DPDP Consent and the PII Access Log

How consent is captured for e-signing and marketing, and how sensitive-data access is recorded.

What this covers

India’s Digital Personal Data Protection Act, 2023 expects you to capture clear consent, honour withdrawal and keep a record of who handled sensitive data. Oris Work includes a few building blocks for this. They support your compliance work; they do not replace advice from your own counsel.

1. Consent when a client e-signs a letter

When an engagement letter includes the "Data Protection & Confidentiality" clause, the signing page shows an extra required checkbox stating consent under the Digital Personal Data Protection Act, 2023.
The client cannot sign without ticking it.
Oris Work records that consent was given and the time it was given, alongside the signature details.

2. Marketing and outreach consent

In the Growth area, every outbound message goes through a single queue (Growth → Outbound).
Before a message is sent, Oris Work checks there is an active consent for that exact channel and purpose. Consent given for one purpose does not allow another.
Messages without consent are not sent. They show as "Suppressed" with a reason such as "no consent", and there is no override switch.
Nothing is sent without either a person approving it or a channel you have explicitly switched to auto-send.

3. PII access log

Reads of a client’s PAN are written to an access log (who, which field, which workspace, purpose, time). See Data Encryption and PAN Handling for the details.

4. Data subject requests

The platform supports access, correction and erasure requests from individuals. A request is filed with a reference number, and only a workspace admin can fulfil it, and only for their own workspace. There is no dedicated screen for this in the app today, so if a client asks for their data to be exported or erased, contact your Oris Work support contact to run it.

What you should do

Keep your own consent wording clear and recorded; do not message people who have not agreed.
Leave the Data Protection clause in your engagement letter templates if you hold clients’ personal data.
Review who has access to client profiles (Custom Roles).
Read our public Privacy Policy for how Oris Work itself handles data.

Related guides

Data Encryption and PAN Handling

What Oris Work stores encrypted, how PAN is protected, and what never leaves in an export.

How Workspaces Are Kept Separate

A plain-language overview of how one firm’s data is kept apart from another’s.

Campaigns basics

Write an email campaign, choose exactly who gets it, send yourself a test, send or schedule it, and read the results.

Signing documents online

Review and sign engagement letters, proposals and contracts from your phone or computer.