SecureDApp launches SecureCMS for bank and NBFC DPDP consent records

Bengaluru-based SecureDApp launched SecureCMS on November 2, 2026, a consent management platform aimed at banks, NBFCs and other financial institutions preparing for India's Digital Personal Data Protection rules. The Tribune, citing an ANI report, and Elets BFSI both covered the launch. Consent Manager provisions of the DPDP Rules, 2025 take effect on 13 November 2026, while the main notice, consent, security and breach duties apply from 13 May 2027, leaving lenders roughly six months to show how they capture and prove consent.

SecureCMS is built around banking workflows rather than a website cookie banner. According to both outlets, it records OTP-verified consent at branches, mobile and net banking, DSAs, business correspondents, call centres and WhatsApp. It stores purpose-level records per product, including notice version and language, with notices in English and the 22 Eighth Schedule languages. Withdrawals sync in real time to core banking, loan origination, CRM and marketing systems through APIs, webhooks and SDKs.

A central design choice is a legal-hold engine that separates stop-processing from erase. Section 6(4) of the DPDP Act lets a customer withdraw consent at any time, yet PMLA and RBI KYC rules require certain records to be kept for years. The platform also limits data shared with DSAs and collection agencies, runs rights-request and grievance workflows, and keeps a tamper-evident audit trail for auditors or the Data Protection Board. SecureDApp says the same software packages sector frameworks for fintech, insurance, broking, healthcare and other industries, and that SecureCMS is a consent management platform for a fiduciary's own operations, not a registered Consent Manager under Rule 4.

Elets BFSI and The Tribune both note co-founder and CTO Himanshu Gautam's point that the hard problem is keeping consent consistent across a core banking system, loan origination, CRMs and partner integrations by treating every consent and withdrawal as an event each system must acknowledge. Abhishek Singh, quoted in The Tribune piece, said May 2027 is when the Board can start asking questions, so institutions should use the next six months to fix consent records. SecureDApp clarified it is not asking banks to become Consent Managers; SecureCMS is meant to work alongside registered Consent Managers as that ecosystem forms.