How ConsentIQ Proves Consent Without Storing Personal Data
ConsentIQ is data-blind by design: a consent record stores only a keyed one-way hash of the data principal's identifier, never the email or phone itself. Consent is captured as a signed, MeitY-aligned artefact, and a Data Protection Officer can still search and prove consent in real time, without the stored data ever being read in the clear. The record can be verified by anyone, using a published key, without ConsentIQ being in the loop.
Source: IQWorks Research | Last updated: July 2026
A consent database is one of the quietest liabilities in a privacy program. To prove that a person agreed to a purpose, most platforms keep a row that ties that person's email or phone number to a timestamp and a purpose. The proof and the personal data live together. Every one of those rows is now something to secure, to include in a data subject request, and to account for in a breach.
ConsentIQ was built to break that link. The consent record proves what was agreed without holding who agreed in readable form.
What "data-blind" means here
When a data principal gives consent, ConsentIQ takes the identifier used to reach them — an email address or a phone number — and puts it through a keyed one-way hash at the point of collection. What gets written to the consent record is the hash, never the plaintext identifier. The hash cannot be reversed back to the email or phone, and without the key it cannot be recomputed by anyone else.
The record itself is a signed artefact modelled on India's MeitY Electronic Consent Framework: it carries the collector, the data consumer, the purpose, the data items, and the hashed identifier, wrapped in a cryptographic signature. It is the evidence of consent, and it is legible to auditors and regulators.
This is a narrower and more honest claim than "we store no personal data at all." The tamper-proof consent record is hash-only. Say a lender collects consent for an education loan: the signed artefact that proves that consent holds a hash, a purpose, and a signature — not the applicant's email.
Searching for consent without seeing the person
The obvious objection to hashing everything is that you can no longer look anyone up. ConsentIQ handles this the same way it handles collection.
When a DPO needs to answer "did this person consent, and to what?", they search by email or phone in the console, and a match returns the consent record — found, and verified — in real time, with the identifier shown only as its truncated hash. The person is located without their personal data ever being read back from storage for the match.
Proof that outlives the platform
Storing consent is easy. Proving it later, to someone who does not trust you, is the hard part. ConsentIQ signs each artefact and chains it into a tamper-evident audit log. Altering a past record breaks the chain, and the console flags the mismatch.
The signatures are portable. Alongside the platform's internal integrity signature, each artefact can carry a second signature verifiable against a public key that ConsentIQ publishes. A regulator, an auditor, or a counterparty can verify a receipt independently, without an account and without asking ConsentIQ anything.
Records export in the formats that downstream systems and standards expect:
| Export format | What it is for |
|---|---|
| A human-readable consent receipt for records and disclosure. | |
| W3C Verifiable Credential (JSON-LD) | A machine-verifiable credential for interoperable, cryptographically checkable consent. |
| Kantara Consent Receipt | The established consent-receipt standard for portability across systems. |
| MeitY-aligned artefact (JSON) | The India-specific Electronic Consent Framework profile. |
Verifying who the person is, without keeping their data
Some consent needs an extra check before it is valid. Under India's DPDP Act, processing a child's personal data requires verifiable parental consent. ConsentIQ uses DigiLocker eKYC to verify age and, where needed, a parent or guardian — over a standard OAuth flow — so the consent that gets signed is one that actually holds up. The verification confirms the fact the regulation asks for, and the record stays data-blind.
Why this is the right default
A consent platform accumulates records for years. Treating each record as a small container of personal data means the store grows into a target, and every data subject request and breach assessment has to reckon with it. Treating the record as a signed, hash-only artefact means the proof is durable and portable while the personal data is not sitting inside it.
Key Takeaways
- Consent records store a keyed one-way hash of the identifier, not the email or phone itself.
- Consent is captured as a signed, MeitY-aligned artefact and chained into a tamper-evident audit log.
- A DPO searches by email or phone and gets a verified match in real time — the person is found without their data being read back.
- Each artefact can carry a portable signature, verifiable against a published key by any third party.
- Records export as PDF, W3C Verifiable Credential, Kantara Consent Receipt, and a MeitY-aligned JSON artefact.
- DigiLocker eKYC verifies age and guardian consent for children under the DPDP Act.
ConsentIQ keeps the evidence of consent and lets go of the personal data that usually travels with it. See it in your own environment: book a ConsentIQ demo and proof of concept.
Ready to automate your compliance?
See how IQWorks helps enterprises manage data protection at scale.
Request Demo
