DPDP compliance, built into the CRM
India's DPDP Act asks a business that holds personal data to prove consent, not just collect it. For businesses selling in India, Vaalo records consent in an append-only ledger, checks it before marketing messages are sent, and handles access, correction and erasure requests with built-in workflows, so the evidence exists when a customer or an auditor asks.
Who agreed, to what, and when they withdrew - recorded so you can answer with evidence.
- a3f9…c21dConsent givenMarketing messages · purpose recorded
- 7be2…90aaChecked at send timeEvery broadcast and agent send
- e04c…b771Consent withdrawnLater sends blocked, reason shown
What the Act asks of you, in plain words
If your business collects personal data, the DPDP Act expects you to take consent for a stated purpose, honour withdrawals, answer requests for access, correction and erasure, protect minors' data with guardian consent, and report breaches. These duties sit with your business; Vaalo's job is to give you the tooling to carry them out inside the system where the data already lives.
The consent ledger
Every consent given and withdrawn is written to an append-only, hash-chained ledger: entries are added, never edited or deleted, and tampering breaks the chain and is detectable. It records who agreed, to what, and when, which is exactly the record a business needs if a customer questions a message.
Checked at send time, everywhere
Consent is not a one-time import filter. It is checked at the moment a message is sent, across marketing broadcasts, scheduled messages, workflow WhatsApp steps, and the outreach of the Chaser, Reviver, Scout and Amplifier agents. A withdrawn consent blocks the send with a clear reason. The consent ledger itself cannot be paused or switched off, even by the platform operator.
Consent checks in the WhatsApp inbox → · Consent rules for AI agents →
Rights requests and the breach register
Access, correction and erasure requests run as tracked workflows with deadlines, so a request is answered rather than remembered. Suspected breaches are logged in a breach register; the 72-hour regulator clock is stamped only when a breach is confirmed, and filing stays a human, platform-side act. Nothing is filed automatically.
An honest note
Vaalo is tooling for your DPDP duties, not legal advice. Compliance also depends on how your business collects consent and handles requests, so take legal advice for your specific obligations. What Vaalo guarantees is that the records, checks and workflows described here exist in the product and run as described.
Questions, answered plainly
What is a consent ledger?
A consent ledger is a permanent record of when a person gave consent, what they agreed to, and when they withdrew it. Vaalo's consent ledger is append-only and hash-chained, which means entries are added, never edited or deleted, and any tampering breaks the chain and is detectable. It is the evidence a business needs if a customer questions a message.
What happens in Vaalo when a customer withdraws consent?
The withdrawal is recorded in the consent ledger and takes effect at send time. Marketing broadcasts and agent outreach to that person are blocked with a clear reason. Messages a business must send to deliver a service it owes the customer are treated separately from marketing, and the distinction is documented in the product.
Is Vaalo DPDP compliant?
Vaalo is built to support your DPDP duties: consent records, send-time consent checks, rights request workflows for access, correction and erasure, and a breach register. Compliance also depends on how your business collects consent and handles requests, so treat Vaalo as the tooling for those duties, and take legal advice for your specific obligations.
See Vaalo on your own leads
Tell us where your leads come from and how your team follows up today. We will show you Vaalo set up for your business type, scope what you need, and give you a fixed quote.