API: India DPDP overview | SDK: Python DPDP
The vocabulary
- Data Principal — the individual whose personal data is processed.
- Data Fiduciary — the organization that decides why and how data is processed (you).
- Significant Data Fiduciary (SDF) — a fiduciary the government designates as higher-risk, with extra duties (audits, DPO, impact assessments).
- Personal data — anything that identifies an individual. In India this prominently includes Aadhaar, PAN, UPI IDs, and mobile numbers.
Obligations RAIL helps you meet
| Obligation | DPDP section | How RAIL helps |
|---|---|---|
| Notice before processing | S.5 | emit a notice.shown event; it is retained as evidence. |
| Consent, and easy withdrawal | S.6 | emit consent.granted / consent.withdrawn; evaluate blocks actions that lack a lawful basis. |
| Purpose limitation | S.4 | scan detects purpose drift — content that strays from the declared purpose. |
| Data minimization & accuracy | S.8 | scan surfaces Indian PII so you can mask or drop what you do not need. |
| Children’s data (no tracking, no targeted ads) | S.9 | scan flags child signals; evaluate blocks profiling of minors. |
| Data principal rights (access, correction, erasure) | S.11–S.14 | emit a dsr.received event to start the statutory response clock; timers tracks it. |
| Breach notification | S.8(6) | emit breach.detected to start CERT-In and Data Protection Board timers. |
| SDF additional duties | S.10 | evidence produces the SDF annual report packet. |
The compliance lifecycle
A session is the thread that ties one data principal’s journey together. Events accumulate on it, timers start from those events, and evidence is assembled from the resulting trail.Which operation do I reach for?
I have model output to publish
Scan it for Indian PII, child signals, and purpose drift — then detect, mask, or block.
I am about to act on personal data
Evaluate the action for a deterministic allow / block / require_action verdict.
Something happened I must record
Emit the event (consent, DSR, breach). Statutory timers start automatically.
An auditor is asking for proof
Generate evidence — a packet built from the session’s recorded trail.
Hosted vs. enterprise
The same DPDP capability is available two ways. On the hosted API your application sends content to RAIL. In enterprise self-hosted deployments the RAIL agent runs inside your own environment and content never leaves it — appropriate when data residency or air-gapping is required. The endpoint contract is identical, so code written against one runs against the other.Related
India DPDP API overview
The seven endpoints, credit costs, and a complete walkthrough.
Compliance frameworks
How DPDP sits alongside GDPR, CCPA, HIPAA, and the EU AI Act.