DPDP Compliance Toolkit

Record-keeping infrastructure for India's Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023).

The module keeps two kinds of durable record that a Data Fiduciary is responsible for being able to produce:

**Consent records** — an append-only ledger of what a Data Principal agreed to, for which purpose, in which language, against which version of the notice, and when. Consent is purpose-bound under section 6(1), so purpose is a required field rather than a general-purpose flag. Withdrawal is recorded against the entry rather than deleting it, so the original terms survive and can still be produced as evidence.

**Data Principal requests** — access (s. 11), correction, completion, updating and erasure (s. 12), grievance redressal (s. 13) and nomination (s. 14), tracked from receipt to a recorded outcome with the elapsed time kept. Rejections require recorded reasons.

What this module does not do

It does not make a site compliant. Compliance depends on the operator's lawful basis, policies, retention practice and conduct. This module stores evidence of some of those things; it does not produce or guarantee them.

It also does not render cookie banners or consent interfaces. That is already solved by Klaro and EU Cookie Compliance. Use one of those for the interaction and this module for the record.

Why not the existing GDPR modules

Several obligations under the Act have no GDPR counterpart:

• Consent Manager — section 2(g) defines this as "a person registered with the Board". There is no GDPR equivalent.
• Notice language — section 5(3) requires the Data Principal be given the option to access the notice in English or any language specified in the Eighth Schedule to the Constitution, so the language a notice was read in is part of the record.
• Grievance redressal and nomination — rights with no GDPR analogue.
• Breach reporting — section 8(6) applies "in the event of a personal data breach" with no materiality threshold.

Integration

Other modules record consent through the dpdp.consent_recorder service rather than writing entities directly.

Requirements

Drupal 11. No third-party libraries.

A note on the statute

Section references were checked against the Gazette text published by MeitY. Commencement dates, breach-reporting deadlines and penalty figures are not settled by the Act alone — several are left to the Rules, and secondary commentary about them is inconsistent. Verify anything load-bearing against the Gazette rather than against summaries, including this one.