Readiness Program
Consent and data-rights toolkit
Collect consent the way DPDP expects, prove it later, and answer access, correction, erasure and grievance requests without a scramble. It plugs into VerifID Forms, and works on any other form too.
What is live and what is in early access
- Per-purpose consent capture and a linked notice on forms
- Optional share-with-business consent cards, unticked by default; declining changes nothing about the encrypted submission
- End-to-end encryption of every response with keys only the form owner holds
- Embed events for host pages (see the embed guide)
- Multi-language consent widget for web, Flutter and React forms
- Hash-chained, signed consent log with anchoring
- Rights-request portal with connectors and SLA timers
- Verifiable readiness badge tied to your live form setup
How the consent widget behaves
No pre-ticked boxes
Every purpose starts unset. The record schema rejects a pre-ticked consent outright.
One toggle per purpose
No bundled "I agree to everything". Accept-all and reject-optional carry equal visual weight.
Service never conditioned on optional consent
The form submits with every optional purpose declined.
Notice before consent
A plain-language notice summary sits above the toggles, in the person’s own language.
Withdrawal as easy as giving
A persistent "Manage consent" entry point, no more steps than granting.
Exact text kept as evidence
The notice version and a hash of the text each person saw are stored with their choice.
Embed (early access API)
VerifIDConsent.mount("#vf-consent", {
formId: "signup_v3",
noticeVersion: "2.1.0",
languages: ["en-IN", "hi-IN", "ta-IN"],
purposes: [
{ id: "account_creation", required: true },
{ id: "product_updates", required: false },
{ id: "analytics", required: false }
],
blockUntilConsent: { analytics: ["mixpanel.com"] }
});Hindi and regional text ships only after a native-speaking legal reviewer signs it off; machine-translated legal text is never released.
The consent record
Each choice becomes one immutable event. Fields stored per event:
Handling data-rights requests
A person asks, we verify them with a one-time code sent to the contact you already hold (never new ID documents), a case is opened with SLA timers, work fans out to every system, and the closing letter names the Data Protection Board as the next step.
| Request | Basis | What happens |
|---|---|---|
| Access | DPDP s.11 · GDPR Art. 15 | Summary of data, processing and recipients, plus consent history. |
| Correction | DPDP s.12(1) · GDPR Art. 16 | Applied at the source and propagated to processors with acknowledgement tracking. |
| Erasure | DPDP s.12(3) · GDPR Art. 17 | Deleted or anonymised everywhere, unless a legal hold applies, and then you are told why. |
| Withdraw consent | DPDP s.6(4) · GDPR Art. 7(3) | Processing for that purpose stops within 24 hours; processors are notified. |
| Grievance | DPDP s.13 | Routed to your Grievance Officer: acknowledged in 48 hours, answered within 30 days, with the Data Protection Board named as the next step. |
Frequently asked questions
Is the consent toolkit available today? ▾
Part of it is. VerifID Forms already gives respondents optional, unticked-by-default consent cards and keeps every submission end-to-end encrypted. The tamper-evident consent log, multi-language widget for non-VerifID sites and the rights-request portal are delivered through the Readiness Program and are in early access.
Can the consent log be edited after the fact? ▾
The design is append-only: grants, changes and withdrawals are separate events, each hash-chained to the previous one and signed, with periodic anchoring to write-once storage. Altering a past record breaks every later hash, which makes tampering detectable.
How do you store an IP address without over-collecting? ▾
By default only a truncated IP and a keyed hash are stored. Storing the full address is an opt-in with its own purpose and retention period.
How does erasure work if the consent log is immutable? ▾
Personal fields in the log are encrypted with a per-person key. On erasure the key is destroyed, so the record becomes unreadable while the hash chain stays valid as evidence that a lawful process happened.