Protean launches Enterprise DPDP Governance & Consent Platform at Global Fintech Fest

MUMBAI, India, Sept. 24, 2026 /PRNewswire/ -- Protean eGov Technologies today launched its Enterprise DPDP Governance & Consent Platform at the Global Fintech Fest in Mumbai. The platform was launched at the Protean pavilion by Shri Suvendu Pati, Chief General Manager, FinTech Department, Reserve Bank of India, who spoke at the event on consent as a design principle for India's digital financial ecosystem.

The Digital Personal Data Protection Act, 2023 has moved decisively from statute to operation. With the DPDP Rules notified in November 2025 and substantive obligations enforceable from May 2027, organisations are required to demonstrate privacy governance that is continuous, auditable and evidenced.

At the centre of the platform is the consent stack. DPDP-compliant consent journeys are embedded directly within an enterprise's existing web, mobile and assisted channels, so a customer never leaves the journey they are in. When consent is granted, updated or withdrawn, the policy engine validates the request, propagates it automatically to every mapped enterprise application and third-party processor, tracks acknowledgement, and writes an immutable artefact to the consent vault – producing regulator-ready evidence from the customer's action itself rather than from a subsequent reconciliation exercise.

The platform brings the eight statutory obligations of a Data Fiduciary into a single operating system for privacy, organised across four governance pillars. Internal Privacy Governance covers data discovery, the Record of Processing Activities, data flow mapping, gap assessment and governance dashboards. Processor Risk Governance covers Data Protection Impact Assessments, a central processor registry, third-party risk assessment and remediation tracking. Data Principal Governance covers consent management, a rights management portal, grievance redress and dedicated workflows for minors and nominees. Regulatory Operations covers retention and deletion, breach management, audit monitoring and compliance reporting.

Speaking at the launch, Shri Suvendu Pati, Chief General Manager, FinTech Department, Reserve Bank of India, said: "The Digital Personal Data Protection Act moves consent from a matter of paperwork to a matter of design. For the financial sector, the task ahead is to make consent verifiable, revocable and auditable at scale – so that every individual knows what data is being used, for what purpose, and retains the ability to withdraw that permission at any time."

Speaking on the launch, Mr. Ajay Rajan, MD & CEO, Protean eGov Technologies, said: "Consent is becoming the connective tissue of India's digital economy. Our conviction is that privacy and growth are not opposing forces – an enterprise that can show an individual exactly what was permitted, when, and for how long, earns the trust that lets it do more, not less. That is the shift we are enabling: from privacy as a legal obligation to privacy as an enterprise capability."

Speaking at the launch, Mr. Rakesh Dosi, Chief Business & Product Officer, Protean eGov Technologies, said: "Most enterprises today can tell you their privacy policy. Very few can tell you, for a single customer, what was consented to and which downstream system acted on it. One customer action should update every mapped system and leave behind evidence – that is what we have built."

Protean eGov Technologies has built and operated national digital public infrastructure for over two decades. As an Account Aggregator licence holder, the company brings direct operating experience of the consent artefact lifecycle – issuance, revocation and secure data sharing – at national scale. This is that same conviction applied to Privacy.

To know more - https://www.proteantech.in/services/consent-stack 

Product note

Protean Enterprise DPDP Governance & Consent Platform

Launched at the Global Fintech Fest, 11ᵗʰ September 2026, Mumbai

The Digital Personal Data Protection Act, 2023 is no longer a policy exercise. The Rules were notified in November 2025, the Consent Manager registration framework comes into force in November 2026, and substantive obligations become enforceable from May 2027 with penalties of up to ₹250 crore. Multiple stakeholders – the Data Principal, the Consent Manager, processors, third-party vendors, internal business functions and the Data Protection Board – converge on a single accountable owner: the Data Fiduciary. Every one of those connections is an obligation to design, run and evidence.

Embedded consent experience. DPDP-compliant consent journeys are deployed within an enterprise's existing web, mobile, branch, contact centre and partner channels. Consent is captured against the five principles of validity – freely given, specific, informed, unconditional and unambiguous – with itemised notice and unbundled purposes. Customers never leave the journey they are in.

Intelligent consent orchestration. A single customer action – consent granted, updated or withdrawn – is validated by the policy engine, propagated automatically to every mapped enterprise application and processor with acknowledgement tracked, and recorded instantly as an immutable artefact in the consent vault. Compliance evidence is a by-product of the transaction, not a separate exercise.

Four governance pillars. Internal Privacy Governance – data discovery, ROPA, data flow mapping, gap assessment and governance dashboards. Processor Risk Governance – DPIA, third-party risk management, processor registry and remediation tracking. Data Principal Governance – consent management, rights management portal, grievance management, minor and nominee workflows. Regulatory Operations – retention and deletion, breach management, audit monitoring and compliance reporting.

Regulatory automation. Retention runs on configurable, purpose-based timelines with automated deletion triggers, propagation to processors and retained deletion evidence. Breach management runs from incident intake and severity classification through a 72-hour notification workflow and regulator communication to root cause analysis and closure.

Relationship-based workflows. Verifiable guardian consent before any processing of a minor's personal data, with age validation and transition on attaining majority. Nominee registration with identity validation and controlled, auditable rights access upon a defined invocation event.

One source of truth. Discover, map, design, orchestrate, evidence – every downstream privacy activity is derived from verified enterprise metadata rather than manual configuration, on a governance foundation of a policy engine, workflow orchestration, an API gateway, the consent vault and an immutable audit trail.

A six-stage path to compliance maturity runs from data discovery and ROPA through data flow mapping, DPIA and processor assessment, and gap remediation, to continuous privacy operations – combining advisory, governance, process design and technology enablement in a single engagement.

Protean eGov Technologies has built and operated national digital public infrastructure for over two decades, is an Account Aggregator licence holder with proven experience of the consent artefact lifecycle, and has implemented consent management capabilities for initiatives including Bima Sugam and CERSAI. This is that same conviction applied to Privacy.

About Protean:

Incorporated in December 1995, Protean eGov Technologies Limited is engaged in the business of developing citizen-centric and population-scale e-governance solutions. Protean is an information technology-enabled solutions company conceptualizing, developing, and executing critical and population-scale greenfield technology solutions. The company collaborates with the Indian government and has extensive experience in creating digital public infrastructure and developing innovative citizen-centric e-governance solutions.