New
Policy Studio
Create and maintain DPDP-aware policies, terms and compliance documents with guided drafting and version history.
DPDP-native · Engineered in India
Don't just collect
Don't just collect
consent. Prove it.
Privista is India's DPDP compliance suite. A single snippet collects consent purpose by purpose, blocks tracking until people agree, and writes every choice into a tamper-evident, hash-chained ledger you can hand to a regulator.
Data stays in India
ISO/IEC 27560 receipts
Row-level tenant isolation
Google Consent Mode v2
Consent Ledger
consent.privista.in
4 records · not yet verified
The combination that defines it
Collect. Enforce. Prove.
Most tools do one of these. Free banners collect a choice and stop. Ad-tech CMPs broker consent across vendors. Privista does all three together, under Indian law, with proof at the centre of gravity.
01 / Collect
A notice people actually understand
A clear, itemised notice in the visitor's language. Purpose by purpose, default-off, no pre-ticked boxes, no bundling. Withdrawal is one action, as easy as granting.
02 / Enforce
Tracking stays off until people agree
Non-essential scripts stay inert until the matching purpose is granted. On withdrawal, Privista stops them and clears the cookies they already set. It blocks, it doesn't just remember.
03 / Prove
Evidence, not just a stored choice
Every grant, update, and withdrawal becomes an append-only, hash-chained record with a signed receipt. Recompute the whole chain in one click and prove nothing was altered.
From snippet to proof
How it works, end to end
Two journeys meet in the ledger: the visitor makes a choice, and the business gets provable evidence of it. No re-architecture, no legal guesswork.
The visitor
A choice, respected
- Lands on the siteBefore any non-essential tracking runs, a banner appears in their own language.
- Chooses purpose by purposeAccept all, reject optional purposes, or open Manage choices and choose each consent-controlled purpose. Optional processing is default-off.
- Only granted scripts runThe rest stay blocked. The choice is recorded and a receipt is issued instantly.
- Withdraws anytimeSame preference centre, one action. Scripts stop, cookies clear, downstream systems are told.
The business
Live in an afternoon
- Sign up and accept the DPACreate your organisation. The Data Processing Agreement gates go-live, so scope is clear from day one.
- Verify your domain, publish a noticeDefine itemised purposes with sensible defaults and publish your first notice version.
- Drop in one snippetOne line on WordPress, Shopify, React or plain HTML. The SDK loads async and never blocks rendering.
- Watch consent arriveThe dashboard shows live consent, the searchable ledger, receipts, and one-click chain verification.
The part free banners skip
It blocks. It doesn't just remember.
Recording a choice is easy. Making it operative before tracking fires is the product. Try it: flip a purpose and watch the scripts change state.
- Type-flip blocking
A tracking tag is marked inert so the browser never runs it. Privista replays it only once the matching purpose is granted.
- Google Consent Mode v2
The four consent signals default to denied and update on the visitor's choice, keeping the Google ecosystem in step.
- Unmanaged-script detection
Anything you haven't classified is surfaced in the dashboard as a gap, so your site is never silently broken or silently leaking.
Preference centre
privista.js
Essential site operationAlways active · Not controlled by consent
🔒
Analyticsga4 · hotjar
Marketingmeta pixel · google ads · linkedin
gtag/js · GA4Blocked
static.hotjar.comBlocked
connect.facebook.netBlocked
googleads.g.doubleclickBlocked
Get the framing right
DPDP has no cookie law. It has a consent obligation.
The banner-before-a-cookie rule is European. Under India's DPDP Act the obligation attaches to personal data, not to cookies. State it correctly and you earn a lawyer's trust; get it wrong and you lose it.
Myth
"You must show a cookie banner before setting any cookie." That trigger comes from GDPR and ePrivacy, not from Indian law.
DPDP
The moment a cookie, pixel or script collects something that identifies or relates to a person, that is processing of personal data, and notice and consent are required before it happens.
Privista
Not a "cookie-banner product." It is the mechanism that satisfies a real notice-and-consent obligation, purpose by purpose, default-off, with no Legitimate-Interest tab and no fixed vendor taxonomy.
Runway to the obligations
...Days
..Hours
..Min
..Sec
until the substantive DPDP obligations commence on 13 May 2027
Rules notified13 Nov 2025
Consent Manager registration13 Nov 2026
Obligations commence13 May 2027
Honest comparison
Where Privista is different
Capable international products exist. They were built for GDPR. Privista was built for the notice model, the languages and the legal framing of DPDP, with proof as a first-class feature.
| Capability | Privista | Free plugin | IAB / TCF ad-tech CMP | GDPR-retrofit CMP |
|---|---|---|---|---|
| Built for India's DPDP | Native | No | No | Retrofit |
| Blocks tracking before consent | Yes | Rarely | Yes | Yes |
| Tamper-evident proof ledger | Hash-chained | No | Partial | Partial |
| All personal data in India | Yes | Varies | No | Usually EU/US |
| No Legitimate-Interest tab | Consent-led | Mixed | Has it | Has it |
| Eighth Schedule languages | Yes | No | No | Limited |
Who is behind Privista
Built by a cyber law & Information Security Student at NLIU Bhopal, not a generic SaaS team.
