Programs designed with the cost per outcome right, before the budget locks.
Find out what people will actually do, before you build for what you assumed.
Purpose-built systems that work on the ground, not only on the dashboard.
Field operations that turn a plan on paper into work on the ground.
Consent that people understand. From wherever you are, to fully compliant: a consent platform connected to every system you run, and a team that walks the whole way with you through strategy, design, technology and change on the ground.
White-label · Multilingual · Works offline · DPDP Act 2023 and Rules 2025 · Data in India
Watch the videoCommons Trust, from consent to compliance · 3 minScrollWhat we offer
Commons Trust is three portals: one for your DPO, one for the people whose data you hold, and one for your staff. Around it sits the work that makes it real.
A DPO dashboard, a data principal portal and a staff portal, white-label and hosted in India.
Every question tied to the Act, answered by the team that owns it, with “I do not know” counted as a gap.
Purposes and lawful basis, notices and policies, vendor contracts, children's data, board briefings and breach drills.
Fix the gaps, roll out the platform, train your people, and be audit ready.
3 to 12 months
The platform your DPO opens every morning.
DPDP compliance is not a tool you switch on. It is a change in how your organisation collects, uses and lets go of people's data. We walk it with you end to end: our team does the thinking and the training, and Commons Trust keeps it running every day after.
Know where you stand
Decide how you will work
Connect every system
Work on the ground
One to twelve months end to end, depending on your size and pace. Plan your timeline. Already have advisers, or a system? Take the platform on its own, or the consulting on its own.
A talk explains the law. A lawyer writes the policy. Software records the consent. Compliance needs all of it, connected, and someone who stays until it is done.
Getting compliant takes one to twelve months, depending on your size and pace. Plan back from 13 May 2027, not towards it.
The record your DPO keeps, and the moment it was made: a notice read aloud in the field, and a separate choice for each purpose.
What the law asks, and where it lives in the product.
Plain, itemised and multilingual, with audio for people who do not read.
Free, specific and informed: a separate choice for each purpose.
Verifiable parental consent, checked by OTP, ID or family record.
Access, correction, erasure and grievance, with a timer on each.
Keep only as long as needed, and erase on schedule.
Tell the Board, and tell the people affected, in their language.
A portal in the person's own name: what data you hold, which purposes they have agreed to, and a way to change their mind that actually takes effect.
Most mistakes with personal data are made by kind people in a hurry. The staff portal gives every person a short course in their language, the policies they need to sign, and a clear answer before they share anything.
Discover the systems that hold personal data, classify what is in them, set retention before collection, and manage the vendors who touch it.
A baseline assessment with every question tied to the Act, answered by the team that owns that part of the work, and a plan that comes out of it on day one.
Four promises that hold on every screen, for every user, from the first sign-up to the last report.
Your platform, your name.
In the language people speak.
Built for patchy networks.
Consent first, on every screen.
Most personal data enters your organisation on the first day.
Children's data needs a parent's yes, checked properly.
Supporters expect the same respect as the people you serve.
Research data is often the most sensitive you hold.
People reach you where they are, not on a web form.
A complaint is a chance to fix things.
Saying no should be as easy as saying yes.
Some people need someone to act for them.
Leaders are accountable for data, so they need to see it.
Your vendors handle your data too.
Minutes matter when data leaks.
Privacy is easier when it is designed in from the start.
Four things every organisation needs first.
Plain, itemised and multilingual, with audio for people who do not read.
Free, specific and informed, and as easy to take back as to give.
Access, correction, erasure and grievance, from the portal, WhatsApp or the helpline, with a timer on each.
Every notice version, consent and change, in one download.
Every person whose name sits in your systems deserves the same respect.
01The people your programmes serve, who gave their data on day one.
02Whose data needs a parent's verified yes, and no tracking at all.
03Who chose email, WhatsApp or SMS, separately, and can change it.
04Whose records are kept only as long as the programme needs them.
05Who consented to one study, and whose names come off after analysis.
Gender Equality
Industry, Innovation and Infrastructure
Reduced Inequalities
Peace, Justice and Strong Institutions
Partnerships for the GoalsEvery feature
Consent
Rights and records
Governance
Pieces of the product teams open every day.
1,312
Active in 18 states
1,18,240
Open any one to see it in the product.
Plain, itemised, multilingual notices with audio, versioned every time they change.
Purpose-wise consent across every programme, with the ledger behind it.
One queue for the portal, WhatsApp and the helpline, with a timer on each.
Every system that holds personal data, what is in it, and when it should go.
Log, assess, notify and learn, against the clock the law sets.
Their own view of what you hold, and a withdrawal that takes effect everywhere.
Check consent through an API before any system uses data. Connects to your beneficiary apps, CRM, surveys, WhatsApp and SMS, and to every Commons product.
Priced by the number of people whose data you hold. Take the platform, the consulting, or both as one engagement. Every plan is white-label and hosted in India: your name on every notice, consent screen and request portal.
For small organisations getting started
Custom
For programmes with lakhs of beneficiaries
Custom
For networks, foundations and significant data fiduciaries
Custom
“Tell us how your programme runs today. We will show you the product on your own workflow, and be honest about whether it fits.”
Three organisations, three starting points, one way of working.
CSR foundation · India · 6 months9 of 12partner NGOs assessed as DPDP-readyRead the case study →Education nonprofit · Delhi · 3 months82%of about 80,000 students' families consented on WhatsApp or an automated callRead the case study →Livelihoods nonprofit · Andhra Pradesh · 11 months so far64 to 12registration and survey fields, trimmed to purposeRead the case study →Yes. Any organisation that processes digital personal data in India is a data fiduciary, whether it sells products or serves communities.
Yes. Notices can be read aloud by a field worker, consent captured offline in the app, and a copy sent by SMS. Paper forms can be scanned and logged.
The system asks for verifiable consent from a parent or guardian, checked by OTP, ID or family record, and blocks tracking or targeting of children.
No. It is a system that makes compliance practical. We work with your legal advisers to set purposes, retention and notices for your organisation.
Yes; we stay through launch until your team runs it.
Yes. Most organisations hire us for the whole journey, because the same team that finds the gaps sets up the platform and trains the staff. But you can take Commons Trust on its own, or our assessment and advisory on its own, and add the other later.
One to twelve months, depending on how much data you hold and how many teams touch it, in four stages: strategy, design, technology, and change on the ground. You get the platform, a named team, training in your language, and a readiness review every quarter.
Beneficiary, donor and volunteer data handled with care.
Grantee and beneficiary data across partners.
Consent captured offline, in every language.
One consent layer across many systems.
“Consent is not a checkbox. It is a promise to every person whose story sits in your database.*”
Project management for nonprofits: organise teams, volunteers and partners into projects and tasks, with lists, boards, timelines, portfolios, goals and a field app that works offline.
Conversational analytics: ask any question about your programmes in plain English and get live reports on learning, livelihoods and more.
Surveys for the social sector: build in minutes, collect on web, WhatsApp and an Android app that works offline, check quality as answers arrive.
Grant management for grant makers and grant seekers: calls for proposals, AI review, due diligence, milestone tranches and reports, plus an AI proposal writer for nonprofits.
HR, payroll and an intranet in one place, for nonprofits, startups and enterprises, on the web and mobile, with AI built in.
We implement Tally, Zoho Books, Frappe / ERPNext and Odoo, connect them to your programmes, payroll and donations, and add a custom screen on top where it helps.
Create your account, or talk to us about the whole journey: the platform, the advice and the people who stay until it runs.
