5 Best Consent Management Tools for Banks in India, Judged on Withdrawal Proof

If you run privacy at a bank, you already know where consent goes wrong. The customer ticks a box on a branch form, says yes to a BC agent, taps "agree" in the app and tells the call centre to stop calling. Four channels, four records, and none of them stored the same way. Then the customer complains that the telemarketing vendor still rings, and you can't show the regulator that their "no" ever left the CRM.

Your customers notice. In a LocalCircles survey reported on 10 July 2026, 97% of the mobile users who answered said they get unwanted or spam calls every day, and 79% get three or more. That question drew 20,456 answers; the whole survey drew over 40,000 responses from 325 districts (Fortune India, 10 Jul 2026; NewsMeter, 13 Jul 2026). LocalCircles reads the rise in calls from personal-looking numbers as outsourced lead-generation agents. If your bank uses outsourced callers, a withdrawal has to reach them too.

You're here for a shortlist of consent management tools that work for a bank, so I built one around the places banks collect consent and the records banks must keep. I judged five tools against four bank tests, and I've written down where KYC retention beats a withdrawal. Read to the end and you'll have a demo script that shows in 30 minutes whether a tool can prove a withdrawal reached every system and vendor.

TL;DR

Consent management for banks covers branch forms, cross-sell calls and partner APIs, plus a KYC file you must keep after the customer says no. Pick the tool that keeps all of it on one customer record and can show an auditor which processing stopped and which had to continue by law.

1. Redacto: best for banks that need proof a withdrawal reached every mapped system and vendor, across branch, app, web and call centre. (Full disclosure: we build it.)
2. Consentin by Leegality: best for public sector banks that want on-prem deployment and a named bank reference (Union Bank of India).
3. Perfios DPDP Suite: best for banks that already run Perfios in lending, where consent has to follow the loan from account opening to collections.
4. OneTrust: best for banks with overseas branches that already use OneTrust for GDPR and want India under the same contract.
5. KGreen Consent Management (KonneCX): best for cooperative banks whose first problem is checking consent before every SMS, call, email and letter.

The 5 tools compared

This is the consent management platform for banks comparison I'd want on my desk before a procurement call. Where a cell says "Ask", the vendor doesn't make it clear, so put it on your demo list.

How we chose

Bank customer consent management software has to pass tests a retail banner tool never faces. These are the four pass/fail checks I'd use in your seat:

1. Offline capture. Does it take consent from the branch, the BC agent and paper forms as well as web and app, on the same record?
2. Consent kept apart from legal duty. Does it hold purposes that rest on consent separately from data the bank must keep by law, on the same customer record?
3. Withdrawal with evidence. When a customer withdraws, does the change reach downstream systems and vendors, and can you export proof that each one acted?
4. Indian hosting and languages. Can it run in India or on-prem, and offer the notice in English plus the 22 languages of the Eighth Schedule?

I've judged these tools the way I'd judge them for my own team: demos, product documentation, published pricing and what teams running them report, read against how consent breaks in a bank. User opinions come from G2, Capterra, Gartner Peer Insights and Reddit.

Full disclosure: we build Redacto, and it's first on the list. Nothing here is a paid placement, and no vendor saw the draft. Redacto gets the same five sections as everyone else, weaknesses included.

After Redacto, the order is mine: Consentin is the only one with a bank deployment you can point to, and KGreen has the least evidence behind it.

Left out, in one line each: SecureCMS by SecureDApp and ConsentGuard are smaller or NBFC-first; ConsentOS and Surepass are NBFC-first and covered in our finance post; Securiti is DSPM-first and sits in the BFSI suite comparison below. AuthBridge isn't listed because its consent platform is "powered by Redacto", so listing it would count us twice.

If you need DSARs, DPIAs and vendor risk in one suite rather than consent alone, read our DPDPA compliance platforms for BFSI comparison instead.

What changes when the Data Fiduciary is a bank

DPDP consent management for banks starts with one uncomfortable fact: a lot of what a bank does with customer data doesn't rest on consent at all. KYC, transaction records and reporting to regulators rest on law. Marketing, cross-selling and partner sharing rest on consent. Your tool has to keep the two apart, or every withdrawal turns into an argument.

