Consent Tree Research

The DPDP Sector Pulse.
Observed, not surveyed.

A quarterly report on how Indian organisations are tracking against the DPDP Act and Rules — measured from what their public web presence actually shows, not from what anyone says in a questionnaire. Published as sector aggregates only. No organisation is ever named.

FIRST EDITION: Q3 2026 · PUBLISHED SEPTEMBER 2026 · QUARTERLY THEREAFTER

THE PANEL

Built from the regulators’ own registers

The organisations we observe come from public regulatory registers — RBI, CERT-In, IRDAI, SEBI, FIU-IND — not from a purchased list or a convenience sample. Every row in the panel carries its source register, so the population each statistic describes is a matter of record, not of trust.

Registry-sourced · provenance recorded per organisation
THE INSTRUMENT

One scanner, frozen per edition

Signals are measured by the same outside-in scanner our platform runs every day: privacy notice presence and contents, a published grievance contact, a DPO contact, an Indian-language notice option, consent banner behaviour, a withdrawal control, trackers loading before consent, TLS. The check set is frozen for each edition and versioned in the methodology — trend lines only ever compare like with like.

Instrument version + validation results published per edition
THE HONESTY RULES

Three states, and a floor

Every statistic accounts for three states — signal present, signal absent, and could not assess — and all three are published, on the chart, not in a footnote. A sector appears only when enough organisations were actually assessed for a percentage to mean something; below that floor we print “insufficient panel this quarter”, never a number.

Minimum panel per published statistic: 30 organisations
The standing rules

What this report will never do.

Compliance readers get scared for a living. This series is built on the opposite premise, and these rules are permanent:

It will never name an organisation — or let you guess one.

No best-in-sector or worst-in-sector callouts, no quotes from any website, no cell sizes small enough to point a finger. Aggregates only, permanently.

It will never turn an unknown into a failure.

A site we couldn’t assess is published as exactly that. It never inflates a failure rate, and it visibly degrades our own headline instead of quietly disappearing.

It will never do penalty arithmetic.

No fine-amount headlines, no countdown clocks. Each finding ships with what good looks like — prevalence plus a path, not a threat.

It will never call anyone compliant or non-compliant.

DPDP compliance runs far deeper than any outside-in scan can see — consent records, retention, breach process. This is a sector barometer of public signals, stated as such. It is not an audit, and it carries no statutory recognition.

It will never be a survey in disguise.

Nothing in it is self-reported. Every statistic is an observation of a public surface, reproducible from the published methodology — check us.

Editions

Q3 2026, NBFC lending — the first edition.

Measured on 14 August 2026 with methodology v1: 711 licensed non-banking finance companies confirmed and measured, of 8,588 on the regulator’s register. Sector aggregates only. No organisation is named.

Read the report online → Methodology Table (CSV) ↓ Table (JSON) ↓

What you are getting, plainly.

  • The report, online and as a PDF. Read it on this site, or request the PDF below. The measured figures were taken on 14 August 2026 and have not changed since; the PDF’s own standing-rules table was updated on 18 September 2026 to record that the review below had completed.
  • The hand review is complete. 214 of the 715 confirmed company-to-website matches (30%, drawn in hash order so the draw can be re-derived) were checked one by one by a person at Consent Tree between 12 and 16 September 2026: 207 confirmed, 1 wrong (a site belonging to a different company — its measurement remains among the 711 and is not removed from this edition), 6 could not be told. This checked that each measured site belongs to the company named on the register; it did not re-score the per-check measurements by hand.
  • The aggregate table is published. Every figure in the report traces to a row of it, downloadable above as CSV or JSON.
  • Not yet done. The report has not had external legal review. No person has yet re-scored the per-check measurements; the methodology page states that gap in its validation section.
  • What it is not. Not an audit, not a compliance determination, no penalty arithmetic, no company named. Organisations may ask to be permanently excluded from the panel — honoured forever, no questions asked, at hello@consentree.in.

We send a 6-digit code to confirm the address is yours. When you confirm, we record your consent — for sending you this report, and, only if you tick it, for telling you about future editions — as a consent record in our own Consent Tree tenant, the same way our customers record theirs. The address is used for nothing else: never for sales outreach, never shared. The address is stored on Amazon Web Services in India, and the report email is sent through Microsoft 365. No mailing or marketing tool ever sees it. We keep the address for 90 days for the report, and for 730 days (two years) if you ticked edition updates, or until you withdraw, whichever comes first. We also keep a record that you gave consent, so we can show it. You can withdraw at any time at consentree.in/withdraw or hello@consentree.in. Nothing is recorded and nothing is sent until you confirm.

You are giving consent under the Digital Personal Data Protection Act, 2023. Trovance Ventures Private Limited is the Data Fiduciary. You can withdraw any consent at any time, as easily as you gave it, on the consent withdrawal page, or by writing to our Data Protection point of contact / Grievance Officer: Chandrasekhar G, cdpo@consentree.in, +91 9884092669. You may also complain to the Data Protection Board of India.