job applicant
- Visitor entry
- CCTV notice
- Marketing opt-in
- Event registration
In their language
English and all 22 scheduled languages.
Select a language to see the consent screen. Then select Listen. Forms can also read the text aloud and show larger text and high contrast.
What the law says about languages →Show all 22 languages
- Assamese
- Bengali
- Bodo
- Dogri
- Gujarati
- Hindi
- Kannada
- Kashmiri
- Konkani
- Maithili
- Malayalam
- Manipuri
- Marathi
- Nepali
- Odia
- Punjabi
- Sanskrit
- Santali
- Sindhi
- Tamil
- Telugu
- Urdu
Hindi
आपकी सहमति आवश्यक है
सहमति वापस लेने का अधिकार
अपनी सहमति देंWherever people are
Ask anywhere. Track everything in one place.
Each consent goes into one record, with the same proof and the same way to withdraw.
Personal link
Sent by email, SMS or WhatsApp.
QR poster
An open link for counters, camps and notice boards.
On your site
A banner or form inside your own sign-up page.
Printed sheet
Bilingual A4 with a QR code on every page.
Offline in the field
An Android SDK that works without a network and syncs later.
Inside WhatsApp
A form that opens in the chat itself, with Meta's WhatsApp.
Paper is read back, not left in a cupboard.
Print
A4 sheets in any published language, with English beneath each line and a QR code on every page.
Upload
A PDF or phone photos, up to 25 files in a batch.
Read
Pages are straightened, and tick boxes, signature ink and handwriting in Indian scripts are read by AI processed in India.
Review
A person confirms each sheet. You can let clean self-signed sheets through and check 1 in 20.
Paper counts too. Once a paper form is scanned or typed in, the DPDP Act applies to it (section 3). Why paper is covered →
Proof you can show
Show the Board the notice the person saw.
Every consent is stored with the notice version, the language, the evidence and a receipt. Each event is chained to the one before it, so any change to a record shows up.
What valid consent looks like →- 1 Mar, 9:00Notice version 3 publishedSaved exactly as shown, in every language
- 4 Mar, 10:12Consent givenConfirmed with a code sent by SMS
- 4 Mar, 10:12Receipt sentA PDF with the person's consent number
- 9 Jun, 18:40One purpose withdrawnSMS reminders stop, and your systems are told
- Every nightNothing changedEach step is checked against the one before it
Write-once storage
Evidence is kept write-once as proof of consent, for 7 years by default, so it cannot be altered. Only roles you allow can see it.
Hash-chained audit log
Every decision is logged and the chain is checked every night. Export to CSV or your SIEM.
Standard receipts
Receipts are based on ISO/IEC TS 27560 for consent records.
DPDP checks
Key duties under the Act are checked against your live records, with a link to fix each gap.
Rights and requests
Withdrawal as easy as giving. Every request tracked to its deadline.
People manage their consent from one page. Your team handles every request from one inbox, each with a number and a deadline.
Every duty, mapped to the Act →Withdraw at once
One purpose or all of them, at any time. Your connected systems are told by signed webhook, and each confirmation is tracked.
See their data
A plain-language summary in the person's own language, with the data files.
Correct it
Sent to your systems, which report back what changed.
Erase it
Erased with proof, or held where a law says the data must be kept.
Raise a grievance
Assign, prioritise and reply. Every reply explains how to go to the Board.
Name a nominee
Someone they trust can act for them on death or incapacity.
- CNT-EXM-000482WithdrawalSystems told 3 of 3Done
- DSR-EXM-000117AccessSummary readyDue in 12 days
- DSR-EXM-000118CorrectionWaiting for your systemDue in 20 days
- DSR-EXM-000119ErasureLegal holdKept as the law requires
- GRV-EXM-000045GrievanceAssignedDue in 64 days
For developers
Fits into the systems you already run.
Record, share and connect consent events with the tools that you already use.
API and webhooks
Record consent and handle requests from your own apps. Signed events tell your systems what changed.
SDKs
Shared with customers.
- Java
- Node
- React
- Web
- Android
Connectors
Salesforce, HubSpot, Zoho CRM, greytHR, Keka and Darwinbox, or any system through files or the API.
When something goes wrong
Report to the Board within 72 hours. Tell people without delay.
Rule 7 asks you to inform the Board without delay, send a detailed report within 72 hours, and tell every affected person in plain language. Sehmat keeps the clock and the proof.
A 72-hour breach playbook →- The Board report deadline on every incident, flagged when it is overdue.
- A Rule 7 notice to each person by email and SMS.
- The SMS link opens with a one-time code, and every open is recorded.
- A list of who was told and when, ready for the Board.
Built by the team behind Tashi, and in use there today.
The DPDP clock
The main duties apply from 13 May 2027.
The DPDP Rules come into force in phases. Most of what your organisation must do starts on one day.
What starts when →— days
until most DPDP duties apply
13 Nov 202513 May 2027
The Act becomes law
The Digital Personal Data Protection Act receives the President's assent. It sets out how organisations in India must handle personal data.
The Rules are published
The DPDP Rules, 2025 explain how the Act works in practice. The Data Protection Board of India is established in law. It will hear complaints and can impose penalties.
Consent Managers can register
Companies can apply to the Board to become registered Consent Managers. Your own duties have not started yet, so this is the time to prepare.
Your duties begin
Clear notices, valid consent, easy withdrawal, security, breach notices, children's data, rights requests, grievances and erasure all apply from this day.
Dates as notified in the Gazette. A 2026 proposal to bring them forward has not been notified.
Is Sehmat a registered Consent Manager?
No. Sehmat is a consent management platform that organisations (Data Fiduciaries, in the Act's words) use to collect, record and honour consent. Registered Consent Managers are a separate role under the DPDP Act. Rule 4, on registering Consent Managers, applies from 13 November 2026.
Where is our data stored?
In data centres located in India, with database backups in a second Indian region. The AI that reads paper sheets and drafts translations also runs in India.
Does using Sehmat make us DPDP compliant?
No tool can do that on its own. Sehmat gives you the notices, consent records, rights handling, breach workflow and evidence the Act asks for. Your policies and how your teams use them still matter.
We already use a global privacy tool. Do we need Sehmat?
Global tools are often built around cookies and the GDPR. The DPDP Act also asks for notices in Indian languages, consent that works on paper and offline, Rule 7 breach notices and its own rights and deadlines. Sehmat can run alongside your global tool for India and send every decision to it by API and signed webhook.
Where are the API docs?
We share the API reference, OpenAPI files and SDKs when your organisation gets access.
What support and service levels do we get?
They are set out in your agreement with us. We also sign a data processing agreement on request.
How much does Sehmat cost?
It depends on how many people you ask for consent, the channels you use and the help you need to set up. Tell us about your organisation and we will suggest the right plan and price.
How do we get access?
Request access with your organisation's details. A person reviews every request, and we aim to reply within three working days. Once approved, your admin gets a link to set a password, and we help you set up your first forms.
Still have a question?
Talk to usGet ready for the DPDP Act before 13 May 2027.
Request access and a person from our team will set you up.
Gave your consent to an organisation that uses Sehmat? Open My consents · Track a request