So how do banks manage customer consent under the DPDP Act? In practice, three moves: capture each consent purpose on its own with a notice the customer can read in their language, store it on one record no matter which channel it came from, and push every withdrawal to the systems and vendors that act on it while the legal holds stay in place.

The dates matter. The DPDP Rules 2025 were notified on 13 November 2025 (G.S.R. 846(E)). Rule 4 on Consent Managers applies from 13 November 2026, and the notice, consent, rights, breach and Significant Data Fiduciary duties in Rules 3, 5 to 16, 22 and 23 apply from 13 May 2027 (MeitY, DPDP Rules 2025; PIB, 14 Nov 2025). Our DPDP Rules explainer has the full timeline.

Large banks should plan for being named a Significant Data Fiduciary, which brings a DPO based in India, an independent data auditor and periodic impact assessments (section 10, with Rule 13 from 13 May 2027). No bank, and no class of Data Fiduciary, has been notified under section 10 yet. I'd budget as if you will be.

KYC records: keeping them doesn't depend on consent

Does a bank need consent to keep KYC records? No. The RBI tells it to keep them. The RBI (Commercial Banks – Know Your Customer) Directions, 2025, updated as on 1 October 2026, say a bank must keep transaction records for at least five years from the date of the transaction, and identification and address records for at least five years after the business relationship has ended (para 50) (RBI).

The DPDP Act agrees. Section 8(7) tells a Data Fiduciary to erase personal data when consent is withdrawn "unless retention is necessary for compliance with any law for the time being in force". The Act's own example under that clause is a bank: a customer closes her savings account, the bank must keep her identity records by law, so it keeps them.

One detail I'd flag to your legal team: the Act's example says ten years, which matches the PMLA rule before a 2013 amendment cut it to five. PMLA section 12 and the RBI's KYC Directions now say at least five years after the relationship ends, and other laws can require longer for some records. The example explains section 8(7); it doesn't set the period. Take each period from your counsel.

What the RBI text does tie to consent is narrower than most banks assume. The bank needs "the explicit consent of the customer" to collect information beyond what its own KYC policy specifies (para 17(5)), and an explicit consent to download records from CKYCR. Whether the data you collect at account opening rests on consent or on a legal duty is a question for your counsel, purpose by purpose. Don't let a tool vendor answer it for you.

So, can a bank delete your data if you withdraw consent? It must stop using the data for the purposes that rested on consent, like marketing and partner sharing, and erase that data unless a law requires it to keep it. KYC and transaction records stay for the RBI's minimum periods. A good tool shows both on the same screen: "marketing withdrawn, stopped on these systems; KYC held under para 50 until this date".

Withdrawal itself must be easy. Section 6(4) says the ease of withdrawing has to be "comparable to the ease with which such consent was given". If the customer gave consent with one tap in the app, a branch visit to withdraw it won't pass.

Read our guide to DPDP Act compliance requirements for the rest of sections 6 and 8.

Branch forms, BC agents and call centres

The DPDP Act covers paper. Section 3 applies the Act to personal data collected in digital form and to data collected "in non-digital form and digitised subsequently". Branch and paper consent forms under DPDP are therefore in scope the moment someone scans them or types them into the core banking system, which is almost always.

On many bank forms, the branch tick box is where consent goes to die. It's a bundled tick box on an account opening form, stored as a PDF nobody can query, with no notice version attached. The fix isn't to stop using paper. It's to record each paper consent on the same customer record as the app and web consents, with the channel, the notice version and the date, so a withdrawal in the app also covers the branch consent.

Two rules make this harder for banks than for retailers. Section 6(3) requires the consent request to be available in English or any language in the Eighth Schedule, and BC agents in rural branches work in many of them. And section 6(10) puts the burden of proof on you: if a question arises, the Data Fiduciary must prove notice was given and consent was given. A call-centre "yes" with no recording reference isn't proof.

Marketing calls: TRAI's Digital Consent Acquisition and the 1600 series

TRAI's Digital Consent Acquisition (DCA) for banks is a joint TRAI and RBI pilot announced on 10 December 2025. Nine telecom operators and eleven banks took part: SBI, PNB, Axis Bank, Bank of Maharashtra, Canara Bank, Kotak Mahindra Bank, IndusInd Bank, ICICI Bank, HDFC Bank, Indian Overseas Bank and Punjab & Sind Bank (TRAI press release 150/2025).

