DPDP Compliance Toolkit

Record-keeping infrastructure for India's Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023), and the Rules made under it.

Consent and rights are not states you can infer later. If a Data Principal asks what they agreed to, or a regulator asks how a grievance was handled, the answer has to already exist. This module keeps that record.

Consent records

An append-only ledger of what was agreed: the purpose, the Data Principal, whether consent was granted or refused, the language and version of the notice shown, and where it was collected.

• Purpose-bound. Section 6(1) limits consent to a specified purpose and to the data necessary for it, so purpose is a required field rather than a general-purpose flag. Consent to one purpose says nothing about another.
• Notice language is part of the record. Section 5(3) entitles a Data Principal to the notice in English or any language in the Eighth Schedule, so which language was actually read is recorded, along with which version of the text.
• Withdrawal is additive. Withdrawing stamps the entry rather than deleting it, so the original terms remain producible afterwards. Consent records have no edit form, and the listing offers no edit or delete operation.
• Refusals are recorded too. Being able to show that a refusal was honoured matters as much as showing consent.
• Guardian consent. Section 9(1) requires verifiable consent of a parent or lawful guardian before processing a child's data, or that of a person with a disability who has a lawful guardian. Rules 10 and 11 prescribe different manners for those two cases, so the record keeps them distinct instead of collapsing both into one minor flag.

Data Principal requests

Access (s. 11), correction, completion, updating and erasure (s. 12), grievance redressal (s. 13) and nomination (s. 14), tracked from receipt to a recorded outcome with the elapsed time kept.

Rejecting a request requires recorded reasons. Reopening a closed request clears the stale response time, so the elapsed figure cannot understate how long someone actually waited.

Permissions

Reading the ledger, appending to it and withdrawing consent are separate permissions, as are viewing rights requests and deciding them. An auditor can be given sight of the evidence without the ability to change it. Deletion stays with administrators, because a deleted record leaves no trace that consent was given or a right exercised.

What this module does not do

It does not make a site compliant. Compliance depends on your lawful basis, policies, retention practice and conduct. This module stores evidence of some of those things; it does not produce or guarantee them.

It does not render consent interfaces. That is solved by Klaro and EU Cookie Compliance. Use one of those for the interaction and this module for the record. Other modules record consent through the dpdp.consent_recorder service rather than writing entities directly.

It does not execute rights requests. Recording that an erasure was requested and completed is not the same as erasing the data. The module tracks the obligation; carrying it out across your systems remains yours to do.

Why not the existing GDPR modules

Several duties under the Act have no GDPR counterpart:

• Consent Manager — section 2(g) defines a registered intermediary with no GDPR equivalent.
• Notice language — the Eighth Schedule entitlement has no analogue.
• Grievance redressal and nomination — rights with no GDPR counterpart.
• Guardian consent — covering both children and persons with lawful guardians, under separately prescribed manners.

Related

Cyber Incident Register carries the clocks when something goes wrong. A breach engages both: this module holds the consent and rights position, that one tracks the reporting deadlines, including the DPDP breach intimation under section 8(6) and rule 7, alongside CERT-In and the GDPR.

Requirements

Drupal 11. No third-party libraries.

A note on the instruments

Section references here were checked against the Gazette text of the Act, and of the Digital Personal Data Protection Rules, 2025, notified as G.S.R. 846(E) on 13 November 2025.

That repeatedly mattered. The seventy-two hour breach window widely attributed to the Act appears nowhere in it; it is in rule 7(2)(b) of the Rules, and breach intimation is in fact staged rather than single.

Rule 8 has two limbs, and only the first is a ceiling. Rule 8(1) gates an erasure duty to the classes of Data Fiduciary listed in the Third Schedule, which covers specific large operators rather than every site. Rule 8(3) runs the other way: a minimum of one year's retention, for the purposes listed in the Seventh Schedule, gated by purpose rather than by class or size. Rule 6(1)(e) separately requires a year of the logs used to detect and investigate unauthorized access. So a recorded withdrawal is not by itself authority to delete.

Verify anything load-bearing against the Gazette rather than against summaries, including this one.

Disclosure

AI assisted in writing this module's code, tests and documentation.

It decided none of the substance. Every statutory claim here was read from the Gazette text rather than from a summary, which is the whole point of the module: the seventy-two hours everyone attributes to the Act is in rule 7(2)(b) of the Rules, and rule 8 carries a retention floor as well as an erasure duty. Permissions and access handlers were reviewed by hand. The test suite runs against a real Drupal 11 install rather than being assumed to pass.