Digital Personal Data Protection Act, 2023
India's DPDP Act governs how digital personal data of individuals in India is collected and processed. It centres on clear notice, free and specific consent, purpose limitation and the rights of data principals.
Example finding{
"rule": "dpdp.consent-capture",
"framework": "DPDP",
"severity": "high",
"file": "app/api/signup.ts",
"check": "Consent capture with timestamp and version",
"status": "failed",
"fix": { "available": true, "files": 2 }
}What DPDP expects from engineering.
- 01
Notice and consent
Collect consent that is free, specific, informed and unambiguous, with an itemised notice of the data and purpose.
- 02
Purpose limitation
Process personal data only for the purpose consented to, and stop when consent is withdrawn.
- 03
Data principal rights
Support access, correction, completion and erasure requests, plus grievance redressal.
- 04
Retention and erasure
Erase personal data once the purpose is served, unless retention is required by law.
- 05
Children's data
Obtain verifiable parental consent and avoid tracking or targeted advertising directed at children.
- 06
Breach intimation
Notify the Data Protection Board and affected individuals of personal data breaches.
Turned into code rules.
- Consent capture with timestamp and version
- Purpose tags on personal data fields
- Erasure and correction endpoints
- Retention jobs for stale records
- PII redaction in logs
Read the source.
RuleFix links to primary sources so you can check the requirements yourself. We are not affiliated with these bodies.
Cover more with the same workflow.
GDPR
HIPAA
LGPD
Ship AI-powered products
that are compliant by design.
Join developers building with RuleFix.