The banks upload old and new promotional consents to a shared digital platform. Selected customers get an SMS from short code 127000 with a link to their telecom operator's consent page, where they can see the consents those banks hold against their number and keep, change or revoke them. TRAI's own reason for the pilot: under the 2018 TCCCPR rules, uploading legacy consents taken on paper forms and at outlets proved so hard that "full implementation could not be achieved".

That's the bank's own consent problem, described by the telecom regulator. If your promotional consents live in branch PDFs and a vendor's spreadsheet, you can't upload them to anything. A consent tool should give you an export of current promotional consents per mobile number, with source and date, and take revocations back from the telecom side.

The second TRAI change is the 1600 number series. A TRAI Direction of 19 November 2025 set the last dates for RBI-regulated entities to move service and transactional calls to 1600 numbers (TRAI press release 135/2025):

• Commercial banks (public, private and foreign): 1 January 2026
• Payments banks, small finance banks and NBFCs with assets above ₹5,000 crore: 1 February 2026
• Remaining NBFCs, cooperative banks, regional rural banks and smaller entities: 1 March 2026

That's the split banks keep getting wrong: an EMI reminder is servicing, a pre-approved loan offer is marketing. The second needs consent, recorded per purpose.

This is also the answer on consent for cross-selling insurance and loans by banks. Treat each cross-sell as its own purpose: "insurance offers" and "loan offers" separate from "account servicing", each with its own notice and its own withdrawal. Bundle them into one tick box and section 6(1) ("specific", "unconditional") is hard to meet.

Consent Managers and Account Aggregators aren't the same thing

The difference between a Consent Manager and an Account Aggregator comes down to which law, which data and who regulates it. A Consent Manager under DPDP section 6(7)-(9) is a person registered with the Data Protection Board through whom a customer can give, manage, review or withdraw consent with any Data Fiduciary. Rule 4 on their registration applies from 13 November 2026, and Consent Managers must be Indian companies (PIB, 14 Nov 2025). An Account Aggregator is an RBI-licensed NBFC that moves financial information between providers and users with the customer's consent, governed by the RBI (Non-Banking Financial Companies – Account Aggregator) Directions, 2025, issued 28 November 2025 (RBI).

Sahamati, the AA industry body, has argued that the Board should deem or register operating AAs as Consent Managers for financial data (Sahamati). That's a proposal, not law.

If you searched for a DPDPA consent manager for BFSI, here's what it means in practice: a consent management platform is software your bank runs. A Consent Manager is a registered third party acting for the customer. Your platform should accept consents and withdrawals that arrive through a registered Consent Manager and put them on the same record. Read our explainer on the role of the Consent Manager in the DPDP Act.

What compliance tools help banks enforce consent and privacy across digital channels?

Three kinds. A consent management platform captures and stores purpose-wise consent from web, app, IVR and branch. A preference or communication check stops an SMS, email or call before it goes out without valid consent. And downstream connectors push withdrawals to the CRM, the dialler, partner APIs and vendors, with proof each one acted.

Most banks buy the first and assume they've got the third. Ask for the third by name. App-first banks should also read our guide to consent management for iOS and Android apps, since that's where your volume sits.

1. Redacto

We built Redacto to check that every withdrawal reaches the systems that use the data, and to turn the result into a statement an auditor can read. The sample record in our product is a bank's, "Acme Retail Bank", with an "Account opening" purpose marked as required and separate marketing and analytics choices.

Features

• One customer record across channels. Web forms, apps, phone and paper consents land on the same record, and each route keeps its own notice version.
• A receipt per consent. Every consent gets a timestamped receipt linked to the notice version.
• Withdrawal pushed downstream, with proof. Each withdrawal goes to every system and processor mapped to that purpose. Redacto checks that each one acted, follows up on the ones that didn't, and records the result in a Consent Reconciliation Statement.
• Legal duties recorded apart from consent. Processing that rests on a legitimate use under section 7 is recorded with the ground noted, and retention is set per purpose. That's how you show "marketing withdrawn, KYC held".
• Languages. English plus the 22 Eighth Schedule languages.
• Consents through Consent Managers. Consent given or withdrawn through a registered Consent Manager lands on the same record.
• Legacy consents. Historical consents can be loaded and tagged by original source. That's the TRAI legacy problem in one feature.
• Children. Parent or guardian consent with a record of how identity and age were checked, per Rule 10.

