India DPDP: Overview

Concept: India DPDP guide | SDK: Python DPDP | Frameworks: Compliance overview

The India DPDP suite operationalizes the Digital Personal Data Protection Act, 2023 for AI systems. Where a one-shot compliance check answers “is this text compliant right now?”, the DPDP suite covers the full lifecycle of a data principal’s journey: detect Indian personal data, gate decisions against the Act’s obligations, record the events that prove compliance, track statutory deadlines, and produce audit-grade evidence on demand. All seven endpoints sit under one base path and return the same envelope, so you can adopt them incrementally — start with scan, add session and emit when you need stateful tracking, and reach for evidence at audit time.

https://api.responsibleailabs.ai/railscore/v1/compliance/dpdp

Two ways to run DPDP

RAIL ships the same DPDP capability on two paths with opposite data-flow guarantees. This page documents the hosted API.

Hosted (this API)

Your application sends content to api.responsibleailabs.ai. Multi-tenant, org-scoped, billed per call. Everything on this page runs here.

Enterprise self-hosted

The RAIL agent runs inside your own VPC or air-gapped environment; content never leaves your infrastructure. The same seven endpoints are mirrored there for single-tenant, licensed deployments.

The seven endpoints

Endpoint	Method	Credits	What it does
`/scan`	POST	0.5	Detect Indian PII (Aadhaar with Verhoeff checksum, PAN, UPI, mobile, and 6 more), child signals (S.9), and purpose drift (S.4). Detect, mask, or block.
`/evaluate`	POST	0.3	Deterministic `allow` / `block` / `require_action` gate for an action, mapped to DPDP S.4–S.16.
`/emit`	POST	0.1	Record 1–50 compliance events (consent, notice, DSR, breach). Auto-starts regulatory timers.
`/require`	POST	0.3	List the required actions for a given workflow step.
`/evidence`	POST	2.0	Generate an audit-grade evidence packet (DSR response, breach notification, consent audit, SDF annual report). Pro+ plans.
`/session`	POST	0	Create or retrieve a stateful compliance session for one data-principal journey.
`/timers`	GET	0	List regulatory deadline timers, filtered by status, type, or how soon they are due.

Billing on every DPDP route is fire-and-forget by design — a billing hiccup never blocks a compliance decision. Use /verify for a pre-flight balance check when you need one. session and timers are always free.

How the pieces fit together

A typical integration threads a single session through the user’s journey. Events you emit mutate the session state and start the statutory timers; scan and evaluate make in-the-moment decisions; evidence reads the accumulated trail when an auditor or regulator asks.

Response envelope

Every endpoint returns the same two-key envelope. result holds the endpoint-specific payload; credits_consumed reports what the call cost.

{
  "result": { "...": "endpoint-specific" },
  "credits_consumed": 0.5
}

Authentication

All routes require a Bearer token — an API key (rail_...) or a JWT. Pass it on every request:

-H "Authorization: Bearer YOUR_RAIL_API_KEY"

A complete walkthrough

The flow below tracks one loan-application journey end to end. It uses curl; the Python SDK mirrors every call as client.dpdp.*.

Open a session

A session ties events, scans, and timers to one data-principal journey. config.purpose is required.

curl -X POST https://api.responsibleailabs.ai/railscore/v1/compliance/dpdp/session \
  -H "Authorization: Bearer YOUR_RAIL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "action": "create",
    "config": { "purpose": "loan_advisory", "entity_type": "data_fiduciary" }
  }'

The response returns a session_id you reuse on later calls.

Record notice and consent

emit writes the events that later prove you met your notice (S.5) and consent (S.6) obligations.

curl -X POST https://api.responsibleailabs.ai/railscore/v1/compliance/dpdp/emit \
  -H "Authorization: Bearer YOUR_RAIL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "session_id": "sess_1a2b3c",
    "events": [
      { "type": "notice.shown", "data": { "user_id": "u_42" } },
      { "type": "consent.granted", "data": { "user_id": "u_42", "purpose": "loan_advisory" } }
    ]
  }'

Scan content for Indian PII

Before storing or sending model output, scan it. pii_action can detect, mask, or block.

curl -X POST https://api.responsibleailabs.ai/railscore/v1/compliance/dpdp/scan \
  -H "Authorization: Bearer YOUR_RAIL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "content": "Applicant PAN ABCDE1234F, mobile 9876543210.",
    "config": { "pii_action": "mask", "purpose": "loan_advisory" }
  }'

Gate the decision

evaluate returns a deterministic verdict for the action you are about to take.

curl -X POST https://api.responsibleailabs.ai/railscore/v1/compliance/dpdp/evaluate \
  -H "Authorization: Bearer YOUR_RAIL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "action": "make_decision",
    "context": { "user_id": "u_42", "purpose": "loan_advisory" },
    "session_id": "sess_1a2b3c"
  }'

A verdict of require_action tells you to call /require for the outstanding obligations.

Track deadlines and produce evidence

When a data principal exercises a right or a breach occurs, emit starts the statutory timer; timers lists what is approaching; evidence assembles the audit packet.

# A rights request starts the S.13 response clock
curl -X POST https://api.responsibleailabs.ai/railscore/v1/compliance/dpdp/emit \
  -H "Authorization: Bearer YOUR_RAIL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "events": [ { "type": "dsr.received", "data": { "user_id": "u_42", "request_id": "r_9" } } ] }'

# What is due in the next 30 days?
curl "https://api.responsibleailabs.ai/railscore/v1/compliance/dpdp/timers?status=active&approaching_days=30" \
  -H "Authorization: Bearer YOUR_RAIL_API_KEY"

Errors

DPDP routes use standard HTTP status codes. Validation problems return 400 with an error message; evidence on a plan below Pro returns 403 with code: TIER_INSUFFICIENT.

{ "error": "Evidence generation requires Pro+ tier.", "code": "TIER_INSUFFICIENT" }

The DPDP suite never logs raw content or detected PII values — only a truncated, non-identifying snippet for analytics. Aadhaar, PAN, and other identifiers are masked or dropped before anything is written.

Where to go next

India DPDP guide

The concepts behind the suite: obligations, lifecycle, and which endpoint maps to which section of the Act.

Python SDK: DPDP

Every endpoint as a typed client.dpdp.* method, plus client-side PII scanning and the system audit.

Scan endpoint

Indian PII detection, child signals, and purpose drift in detail.

Evidence endpoint

Audit-grade packets for DSR, breach, consent, and SDF reporting.

Reference

Scoring

Compliance

Agent

Introspection & status

India DPDP: Overview

Two ways to run DPDP

Hosted (this API)

Enterprise self-hosted

The seven endpoints

How the pieces fit together

Response envelope

Authentication

A complete walkthrough

Errors

Where to go next

India DPDP guide

Python SDK: DPDP

Scan endpoint

Evidence endpoint

​Two ways to run DPDP

Hosted (this API)

Enterprise self-hosted

​The seven endpoints

​How the pieces fit together

​Response envelope

​Authentication

​A complete walkthrough

​Errors

​Where to go next

India DPDP guide

Python SDK: DPDP

Scan endpoint

Evidence endpoint

Two ways to run DPDP

The seven endpoints

How the pieces fit together

Response envelope

Authentication

A complete walkthrough

Errors

Where to go next