Most compliance software is written by engineers who ask a lawyer to check it afterwards. Privista is built the other way around, by someone studying India's data-protection regime at close range.
That is why the defaults, notice templates and every field in the ledger begin with how the DPDP Act and its 2025 Rules actually read—not a rough approximation of them.
Plans
Start Free. Upgrade only after Ops approval.
One catalog controls public pricing, dashboard access and server-side limits. Paid selections create a request; they never activate a plan automatically.
Start compliant
Free
For one website getting started.
- 500 events/month
- 1 domains · 1 seats
- 2 languages · 1 scans/month
- 6-month online ledger
liveBanner, enforcement and Consent Mode v2liveEnglish + controlled Hindi generation
Start freeFor small organisations
₹799/mo
More traffic, two domains and every scheduled language.
- 25,000 events/month
- 2 domains · 1 seats
- 23 languages · 4 scans/month
- 12-month online ledger
liveAll 23 scheduled languages
Request StarterFor growing teams
₹2,499/mo
Multi-user controls, exports and webhook integrations.
- 1,00,000 events/month
- 5 domains · 5 seats
- 23 languages · 12 scans/month
- 36-month online ledger
liveCSV audit and ledger exportcoming soonRights and grievance workflow
Request GrowthFor high-volume operations
₹6,999/mo
Advanced evidence, branding and integration controls.
- 5,00,000 events/month
- 10 domains · 20 seats
- 23 languages · 30 scans/month
- 84-month online ledger
liveEvidence bundles with hash manifestcoming soonNative mobile SDKscoming soonBreach workflow
Request BusinessCustom governance at scale
Custom
Custom limits, deployment and enterprise controls.
- Custom events/month
- Custom domains · Custom seats
- Custom languages · Custom scans/month
- 84-month online ledger
coming soonOIDC and SAML SSOcoming soonConsent Manager readiness
Talk to usPrices exclude 18% GST. Annual pricing charges for ten months. “Ledger window” means online dashboard/export visibility; older immutable evidence remains preserved under platform and legal retention policy.
| Included allowance | Free | Starter | Growth | Business | Enterprise |
|---|---|---|---|---|---|
| Consent events / month | 500 | 25,000 | 1,00,000 | 5,00,000 | Custom |
| Domains | 1 | 2 | 5 | 10 | Custom |
| Seats | 1 | 1 | 5 | 20 | Custom |
| Languages | 2 | 23 | 23 | 23 | Custom |
| Auto scans / month | 1 | 4 | 12 | 30 | Custom |
| Webhooks | 0 | 0 | 2 | 10 | Custom |
| Online ledger (months) | 6 | 12 | 36 | 84 | 84 |
The questions people ask
Answers, stated correctly
There is no cookie-banner rule in DPDP. What is mandatory is notice and consent before processing personal data. Because most websites process personal data through analytics and marketing scripts, a consent mechanism is needed in practice, and Privista is that mechanism. The obligation attaches to the personal data, not to the cookie.
No, and deliberately so. Privista is a Consent Management Platform that businesses use to collect consent directly from their own users. The business is the Data Fiduciary and Privista is its Processor. The statutory Consent Manager is a separate, registered, regulated intermediary role with a two-crore net-worth gate and certification, which a single-business consent layer does not need.
The ledger is append-only and hash-chained. Each record's hash includes the previous record's hash, so altering any past record breaks every hash after it and is detectable by a verification endpoint. Append-only is enforced at the database role level with a trigger backstop, so even a compromised application credential cannot rewrite history. Each event also has a signed, self-contained receipt.
A business sees only its own data, enforced by the database through row-level security, not just by our code. Privista staff have no standing access. They can only view a tenant's data through a logged, time-limited support session that the tenant can see in its own audit log. So the answer is: only through an action you can see us take.
It blocks. The primary method marks a tag as inert so the browser never runs it, and Privista executes it only after the matching purpose is granted. It also supports Google Consent Mode v2 and a prior-consent API for scripts you load yourself. Enforcement is per script, so you classify your non-essential scripts. Until you do, they run but are flagged in the dashboard as gaps, so nothing is silently broken and nothing is silently hidden.
In India. The database, queue, object storage and backups all run in an India region. The only things on the global CDN are the SDK code and published notice templates, which are not personal data.
Built for the May 2027 obligations
Compliance you can hand to a regulator.
Install one snippet today. Collect consent correctly, enforce it before tracking runs, and keep proof that stands up at a Data Protection Board inquiry.