Pricing

Pricing follows volume, and each module counts it in its own way. For consent, the thumb rules are your data principal count and how many data processors you have, since every processor adds API calls for each withdrawal and each new customer. Industry matters too: a plain B2B flow hitting two API endpoints is far simpler than physical-to-digital flows where company agents access data, and a bank with branch forms and BC agents sits at the complex end. I walk through it in this short video Redacto posted on LinkedIn:

It runs as SaaS, in your private cloud or on-prem, and most teams go live on their first channel in a week.

Reviews

Three customers, in their own words:

Prem Kumar, Data Protection Officer, Pine Labs Group: "Privacy across a group of businesses is hard because every team has its own systems and its own idea of what personal data it holds. Redacto gave us one view of where personal data is collected, why we collect it and where it goes. When a customer request or an audit question comes in, I answer it with evidence, not a round of emails."

Surya N, Director, Product Management, TimePay: "As a product team, we had one worry: would privacy compliance hurt the onboarding journey? It didn't. Redacto's consent flows fit into our app with very little engineering effort, and we change notices from the console instead of shipping a new build. Our users get a clear choice at every step, and we get a consent record we can stand behind."

Saif, Head, Infosec Compliance & Privacy, Razorpay: "Our vendor security and privacy reviews used to live in spreadsheets and long email threads. With Redacto, every assessment, every piece of evidence and every follow-up sits in one place. When a customer sends us a security questionnaire, we answer it from that same record. We focus on the vendors that actually carry risk, and the paperwork no longer runs the week."

Clients

By our own count we've done "40+ successful implementations", and we can't name a bank customer publicly yet. Pine Labs Group, TimePay and Razorpay are quoted above.

Summary

Pick Redacto if your audit pain is proving that a withdrawal stopped marketing everywhere, branch and vendors included, while KYC data stayed on hold. The weaknesses are real: no public reviews yet, no named bank, and reconciliation only covers the systems and vendors you map. If your dialler vendor isn't connected, the statement can't vouch for it. Book a consent demo and bring one channel you collect consent on today.

2. Consentin by Leegality

Consentin is Leegality's DPDP product. Leegality is best known in banking for eSign and eStamp, and Consentin sells consent, cookie consent, data lifecycle, DPIA and breach modules on top.

Features

• 22 Indian languages for consent and cookie collection.
• Consent Check API, webhooks and reports to sync consents across business and third-party databases.
• Channel connections across CRM, LOS, website, app and IVR. For a bank, LOS and IVR are the two that matter.
• Modules for consent management, data lifecycle management, assessments, DPIA, risk register, cookie consent and breach management.
• Certifications listed: SOC 2, ISO 27001:2022, 27017, 27018 and 22301.

Branch and paper capture is the gap I'd test first; make Consentin show you a paper form landing on the customer record.

Pricing

Consentin is the only tool here with a public price. The Starter Pack gives 3,000 consent collections a month at ₹0. Above that you buy monthly packs of consent collections and consent checks. The SaaS version is an annual or quarterly flat fee. The on-prem version is an annual fee based on the number of profiles, with data discovery priced by connectors and endpoints. There's no charge for consent storage and no licence fee.

For any bank, 3,000 a month is a pilot, not a deployment. Use it to test one product line.

Reviews

Consentin itself has no reviews on G2, Capterra or Gartner Peer Insights yet. The only signal is a single Capterra India review of Leegality (4.0, 15 February 2023), and it's about document signing, not consent. For a bank, the Union Bank rollout below is a better test than any star rating.

Clients

Union Bank of India engaged Leegality to roll out Consentin. Cookie consent is already live on the bank's corporate website, and consent management and data discovery are being rolled out across its applications, on-prem or as SaaS (The Tribune, 14 Jul 2026). That's the vendor's account of the scope, so ask Union Bank's team how far it has got.

Summary

Pick Consentin if you're a public sector bank that wants on-prem, a public price to start from and a PSU peer you can call. It's not for banks that want independent user reviews of the consent product before they buy, because there aren't any yet. If you already sign loan documents on Leegality, the vendor relationship is there. Our DPDPA compliance tools roundup covers it alongside the broader suites.

3. Perfios DPDP Suite

Perfios is a lending-data company: bank statement analysis, underwriting and Account Aggregator data flows. It launched the DPDP Suite on 30 March 2026 (Perfios press release).

Features

• Modules: data discovery and classification, automated RoPA, consent governance, data principal rights management, cookie consent and database activity monitoring. Broad for a first release; I'd check how many are live in your deployment, not just on the slide.
• Consent lifecycle: modify, renew or revoke consent in real time, with "automated propagation across downstream systems", versioning and audit logs. That's test 3; make them show it against your dialler, not their demo CRM.
• Customer self-service portal to view all active consents and revoke or change them.
• Retention by purpose: retention and expiry rules can be set by data category and purpose, with exceptions handled by policy. That's test 2 on paper; see it run on a closed account.
• 22 scheduled languages.

One naming trap: Perfios calls the product "Perfios Consent Manager". Under DPDP, a Consent Manager is a registered third party acting for the customer, and Rule 4 registration only starts on 13 November 2026. Don't confuse the two in your board paper.

Pricing

Quote only.

Reviews

Nobody has reviewed the DPDP Suite yet, and it's only been on sale since March 2026. Perfios's one Gartner Peer Insights listing is Perfios Fraud Check and Verification, a different product with one rating from November 2023, so don't read anything into it.

Clients

Perfios supports "over 1000 institutions across 18+ countries" across its products, but none is named as a DPDP Suite bank. Ask for one.

Summary

Pick Perfios if you already use it in lending and want consent to follow the loan from account opening through underwriting, servicing and collections. It's not for banks that want a consent tool with no tie to their lending stack, or that need a public price. Branch and BC capture is the question I'd open the demo with.

4. OneTrust

OneTrust is a global privacy suite. For an Indian bank with overseas branches or NRI customers under GDPR, the appeal is one contract and one console.

Features

• Consent Management Platform (CMP) for banners and consent on websites, mobile apps and CTV, plus APIs "to collect and enforce consent" on other digital channels.
• Universal Consent & Preference Management (UCPM) to collect consent and preferences at every customer touchpoint and sync them to marketing systems.
• A wider suite: privacy automation, DSRs, third-party management and AI governance on the same platform.

The bank-specific gaps are branch or paper capture and showing a KYC hold next to a withdrawn marketing consent. OneTrust is built for global digital channels, not Indian branches, so make both demo questions.

Pricing

Quote-based. CMP pricing is "based on average daily visitors aggregated across all channels and properties", and UCPM is "based on total data subject profiles captured" (pricing). For a bank with tens of millions of customers, profile-based pricing is the line to model before you sign.

Reviews

• Users on G2 like the cookie controls and global coverage, and complain about complex setup, a clunky interface and steep price rises at renewal (G2, August 2025). It sits at 3.6 out of 5 from 17 reviews. I'd cap renewal increases in the contract.
• On Gartner Peer Insights there's no score worth quoting, but the latest critical review, from 26 October 2026, cites API limits, platform performance and changing support contacts. For a bank wiring consent into core systems, API limits are the complaint I'd take most seriously.
• On Capterra, people value the breadth and warn that setup needs real technical help. One put it plainly in May 2026: "This is not the kind of tool a technical marketer can implement and govern on their own".
• On Reddit, a founder on r/IndiaBusiness called it "way too complex, expensive, and slow" for a small team in a 2026 post. That's not a bank, but it's the risk a small or cooperative bank should weigh.

My read: OneTrust is a safe choice when you already run it and have staff to run it well. It's a hard choice for a bank starting from zero with a small team.

Clients

OneTrust doesn't name an Indian bank consent customer, so if you want a local reference, ask for one before the second meeting.

Summary

Pick OneTrust if you're a private or foreign bank with overseas branches that already runs OneTrust for GDPR. It's not for a small finance, payments or cooperative bank with a small privacy team. If you're weighing a move, read our OneTrust alternatives comparison.

5. KGreen Consent Management (KonneCX)

KGreen is a Thane-based BFSI security vendor, and its consent module is built "for banks to capture, manage and enforce customer consent across all communication channels". It's the only tool here written for cooperative banks first.

Features

• Five steps: capture, store by channel and purpose, enforce before each communication, monitor, then audit and evidence.
• Channels: SMS, email, WhatsApp, voice and print, each checked against valid consent before sending. This is KGreen's real strength: a message without valid consent never goes out.
• Maker-checker approvals on any change to a consent record.
• Withdrawal that, in KGreen's words, customers can make "as easily as they gave it" (the Act's test is comparable ease), with each grant and withdrawal stored as tamper-evident evidence.

I wouldn't count on this module for cookie consent, rights requests or a KYC hold shown next to a withdrawal. Ask KGreen before you sign, and budget for a second tool if you need those.

Pricing

Quote only.

Reviews

KGreen has no reviews on G2, Capterra, Gartner Peer Insights or Reddit yet, so the cooperative banks below are your real reviewers. Call one.

Clients

KGreen counts itself "Trusted by 80+ BFSI Institutions" and names cooperative banks including Rajkot Nagarik Sahakari Bank, Sharad Bank, Nav Jeevan Bank, Rajapur Urban Bank, Jijamata Mahila Bank and Dharangaon Bank (KGreen). Which of its products each bank runs isn't clear, so treat these as KGreen customers, not confirmed consent customers.

Summary

Pick KGreen if you're a cooperative bank whose most urgent risk is marketing messages going out without consent, and you want a vendor that already knows cooperative bank IT. It's not for a bank that needs cookie consent, rights requests or a wider DPDP suite in the same tool. Ask for a reference that runs the consent module, by name.

How to choose, by situation

You're a public sector bank with an on-prem mandate

Start with Consentin, which runs on-prem and has a PSU reference in Union Bank of India, and Redacto, which runs on-prem or in a private cloud. Make both show you a branch paper consent being digitised and withdrawn.

You're a private bank with overseas branches

If OneTrust already runs your GDPR programme abroad, test whether UCPM can hold Indian purposes, the 22 languages and a KYC hold. If it can't do that without a large services bill, run Redacto or Perfios for India and keep OneTrust for Europe.

You're a small finance or payments bank that is app-first

Your volume is in the app, so SDK quality and comparable-ease withdrawal under section 6(4) matter most. Redacto and Perfios both cover app capture. Start your Consentin pilot under the free tier if you want a price to compare against.

You're a cooperative bank with a small IT team

KGreen is the one vendor here that writes for cooperative banks, and its maker-checker model fits how you already work. If you need more than outbound message checks, put Redacto or Consentin next to it on the shortlist. Skip OneTrust unless someone else runs it for you.

Questions to ask in a bank demo

Don't accept slides. Ask the vendor to do these four things live, on sample data:

• Show a branch paper consent being digitised. Scan or type in a paper form, attach the notice version and language, and show it on the same record as the customer's app consent.
• Show a withdrawal stopping a DCA-registered promotional consent. Withdraw marketing in the app, then show the dialler, the SMS vendor and the export to the telecom side all updated, with timestamps.
• Show the KYC hold surviving a withdrawal. Withdraw every consent on a closed account and show the identity records still held for at least five years after the relationship ends (RBI KYC para 50), with the end date.
• Show the audit export. Produce the file you'd hand to the RBI inspector or the Data Protection Board for that customer: notices, consents, withdrawals, and which systems acted when.

If a vendor can't do the third one, it was built for a retailer, not a bank.

Related reading

• DPDPA compliance platforms for BFSI, for banks that need DSARs, DPIAs and vendor risk in one suite
• Consent management platforms in India, our pillar guide
• Cookie consent manager vs DPDP Consent Manager
• Best consent management tools for finance, for NBFCs, fintechs and insurers
• Top vendor risk management software for BFSI in India, for the processors your withdrawals have to reach